CVE-2026-129164

Dromara free-fs 2.0.1 through 2.3.1 Share Code and Permission Scope Bypass

Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code-protected shares because share codes are enforced only client-side. Attackers knowing a share ID can call the share items and download endpoints to list and download files without the code, even on preview-only shares.

CVSS 4.0 · 8.2 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129165

Tactical RMM 0.17.0 through 1.6.1 Arbitrary File Read via Report Preview

Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permission can read the Django SECRET_KEY, reused as the NATS password, and publish runscript commands to every managed agent.

CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed

Vendors

Amidaware

Products

Tactical Rmm

CVE-2026-129166

Keep 0.34.10 through 0.55.0 Blind SQL Injection via CEL Bracket-Indexed JSON Keys

Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bracket-indexed JSON keys from CEL filters unescaped into JSON path expressions for SQLite, PostgreSQL, and MySQL. Authenticated users with read:alert permission can submit crafted CEL expressions to /alerts/query or the cel parameter of /incidents, using result counts as a boolean oracle to extract other tenants' alerts and password hashes.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129167

SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 Path Traversal RCE via confluence-to-wiki

Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability that allows unauthenticated attackers holding a public share token to execute code. Attackers supply an absolute filename to /api/v1/confluence-to-wiki/ to extract a ZIP from download_url into the Python library path, then trigger the module's import via a file-convert request.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129168

PMail 2.9.1 through 2.9.8 Stored XSS via Inline HTML Attachments

PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endpoint returns email attachments verbatim with the sender-supplied Content-Type after cid: references are rewritten into attachment links. Unauthenticated SMTP senders can email a text/html attachment and a page-covering cid link, so a recipient who clicks the message runs script in their webmail session to change passwords, including the administrator's.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129169

PMail 2.5.0 through 2.9.8 Stored XSS via /api/email/send HTML Body

PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129170

FileCodeBox 2.2.1 through 2.8.4 Stored XSS via Markdown Preview Parser Error

FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which returns unsanitized text when the marked parser throws. Unauthenticated attackers can share text with thousands of nested blockquote markers followed by HTML payloads, executing script that steals the admin token from localStorage.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129171

NginxPulse 1.5.0 before 1.6.26 SQL Injection via /api/stats/:type

NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents, and read or write server files via PostgreSQL superuser functions.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129172

EdgeEver 1.9.0 before 2.13.0 Stored XSS via Backup Restore and Public Shares

EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /api/v1/restores/json/resources/:id, which accepts a resource kind of image paired with a text/html MIME type without checking consistency. Authenticated members can share the note and send the public blob link to a victim, whose browser executes the script to mint a non-expiring API token granting read and write access to the victim's notes.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-63164

Omnispace Agora Project 26.10.0 IDOR via reloadMailTypeId Parameter

Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed

Vendors

Agora-project

Products

Agora-project

CVE-2026-63163

Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63162

Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter

Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63161

Omnispace Agora Project < 26.10.0 Session Fixation via Authentication

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-128070

Nuxt dev server serves files from a parent directory that contains a lockfile

Nuxt is an open-source web development framework for Vue.js. From 3.5.0 until 4.6.4, Nuxt can choose a parent directory as the default workspaceDir in either of two cases: a stray parent lockfile when the project is outside a Git repository and has no workspace file above it, or a parent pnpm or Deno settings file that does not declare packages or a workspace, including when the project is inside a Git repository. When the development server is reachable from an untrusted network, Vite permits /_nuxt/@fs/ requests beneath that widened directory, allowing unauthenticated clients to read files such as credentials and SSH keys. The issue affects the development server only; production builds and projects whose parent directories contain no qualifying files are unaffected. This issue is fixed in version 4.6.4.

CVSS 3.1 · 5.9 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-63160

Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63159

Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover

Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63158

Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies

Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63157

Omnispace Agora Project < 26.10.0 Stored XSS via Links Module

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address (adress) field that is echoed into an onclick event-handler attribute without neutralizing quotes. Attackers can store a crafted payload through the Links module that executes in the browser of any user viewing the links list, enabling session hijacking or further client-side compromise.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63156

Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter

Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering. Attackers can craft a malicious URL containing the visioUrl parameter with an attribute breakout payload to execute arbitrary JavaScript in the victim's browser pre-authentication, with the issue fixed in version 26.10.0 via changes to app/Common/Req.php.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63155

Omnispace Agora Project 26.10.0 Open Redirect via objUrl Parameter

Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir() function. Attackers can craft login links with objUrl set to a malicious site, causing the application to issue an HTTP 302 redirect to that external URL, which can be abused for phishing and credential theft.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Agora-project

Products

Agora-project