CVE-2026-78557

Unsanitized Data in Industrial Edge App Publisher Enables Remote Code Execution

A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Siemens

Products

Industrial Edge App Publisher

CVE-2026-85114

Unvalidated Ticket Response Allows Arbitrary File Write in Siemens .NET Client Library

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Siemens

Products

.net Client Library For Simatic S7 Webserver Api

CVE-2026-65131

NVSentinel gRPC health‑event interface lacks authentication, enabling denial of service

NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component, where the gRPC health-event interface, exposed over a world-writable Unix domain socket, lacks authentication. A successful exploit of this vulnerability might lead to denial of service.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Nvsentinel

CVE-2026-65197

H3C G3/G5 HDM Firmware Verification Key Replacement

H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key.  This was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

H3c

Products

Hdm Family-a G5

CVE-2026-65198

Huawei Default SNMPv3 USM key

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Huawei

Products

Openubmc

CVE-2026-102342

ammonia allows stored XSS through unsanitized SVG animate and set attributes

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Rust-ammonia

Products

Ammonia

CVE-2026-106108

Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent traversal or an existing symlink below the distribution directory could create new HTML files or directories outside the output tree with the build user's permissions. Application configuration and SSG page definitions are trusted by default, so exploitation requires a build process that derives them from external or otherwise less-trusted content; existing files remain protected by the renderer's no-overwrite behavior. This issue is fixed in version 3.3.0.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Quasarframework

Products

App-vite Quasar

CVE-2026-55675

Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Saltyorg

Products

Docs

CVE-2026-54640

OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Openremote

Products

Openremote Openremote-manager

CVE-2026-55183

RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Zarestia-dev

Products

Rclone-manager

CVE-2026-109412

Exposed Endpoint in Ivanti Neurons Patch for Intune Enables Leakage of Authentication Information

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Ivanti

Products

Neurons Patch For Intune

CVE-2026-103030

Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cfug

Products

Dio

CVE-2026-110097

Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token

Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Ikaros-dev

Products

Ikaros

CVE-2026-110108

MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API

MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mateaix

Products

Matecloud

CVE-2026-110109

JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jetlinks

Products

Jetlinks Community

CVE-2026-110114

oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints

FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared goods_sku_index_01 index for all tenants and force full-table reloads, degrading search availability.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Fj-oms

Products

Oms-erp

CVE-2026-110125

waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm, delete and refund endpoints to read recipient addresses and phone numbers or disrupt orders.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wayn111

Products

Waynboot-mall

CVE-2026-110126

waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/{addressId} requests to overwrite or remove victims' saved addresses.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wayn111

Products

Waynboot-mall

CVE-2026-110131

ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or isDel=true query parameters to retrieve full titles, descriptions and content of non-public articles.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Liuyuyang01

Products

Thrivex-server

CVE-2026-108375

dataclasses-avroschema allows code injection through generated field-default literals

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Marcosschroh

Products

Dataclasses-avroschema