CVE-2026-65925

Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-65617

Potential remote code execution on an Artifactory package service container.

A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-65922

Potential unauthorized modification of Artifactory internal metadata

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is not affected.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-48052

Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request

Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of the ":organizationId" in the URL, but the repository write filters on tag.id alone, so the URL-level org scope never reaches the database. This issue has been patched in version 26.5.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Papra-hq

Products

Papra

CVE-2026-64641

Next.js: Denial of Service in App Router using Server Actions

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Vercel

Products

Next.js

CVE-2026-66014

Potential authentication bypass leading to privilege escalation in Artifactory

JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-65924

Server-Side Request Forgery (SSRF) via Terraform Remote repository

JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary destinations and receive the response content.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-9144

Taiko AG1000-01A Rev 7.3/8 Stored XSS via Web Configuration Interface

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allows authenticated attackers to execute persistent JavaScript by fragmenting malicious payloads across multiple administrative form fields. Attackers can bypass front-end length restrictions using JavaScript comments and template literals to concatenate executable script fragments that are rendered in administrative dashboard views such as index.zhtml, resulting in persistent script execution within administrative sessions.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Oracle Taiko

Products

Communications Application Session Controller Ag1000-01a Sms Alert Gateway

CVE-2026-9141

Taiko AG1000-01A Rev 7.3/8 Authentication Bypass via Web Interface

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface that allows unauthenticated attackers to access internal application pages without any session management or server-side authentication checks. Attackers with network access can directly request internal resources such as index.zhtml, point.zhtml, and log.shtml to gain full administrative read and write access, enabling unauthorized modification of alarm routing, device configuration, and disruption of monitoring and control functions.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Oracle Taiko

Products

Communications Application Session Controller Ag1000-01a Sms Alert Gateway

CVE-2026-9139

Taiko AG1000-01A Rev 7.3/8 Hard-coded Credentials via login.zhtml

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static plaintext credentials in the page source. Unauthenticated attackers with network access can recover administrative credentials directly from the client-side validate() function to obtain full administrative access to the device.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Oracle Taiko

Products

Communications Application Session Controller Ag1000-01a Sms Alert Gateway

CVE-2026-7435

SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString

SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without parameterization or sanitization. Attackers can craft encrypted payloads submitted to the /api/stl/actions/dynamic endpoint to execute arbitrary SQL statements, leading to unauthorized database access, data disclosure, authentication bypass, data modification, or complete database compromise.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Siteserver Sscms

Products

Sscms Sscms

CVE-2026-7429

SSCMS v7.4.0 Reflected Cross-Site Scripting via STL Processing

SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting malicious STL template payloads that are decrypted and returned without proper sanitization. Attackers can exploit improper output encoding in the /api/stl/actions/dynamic endpoint to inject executable JavaScript into JSON responses, leading to session hijacking, phishing attacks, and unauthorized actions performed on behalf of users.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Siteserver Sscms

Products

Sscms Sscms

CVE-2026-6539

Notepad++ 8.9.3 Format String Injection via nativeLang.xml

Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leading to access violations and potential leakage of stack or register contents.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Don Ho Notepad++ Notepad-plus-plus

Products

Notepad\+\+ Notepad++ Notepad\+\+

CVE-2026-63098

TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint

TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler. Attackers can obtain the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles without any credentials.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Strangebee Thehive-project

Products

Thehive Thehive

CVE-2026-63097

Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure

Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that allows authenticated local users to access post-leave room state events by exploiting a flawed membership check that evaluates only the RoomExists field while ignoring IsInRoom, HasBeenInRoom, and Membership fields. Attackers who have left a room can call the rooms context API endpoint for a previously permitted event and receive unfiltered current room state that the /messages and /sync endpoints correctly withhold.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Matrix

Products

Dendrite

CVE-2026-63096

Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint

Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to arbitrary hosts and ports by supplying an unvalidated serverName parameter to the legacy media download endpoint. Attackers can exploit distinguishable error response classes and leaked internal IP addresses in error messages to perform blind port scanning and enumerate internal network topology.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Matrix

Products

Dendrite

CVE-2026-63095

Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint

Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifier bindings belonging to other users by submitting an arbitrary address and medium to the account deletion endpoint without ownership verification. Attackers can exploit the unverified Forget3PID handler to remove a victim's email or MSISDN binding and subsequently rebind the address through an identity server to hijack the victim's password reset flow.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Matrix

Products

Dendrite

CVE-2026-63091

ProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record Parser

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and forcing the server to read beyond the end of the SSH channel data and write overread process memory into the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable exploitation of memory corruption vulnerabilities in the same process.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Proftpd

Products

Proftpd

CVE-2026-63090

ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Proftpd

Products

Proftpd

CVE-2026-62188

OpenClaw < 2026.6.9 Feishu Authorization Bypass

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. The issue is fixed in version 2026.6.9.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Feishu Openclaw

Products

Feishu Feishu Openclaw\/feishu