CVE-2026-50701

Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the dashboard-view component.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Frappe Framework

CVE-2026-11374

Account Takeover via Predictable SSO Ticket Generation

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

CVSS 3.1 · 9 Critical EPSS 2.5% KEV · Not listed

Vendors

Zohocorp

Products

Manageengine Adaudit Plus Manageengine Adselfservice Plus Manageengine M365 Manager Plus and 1 more

CVE-2026-50705

Frappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline rendering

A Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of untrusted input in the Form Dashboard headline renderer.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Frappe Framework

CVE-2020-9695

Acrobat Reader | Out-of-bounds Write (CWE-787)

Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Dc Acrobat Reader Acrobat Reader Dc and 2 more

CVE-2026-8378

Frontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scripting via File Rename

The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability exploitable by users with Subscriber-level access and above against an administrator viewing the file management interface.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Frontend File Manager Plugin Wordpress

Products

Frontend File Manager Plugin Wordpress

CVE-2026-10749

Post Duplicator < 3.0.15 - Contributor+ PHP Object Injection via customMetaData

The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP Object.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Duplicator Project Wordpress

Products

Duplicator Wordpress

CVE-2026-10092

Cincopa video and media plug-in <= 1.163 - Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Comments

The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cincopa Shortcode in Post Comments in all versions up to, and including, 1.163 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation is possible because the plugin processes the [cincopa] shortcode via a comment_text filter hook, allowing unauthenticated visitors who can post comments to supply a malicious shortcode argument that persists in the database.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Cincopa Wordpress

Products

Video And Media Plug-in Wordpress

CVE-2025-71354

picklescan - Remote Code Execution via idlelib.debugobj.ObjectTreeItem.SetText

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and executes arbitrary commands when pickle.load() is called.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Mmaitre314 Picklescan

Products

Picklescan Picklescan

CVE-2026-56223

Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a malicious IdP can forge SAML assertions containing victim email addresses to trigger account merge and gain full access to victim accounts, organizations, and data.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Cap-go

Products

Cap-go

CVE-2026-56232

Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header

Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewareKey function. Attackers can bypass subkey scope restrictions by referencing their own subkeys, causing all downstream route handlers to use the unrestricted parent key instead of the scoped subkey.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cap-go

Products

Cap-go

CVE-2026-56237

Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation

Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the backend fails to validate that keys are securely generated and bound to the authenticated user. An attacker can tamper with the API key parameter in the generation request and supply arbitrary values, generating custom API keys without proper authorization, which can lead to unauthorized access to protected endpoints.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Cap-go

Products

Cap-go

CVE-2026-56244

Capgo - Webhook Signing Secret Disclosure via Non-Admin API Key

Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies on the webhooks table. Attackers can retrieve the webhook secret and forge valid X-Capgo-Signature headers to send authenticated webhook events to configured receivers, breaking webhook authenticity and integrity.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cap-go

Products

Cap-go

CVE-2026-56256

Capgo - Two-Factor Authentication Bypass via Organization Management API

Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g., editing organization details, inviting users) do not validate 2FA completion on the backend. An authenticated Admin user who has not enabled 2FA can replay or modify a previously captured ORG API request to perform privileged organization actions, bypassing the globally enforced 2FA requirement.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cap-go

Products

Cap-go

CVE-2026-56302

Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security

Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cap-go

Products

Cap-go

CVE-2026-56337

Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.exist_app_v2 RPC function that allows unauthenticated attackers to enumerate app_ids by calling POST /rest/v1/rpc/exist_app_v2 with arbitrary appid parameters. Remote attackers can exploit this SECURITY DEFINER function to determine whether specific app_ids exist in the public.apps table, enabling cross-tenant app enumeration and privacy violations.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cap-go

Products

Cap-go

CVE-2026-56338

Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint

Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors with captcha verification process failed messages, blocking access to security controls.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cap-go

Products

Cap-go

CVE-2026-50709

Frappe Framework 17.0.0-dev - Stored XSS in Notifications Events color rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Notifications > Events panel.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Frappe Framework

CVE-2026-50711

Frappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields rendering

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Number Card component.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Frappe Framework

CVE-2026-56397

SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or README fields, exploiting Electron's nodeIntegration setting to execute OS commands.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

B3log Siyuan

Products

Siyuan Siyuan

CVE-2026-54518

jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fasterxml

Products

Jackson-databind