CVE-2026-102663

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openlistteam

Products

Openlist

CVE-2026-100830

Mitigation bypass in the DOM: Navigation component

Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-106459

Backstage: Improper input validation in Sentry scaffolder actions

Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. This issue is fixed in version 0.3.8.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Backstage Linuxfoundation

Products

Backstage Plugin-scaffolder-backend-module-sentry Backstage and 1 more

CVE-2026-84316

Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

0xjacky

Products

Nginx-ui

CVE-2026-78673

Maximo AI Service Improper Input Validation

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Maximo Ai Service

CVE-2026-75076

IBM Aspera Enterprise Webapps Information Disclosure

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Aspera Enterprise Webapps

CVE-2026-108811

WMCMS index.php information disclosure

A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wmcms

Products

Wmcms

CVE-2026-106331

chromium-browser: Improper input validation in Extensions

Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-106582

openssh: openssh: Information disclosure via shared compression side-channel

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-106501

Backstage: Sensitive information exposure in Scaffolder

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Backstage Linuxfoundation

Products

Backstage Plugin-scaffolder-backend Backstage and 1 more

CVE-2026-106502

Backstage: Sensitive information may be exposed in Scaffolder task failure events

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure conditions, an authenticated user may retrieve backend-managed credentials used during task execution from affected task events. This issue is fixed in version 4.1.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Backstage Linuxfoundation

Products

Backstage Plugin-scaffolder-backend Backstage and 1 more

CVE-2026-107293

Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outside tool calls in gen_ai.input.messages and pydantic_ai.all_messages. Agents using NativeOutput, PromptedOutput, or output validators on text output can therefore disclose validation feedback, including invalid model values quoted by that feedback, to readers of the telemetry backend. Tool-call retries and deployments that do not use include_content=False are not affected by this specific path. This issue is fixed in versions 1.107.4 and 2.27.1.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Pydantic

Products

Pydantic-ai Pydantic Ai

CVE-2026-93892

Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Tririga Application Platform

CVE-2026-108947

yoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization

A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been published and may be used. The project maintainer explains: "This is very similar to an internal report that GH auto-generated for the owner before, which I found tolerable for this project at that time. So I will close this as duplicate."

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Yoshitomo-matsubara

Products

Torchdistill

CVE-2026-108861

Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields to receive their values unredacted.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Erpipe-org

Products

Odoo Mcp

CVE-2026-108578

Neterbit NW-431F Embedded Web Server sms.json information disclosure

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS 1.5% KEV · Not listed

Vendors

Neterbit

Products

Nw-431f Nw-431f Router

CVE-2026-89203

Unauthorized Data Retrieval via Unrestricted Database Queries in Siemens RUGGEDCOM CROSSBOW

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Siemens

Products

Ruggedcom Crossbow

CVE-2026-14308

Insufficient Signature Validation

Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zohocorp

Products

Manageengine Malware Protection Plus

CVE-2026-108489

WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-107225

Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Excelize Qax-os

Products

Excelize Excelize