SB2026091642 - Multiple vulnerabilities in Jira Service Management Data Center

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091642

SB2026091642 - Multiple vulnerabilities in Jira Service Management Data Center

Published: September 16, 2026

Security Bulletin ID SB2026091642
CSH Severity
High
Patch available
YES
Number of vulnerabilities 41
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 10% Medium 73% Low 17%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 41 vulnerabilities.


1) Inefficient regular expression complexity (CVE-ID: CVE-2026-48801)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in LinkifyIt.prototype.match when processing user-supplied text containing many fuzzy links or email-like strings. A remote attacker can send a specially crafted request body to cause a denial of service.

This affects services that synchronously render untrusted Markdown with linkification enabled on the request path, including transitive use through markdown-it with linkify:true.


2) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-12803)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to forge authenticated ciphertexts across nonces.

The vulnerability exists due to improper cryptographic binding in KCCMBlockCipher MAC processing when AAD is absent. A remote attacker can craft data that exploits the missing nonce binding to forge authenticated ciphertexts across nonces.


3) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-58059)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in X.500 distinguished name stringification when escaping strings with quadratic-time behavior. A remote attacker can supply crafted distinguished names to cause a denial of service.


4) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-12816)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to forge message authentication codes.

The vulnerability exists due to improper cryptographic implementation in IESEngine stream-mode MAC processing when deriving keys through a length-dependent KDF split. A remote attacker can supply crafted input to forge message authentication codes.


5) Input validation error (CVE-ID: CVE-2026-59650)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to weaken Diffie-Hellman key agreement security.

The vulnerability exists due to improper input validation in MTI/A0 DH agreement when processing an unvalidated peer value. A remote attacker can supply a crafted peer value to weaken Diffie-Hellman key agreement security.


6) Input validation error (CVE-ID: CVE-2026-59639)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass CMS signature presence checks.

The vulnerability exists due to improper input validation in CMS verifySignatures when processing SignedData with zero signers. A remote attacker can supply crafted SignedData to bypass CMS signature presence checks.


7) Insufficient verification of data authenticity (CVE-ID: CVE-2026-59642)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to tamper with CMS AuthenticatedData content.

The vulnerability exists due to improper cryptographic binding in CMS AuthenticatedData processing when authAttrs are present. A remote attacker can supply crafted CMS data to tamper with CMS AuthenticatedData content.


8) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-58060)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in HSS public-key verification when processing an unbounded level count. A remote attacker can provide a crafted public key to cause a denial of service.


9) Prototype pollution (CVE-ID: CVE-2026-67320)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improperly controlled modification of object prototype attributes in the Node.js HTTP adapter request path when processing interceptor-returned regular object configs with a polluted Object.prototype.proxy. A remote user can trigger prototype pollution elsewhere in the process and cause affected HTTP requests to be routed through an attacker-controlled proxy to disclose sensitive information.

Exploitation requires Node.js HTTP adapter usage and a request interceptor that returns a plain object copy of the request configuration. The confirmed disclosure impact is limited to plaintext HTTP requests and can expose authorization headers, request metadata, and request body content.


10) Resource exhaustion (CVE-ID: CVE-2026-59869)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the js-yaml parser when parsing YAML documents containing chained merge keys. A remote attacker can send a specially crafted YAML document to cause a denial of service.

The issue results in quadratic CPU consumption for input whose size grows only linearly.


11) Integer overflow (CVE-ID: CVE-2026-59879)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in List#set, List#setIn, List#updateIn, List#setSize, and the related functional set, setIn, and updateIn operations when processing a crafted index, size, or key-path segment in the range [2 ** 30, 2 ** 31). A remote attacker can send a specially crafted request to cause a denial of service.

A single small unauthenticated request can trigger an uncatchable infinite loop on an empty List or unbounded allocation leading to process abort on a populated List.


12) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-14682)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in definite-length read processing when performing an unbounded up-front allocation. A remote attacker can supply crafted input with a large declared length to cause a denial of service.


13) Uncaught Exception (CVE-ID: CVE-2026-73088)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


14) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-59887)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in the mailto: schema validator scan loop when processing user-supplied text containing repeated mailto: sequences. A remote attacker can send specially crafted input to cause a denial of service.

The issue is reachable through the documented .test() and .match() API and through markdown rendering with linkification enabled.


15) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-73089)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `--` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


16) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-59880)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in Immutable.Map and Immutable.Set collision bucket handling when processing attacker-controlled object keys. A remote attacker can supply many crafted colliding keys to cause a denial of service.

Applications are affected when untrusted input is used as keys in Immutable structures rather than only as values under fixed keys.


17) Uncontrolled Recursion (CVE-ID: CVE-2026-13506)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in the lazy ASN.1 sequence parser when forcing sequence evaluation that resets the nesting-depth guard. A remote attacker can supply crafted ASN.1 data to cause a denial of service.


18) Double Decoding of the Same Data (CVE-ID: CVE-2026-75899)

CWE-ID: CWE-174 - Double Decoding of the Same Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to double decoding of the same data in the fast-uri normalize() and resolve() hostname handling logic when processing a URI with a nested percent-encoded host. A remote attacker can supply a specially crafted URI to perform server-side request forgery.

The issue can cause the hostname to be interpreted as a different destination than the input appears to contain, including internal addresses such as loopback or a cloud metadata endpoint.


19) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-75975)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass host-policy checks and perform server-side request forgery.

The vulnerability exists due to improper input validation in the IPv6 literal normalization logic of fast-uri when normalizing untrusted URLs containing malformed bracketed IPv6 literals. A remote attacker can supply a specially crafted URL to bypass host-policy checks and perform server-side request forgery.

Malformed bracketed IPv6 literals with invalid trailing text are silently truncated to different valid IPv6 addresses, and parse().error is not set for these inputs.


20) Improper Handling of URL Encoding (Hex Encoding) (CVE-ID: CVE-2026-76172)

CWE-ID: CWE-177 - Improper Handling of URL Encoding (Hex Encoding)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass host validation and inject carriage return and line feed characters into output.

The vulnerability exists due to improper handling of url encoding in the scheme component normalization logic when normalizing or resolving untrusted URLs. A remote attacker can supply a specially crafted percent-encoded scheme to bypass host validation and inject carriage return and line feed characters into output.

Applications that treat a missing authority as same-origin during redirect checks, host allowlist enforcement, or outbound request decisions are particularly exposed.


21) Memory leak (CVE-ID: CVE-2026-68763)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an allocation leak in HTTP/2 backlog tracking when processing a reset stream. A remote attacker can reset a stream to cause a denial of service.


22) Interpretation Conflict (CVE-ID: CVE-2026-13676)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to fast-uri fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. A remote attacker can trigger the vulnerability to modify data on the system.


23) Prototype pollution (CVE-ID: CVE-2022-46175)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within the JSON5.parse() function. A remote attacker can inject and execute arbitrary script code.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


24) Code Injection (CVE-ID: CVE-2026-44728)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper control of code generation in @babel/plugin-transform-modules-systemjs when compiling specifically crafted malicious code. A local user can compile specifically crafted malicious code to execute arbitrary code.

User interaction is required.


25) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-55276)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to obtain incomplete security configuration information.

The vulnerability exists due to logic errors in effective web.xml generation in the logged effective web.xml output when generating configuration logs. A local user can review the logged output to obtain incomplete security configuration information.

Special roles and empty authorization constraints are omitted from the logged effective web.xml.


26) Resource exhaustion (CVE-ID: CVE-2026-73507)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in XmlFrameDecoder. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


27) Uncontrolled Recursion (CVE-ID: CVE-2026-73566)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the mapHas helper used by filesFilter when processing a crafted tar archive with a non-empty member-selection list. A remote attacker can supply a specially crafted archive with a long path to cause a denial of service.

On async and streaming consumers, the resulting stack overflow raises an uncaught RangeError that terminates the Node process. The issue is triggered when listing or extracting selected members from an untrusted archive.


28) Interpretation Conflict (CVE-ID: CVE-2026-18446)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass host-based policy checks and steer requests to an unintended destination.

The vulnerability exists due to interpretation conflict in the fast-uri URI parser when parsing references that use backslash-based authority introducers. A remote attacker can supply a specially crafted URL to bypass host-based policy checks and steer requests to an unintended destination.

The issue arises from inconsistent host extraction between fast-uri and Node's WHATWG URL handling for special schemes.


29) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53404)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass rewrite conditions.

The vulnerability exists due to logic errors in RewriteValve when processing requests against OR-chained rewrite conditions. A remote attacker can send a request that matches the first OR condition to bypass rewrite conditions.

