CVE-2026-64796

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Regularlabs.com

Products

Sourcerer Extension For Joomla

CVE-2026-63683

Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager

Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Regularlabs.com

Products

Advanced Module Manager Extension For Joomla Conditional Content Extension For Joomla Content Templater Pro Extension For Joomla and 1 more

CVE-2026-47475

Inference API Assertion Failure in NVIDIA TensorRT-LLM Causes Denial of Service

NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacker could trigger a reachable assertion in the sampler thread. A successful exploit of this vulnerability might lead to denial of service.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Tensorrt-llm

CVE-2026-15764

chromium-browser: chromium-browser: Use after free in Ozone

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google Linux

Products

Chrome Linux Kernel

CVE-2026-15765

chromium-browser: chromium-browser: Use after free in Ozone

Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-15771

chromium-browser: chromium-browser: Insufficient validation of untrusted input in Media

Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google Microsoft

Products

Chrome Windows

CVE-2026-54572

rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Rclone

Products

Rclone

CVE-2026-65618

Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-65616

Potential privilege escalation to JFrog administrator privileges

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-65925

Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-65617

Potential remote code execution on an Artifactory package service container.

A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-65922

Potential unauthorized modification of Artifactory internal metadata

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is not affected.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-48052

Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request

Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of the ":organizationId" in the URL, but the repository write filters on tag.id alone, so the URL-level org scope never reaches the database. This issue has been patched in version 26.5.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Papra-hq

Products

Papra

CVE-2026-64641

Next.js: Denial of Service in App Router using Server Actions

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Vercel

Products

Next.js

CVE-2026-66014

Potential authentication bypass leading to privilege escalation in Artifactory

JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-65924

Server-Side Request Forgery (SSRF) via Terraform Remote repository

JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary destinations and receive the response content.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-9144

Taiko AG1000-01A Rev 7.3/8 Stored XSS via Web Configuration Interface

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allows authenticated attackers to execute persistent JavaScript by fragmenting malicious payloads across multiple administrative form fields. Attackers can bypass front-end length restrictions using JavaScript comments and template literals to concatenate executable script fragments that are rendered in administrative dashboard views such as index.zhtml, resulting in persistent script execution within administrative sessions.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Oracle Taiko

Products

Communications Application Session Controller Ag1000-01a Sms Alert Gateway

CVE-2026-9141

Taiko AG1000-01A Rev 7.3/8 Authentication Bypass via Web Interface

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface that allows unauthenticated attackers to access internal application pages without any session management or server-side authentication checks. Attackers with network access can directly request internal resources such as index.zhtml, point.zhtml, and log.shtml to gain full administrative read and write access, enabling unauthorized modification of alarm routing, device configuration, and disruption of monitoring and control functions.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Oracle Taiko

Products

Communications Application Session Controller Ag1000-01a Sms Alert Gateway

CVE-2026-9139

Taiko AG1000-01A Rev 7.3/8 Hard-coded Credentials via login.zhtml

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static plaintext credentials in the page source. Unauthenticated attackers with network access can recover administrative credentials directly from the client-side validate() function to obtain full administrative access to the device.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Oracle Taiko

Products

Communications Application Session Controller Ag1000-01a Sms Alert Gateway

CVE-2026-7435

SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString

SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without parameterization or sanitization. Attackers can craft encrypted payloads submitted to the /api/stl/actions/dynamic endpoint to execute arbitrary SQL statements, leading to unauthorized database access, data disclosure, authentication bypass, data modification, or complete database compromise.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Siteserver Sscms

Products

Sscms Sscms