CVE-2026-116216

MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Maccms Magicblack

Products

Maccms Maccms10

CVE-2026-118250

Highcharts: dotted series.keys paths write to Object.prototype

Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype. Those properties are visible to all JavaScript in the page, and no user interaction is required beyond rendering the chart. This issue is fixed in 11.4.9, 12.6.1, and 3.1.0.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Highcharts

Products

Highcharts

CVE-2026-116674

systeminformation: Prototype pollution in `networkStats()` via the interface name

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Sebhildebrandt

Products

Systeminformation

CVE-2022-2625

postgresql: Extension scripts replace objects not belonging to the extension.

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

CVSS 3.1 · 8.0 High EPSS 2.2% KEV · Not listed

Vendors

Fedoraproject Postgresql Redhat

Products

Fedora Postgresql Enterprise Linux and 5 more

CVE-2026-120448

DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Doramart

Products

Doracms

CVE-2026-115933

Forged signed tokens let any registered user take over other users and organizations

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Gitroomhq

Products

Postiz-app

CVE-2026-107249

Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Block Ajax

CVE-2026-118248

Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Highcharts

Products

Dashboards Highcharts

CVE-2025-13204

CVE-2025-13204

npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Expr-eval Project Silentmatt

Products

Expr-eval Javascript Expression Evaluator

CVE-2026-90863

Privilege Escalation via Missing Authorization in WS_FTP Manager

Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-119565

Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Plausible

Products

Plausible Analytics

CVE-2026-29063

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Immutable-js Redhat

Products

Immutable Immutable-js 3scale Api Management Platform and 25 more

CVE-2026-46330

Revert "net/smc: Introduce TCP ULP support"

In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The implementation attempts to convert an active TCP socket into an SMC socket by modifying the underlying `struct file`, dentry, and inode in-place, which violates core VFS invariants that assume these structures are immutable for an open file, creating a risk of use after free errors and general system instability. Given the severity of this design flaw and the fact that cleaner alternatives (e.g., LD_PRELOAD, BPF) exist for legacy application transparency, the correct course of action is to remove this feature entirely.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-118538

a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

A2ui-project

Products

A2ui

CVE-2026-58255

Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output `uid`/`gid` injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jhuckaby

Products

Cronicle

CVE-2026-112295

FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update

FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Flycms Project Sunkaifei

Products

Flycms Flycms

CVE-2026-41267

Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mass assignment (JSON injection) vulnerability in the account registration endpoint of Flowise Cloud allows unauthenticated attackers to inject server-managed fields and nested objects during account creation. This enables client-controlled manipulation of ownership metadata, timestamps, organization association, and role mappings, breaking trust boundaries in a multi-tenant environment. This vulnerability is fixed in 3.1.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Flowiseai

Products

Flowise

CVE-2026-9726

Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Alternativecommerce Drupal

Products

Alternativecommerce Drupal Alternativecommerce (basket)

CVE-2026-110804

Improper JIT Elevation Handling Allows Deletion of Active Directory Groups via PAM Checkout

Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Devolutions

Products

Devolutions Server Server

CVE-2026-96378

Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Commerce Decoupled Checkout