Exploitation requires a rule set that uses an OR chain followed by non-OR conditions.


30) Deserialization of Untrusted Data (CVE-ID: CVE-2026-54512)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to instantiate arbitrary classes.

The vulnerability exists due to deserialization of untrusted data in DatabindContext._resolveAndValidateGeneric() and PolymorphicTypeValidator handling when processing polymorphic type identifiers with generic parameters during deserialization. A remote attacker can supply a specially crafted type identifier and JSON data to instantiate arbitrary classes.

Only applications that accept untrusted JSON and have polymorphic typing enabled while relying on a configured PolymorphicTypeValidator allow-list are affected.


31) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-14257)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in expand() when processing attacker-influenced brace expansion patterns. A remote attacker can send a specially crafted input string to cause a denial of service.

The issue can terminate the Node process with an uncatchable out-of-memory error.


32) Improper Certificate Validation (CVE-ID: CVE-2026-53434)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to authenticate with an invalid certificate.

The vulnerability exists due to improper certificate revocation validation in the FFM Connector when handling connections with invalid CRL configuration. A remote attacker can present an invalid certificate to authenticate with an invalid certificate.

Only configurations using the FFM Connector with invalid CRLs are affected.


33) Interpretation Conflict (CVE-ID: CVE-2026-16221)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass host-based policy checks and route requests to an unintended destination.

The vulnerability exists due to interpretation conflict in the fast-uri URL parser when parsing URLs containing a literal backslash in the authority section for special schemes. A remote attacker can supply a specially crafted URL to bypass host-based policy checks and route requests to an unintended destination.

This issue can occur when an application validates a URL with fast-uri and then passes the same input to Node's WHATWG URL parser or fetch-related consumers, which extract a different host from the same string.


34) Resource exhaustion (CVE-ID: CVE-2026-69152)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the expand() function when processing attacker-controlled brace patterns. A remote attacker can send a specially crafted input to cause a denial of service.

The issue can terminate the Node process with an uncatchable out-of-memory error or block the event loop for an extended period.


35) Improper Certificate Validation (CVE-ID: CVE-2026-8763)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass name constraints validation.

The vulnerability exists due to improper certificate validation in name constraints processing when handling rfc822Name and URI values with a trailing dot. A remote attacker can supply a crafted identifier to bypass name constraints validation.


36) Cross-site scripting (CVE-ID: CVE-2026-47761)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in the victim's browser.

The vulnerability exists due to improper neutralization of input during web page generation in the media plugin when rendering content containing crafted data-mce-* attributes. A remote user can inject crafted data-mce-object and related data-mce-p-* attributes to execute arbitrary script in the victim's browser.

User interaction is required when the malicious content is rendered, and only instances with the media plugin enabled are vulnerable.


37) Cross-site scripting (CVE-ID: CVE-2026-47762)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in a victim's browser.

The vulnerability exists due to cross-site scripting in mce:protected comment handling when restoring protected content. A remote user can forge mce:protected comments to bypass sanitization and inject script that executes when content is restored to execute arbitrary script in a victim's browser.

Only users who utilize the protect option are affected, and user interaction is required.


38) Cross-site scripting (CVE-ID: CVE-2026-47759)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script code in a victim's browser.

The vulnerability exists due to cross-site scripting in data-mce-* attribute handling when parsing and serializing content containing data-mce-href, data-mce-src, or data-mce-style attributes. A remote user can inject malicious attribute values to execute arbitrary script code in a victim's browser.

User interaction is required to process crafted content.


39) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-54513)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to instantiate non-allowlisted types.

The vulnerability exists due to incomplete list of disallowed inputs in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() when deserializing attacker-controlled JSON containing array subtypes. A remote attacker can supply a crafted array wrapper to instantiate non-allowlisted types.

The issue occurs because array types are allowlisted based only on whether the class is an array, without validating the array component type against the configured allowlist, and no further validator check occurs for elements when per-element type IDs are absent.


40) Path traversal (CVE-ID: CVE-2026-73646)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in lib/previous-map.js. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.


41) Insufficient verification of data authenticity (CVE-ID: CVE-2026-12802)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to tamper with decrypted data.

The vulnerability exists due to improper authentication tag validation in CMS AuthEnvelopedData decryption when processing encrypted data with an invalid tag length. A remote attacker can supply crafted encrypted content to tamper with decrypted data.


Remediation

Install update from vendor's website.

References