CVE-2026-83252

Unauthenticated HTTP Access Enables Data Exposure and Partial Denial of Service in Oracle Commerce Guided Search

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Commerce Guided Search / Oracle Commerce Experience Manager Commerce Guided Search \/ Oracle Commerce Experience Manager

CVE-2026-48975

HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repo_maintenance_entry.go use UpdateOneID(id) and DeleteOneID(id) without verifying that the maintenance entry belongs to the authenticated user's active group. An authenticated low-privileged user who knows or enumerates another tenant's maintenance-entry UUID can overwrite that record or permanently delete it. This issue is fixed in version 0.26.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Sysadminsmedia

Products

Homebox

CVE-2026-94368

Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 (SigV4). Due to improper validation, the service fails to reject requests containing unsigned x-amz- headers, instead simply dropping them from the signature calculation. This allows an attacker who possesses a valid presigned PUT URL to add an unsigned x-amz-copy-source header, effectively converting a simple upload into a CopyObject operation. This can lead to unauthorized access and copying of any data the original signer is permitted to reach across the entire storage system.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Data Foundation

CVE-2026-94112

mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Mayswind

Products

Ezbookkeeping

CVE-2026-94106

getID3 before 1.9.26 OS Command Injection via Unescaped Filenames

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

CVSS 4.0 · 8.7 High EPSS 1.7% KEV · Not listed

Vendors

Getid3

Products

Getid3

CVE-2026-94033

SourceCodester Drug Recommendation System User Management add_user cross site scripting

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drug_recommender/Admin/add_user of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Drug Recommendation System

CVE-2026-93991

Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Argoproj

Products

Argo-workflows Argo Workflows

CVE-2026-93981

hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Hono

Products

Hono

CVE-2026-93980

code-projects Internship Management System Admin Login Form login.php sql injection

A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php of the component Admin Login Form. Executing a manipulation of the argument Password can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Internship Management System

CVE-2026-93975

code-projects Assessment Management User Editing edit-user.php cross site scripting

A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Assessment Management

CVE-2026-93965

aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpoint_or_command causes command injection. The attack may be initiated remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. To fix this issue, it is recommended to deploy a patch. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS 4.0 · 5.1 Medium EPSS 1.9% KEV · Not listed

Vendors

Aiyiyi121

Products

Sxdevops

CVE-2026-93955

grimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorization

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. Issue #2431 is closed as completed, but its only comment states that the issue “has already been reported elsewhere.” No fixing commit or pull request is identified there.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Grimmory-tools

Products

Grimmory

CVE-2026-93872

Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chains.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti Cotonti Siena Siena

CVE-2026-93737

Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Azkaban Azkaban Project

Products

Azkaban Azkaban

CVE-2026-93688

SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstrap_room values to exhaust prefill process memory until out-of-memory termination.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Lmsys Sgl-project

Products

Sglang Sglang

CVE-2026-93685

Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and command-line details, after completing a basic encrypted connection. This vulnerability does not enable direct remote code execution.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Acm Advanced Cluster Management For Kubernetes

CVE-2026-93605

vm2 NodeVM before 3.12.1 Remote Code Execution via child_process

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Patriksimek Vm2 Project

Products

Vm2 Vm2

CVE-2026-93595

ArcadeDB before 26.9.1 ACL Bypass via query_database Tool

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowing authenticated users to read data they are explicitly denied at the per-type level. Attackers can prompt the AI assistant to execute queries against restricted types or buckets to retrieve sensitive data that would be rejected through normal query endpoints.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Arcadedata

Products

Arcadedb

CVE-2026-93456

django-page-cms through 2.0.13 CSRF via admin mutation views

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Batiste

Products

Django-page-cms

CVE-2026-93292

SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Signoz

Products

Signoz