CVE-2026-118578

maotoumao MusicFreeDesktop Request Forwarder information disclosure

A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosure. The attack can only be performed from the local network. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Maotoumao

Products

Musicfreedesktop

CVE-2026-118537

a2ui Image Player/Video Player/Audio Player Image.js input validation

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

A2ui A2ui-project

Products

A2ui A2ui

CVE-2026-118266

Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POST handler but the override changes the method before CSRF evaluates it, causing both token validation and Sec-Fetch-Site checks to be skipped. A cross-site exploit requires an authenticated victim and an override value that a browser-submitted request can control, such as the form getter used by the advisory reproducer; the default X-HTTP-Method-Override header getter is not settable by a cross-site form. This issue is fixed in 4.16.0 and 5.4.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Labstack

Products

Echo

CVE-2026-118258

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior through the application's network position and credentials. This vulnerability is the result of an incomplete fix for CVE-2026-41691. This issue is fixed in version 4.0.4.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

I18next

Products

I18next-http-backend

CVE-2026-118254

Highcharts Grid: pagination language options are parsed as HTML

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Highcharts

Products

Grid-lite Grid-pro Highcharts

CVE-2026-117574

Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Openshift Ai (rhoai) Openshift Ai

CVE-2026-116958

Konflux-ci: unquoted variable expansion in shell command execution

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing commands with the privileges of the deployment runner.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-108060

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:CVE-2026-108060: Nombre in ‘/Trabajadores/Create’.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite

CVE-2026-108059

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108059: Observaciones in ‘/Terceros/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite

CVE-2026-108058

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108058: Nombre in ‘/PlantillasMail/Edit’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite

CVE-2026-108057

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108057: Nombre in ‘/PlantillasPdf/Edit/1273129’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite

CVE-2026-108056

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108056: NombrePF in ‘/Empresas/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite

CVE-2026-108055

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108055: Nombre in ‘/Inmuebles/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite

CVE-2026-108054

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108054: Nombre in ‘/Familias/Edit/{id}’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite

CVE-2026-108053

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108053: Nombre in ‘/CuentasCorrientes/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite

CVE-2026-108052

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108052: Codigo in ‘/CategoriasFicheros/Edit/{id}’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite

CVE-2026-108051

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108051: Nombre in ‘/Articulos/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite

CVE-2026-108050

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108050: ReferenceOtherParty in ‘/Documents/DeliveryNotes/Edit/{id}’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite

CVE-2026-108049

Clickjacking vulnerability in the Alosuite web application.

Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite

CVE-2026-108048

Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality.

Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite