CVE-2026-111573

Privilege escalation via unprotected Windows agent data folder

Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's plugins or local folders, and to read the agent controller's private key.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Checkmk

Products

Checkmk

CVE-2026-106143

Cross-Site Scripting in Progress Software Kendo UI for Vue

Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via an unsafe URL entered in the Insert Link or Insert Image dialog, which runs when the user clicks the resulting link.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Vue

CVE-2026-105422

Path Traversal in TÜBİTAK BİLGEM's pardus-boot-repair

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal. This issue affects pardus-boot-repair: from 1.0.9 before 1.1.0.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Tubitak Bilgem Software Technologies Research Institute

Products

Pardus Boot Repair

CVE-2025-15400

OpenPix < 2.13.6 - Subscriber+ Payment Gateway Settings Reset

The OpenPix for WooCommerce WordPress plugin before 2.13.6 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openpix Wordpress

Products

Pix Para Woocommerce Wordpress

CVE-2026-111260

Apache TomEE: Predictable OpenID Connect state and nonce values

The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's account, and the replay protection for ID tokens is weakened. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-111261

Apache TomEE: Authentication bypass with empty password in LDAP identity store

The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-111262

Apache TomEE: LDAP injection in LDAP identity store

The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribute values, or influence which directory entry the login is validated against. Only applications using the LDAP identity store are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-111263

Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web application

Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its own web.xml security constraints or EJB method permissions. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-111264

Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method

The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-92910

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Adobe Commerce B2b Commerce and 3 more

CVE-2026-92911

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Adobe Commerce B2b Commerce and 3 more

CVE-2026-92922

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Adobe Commerce B2b Commerce and 3 more

CVE-2026-95631

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Adobe Commerce B2b Commerce and 3 more

CVE-2026-103855

Dimension | NULL Pointer Dereference (CWE-476)

Dimension is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Dimension Macos Windows

CVE-2026-103854

Dimension | Stack-based Buffer Overflow (CWE-121)

Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Dimension Macos Windows

CVE-2026-103853

Dimension | Out-of-bounds Read (CWE-125)

Dimension is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Dimension Macos Windows

CVE-2026-103852

Substance3D - Stager | NULL Pointer Dereference (CWE-476)

Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Substance 3d Stager Macos Windows

CVE-2026-103851

Substance3D - Stager | Stack-based Buffer Overflow (CWE-121)

Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Substance 3d Stager Macos Windows

CVE-2026-103850

Substance3D - Stager | Out-of-bounds Read (CWE-125)

Substance3D - Stager is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Substance 3d Stager Macos Windows

CVE-2026-103848

Adobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 9.9 Critical EPSS 1.4% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager