2026-10-22 Daily Vulns

NEW:

CVE	vendor-product	description	metric	Referenceurl	title	GithubURL
CVE-2014-125131	DedeCMS - DedeCMS	DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag and inject JavaScript, which executes in the victim’s browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.	CVSS4.0: 5.1 - MEDIUM CVSS3.1: 6.1 - MEDIUM	0 1 2 3	Exploitation: noneAutomatable: noTechnical Impact: partial	DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php	github
CVE-2026-101296	Apache Software Foundation - Apache Tomcat	A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.	CVSS4.0: 9.1 - CRITICAL	0	Exploitation: noneAutomatable: noTechnical Impact: total	Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms	github
CVE-2026-112993	Google - Chrome	Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)	CNA n/a CVSS3.1: 8.8 - HIGH	0 1	Exploitation: noneAutomatable: noTechnical Impact: total	undefined	github