CVE-2026-117612

jenkins: Jenkins: Remote code execution via resolves-to attribute handling in XStream

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jenkins Jenkins Project

Products

Jenkins Jenkins

CVE-2026-117565

Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch

Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a page_key to an internal URL, which GetTitleByURL fetches after only scheme validation, then read the page title through the public comment list.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Artalkjs

Products

Artalk

CVE-2026-117561

sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values

Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Codefriar

Products

Sf-mcp

CVE-2026-116841

DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup

DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Diasurgical

Products

Devilutionx

CVE-2026-116020

BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages

BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bookstackapp

Products

Bookstack

CVE-2026-116008

DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bottelet Daybydaycrm

Products

Daybydaycrm Daybyday Crm

CVE-2026-115322

Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bytebase

Products

Bytebase

CVE-2026-103506

SSO settings authorization bypass

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Grafana Redhat

Products

Grafana Grafana Enterprise Hummingbird

CVE-2026-100105

Alerting contact point authorization bypass via schema downgrade

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Grafana Enterprise

CVE-2017-20290

Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Discourse

Products

Discourse

CVE-2014-125137

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

C97

Products

Cart Engine Kemana Directory Qengine Cms

CVE-2026-117956

Invalid pointer in the Nimbus Desktop Client component

Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117960

Spoofing issue in the DOM: Core & HTML component

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117967

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117976

Site isolation issue in the DOM: Navigation component

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-117977

Other issue in the Console component

Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117978

Incorrect boundary conditions in the Graphics component

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117979

Incorrect boundary conditions in the Graphics: WebRender component

Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-22058

CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)

StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Netapp

Products

Storagegrid

CVE-2026-22060

CVE-2026-22060 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)

All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netapp

Products

Storagegrid