CVE-2026-97150
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP c
CVSS
7.2
High
EPSS
0.3%
p26
KEV
—
Exploit Today
8
0-100
Published: Sep 30, 2026 · Last modified: Sep 30, 2026 · CWE-829
0.3%EPSS · 30 days0.3%
2026-09-302026-10-20
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1137099.9 CRI—
——0Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Helm automatically loads a downloader plugin from `<configHome>/.data/plugins` without a separate plugin-install step and executes its program inside argocd-repo-server when a helmCharts repository URL uses the plugin's protocol. The command runs as the repo-server user and can read repository credentials and other process-accessible data. An attacker can commit the Kustomization and plugin to a Git repository that an Application builds or upload the files through POST /api/v1/applications/manifestsWithFiles, also exposed by argocd app diff --local --server-side-generate. The upload path requires only Application get permission on an existing Application, without Application update or sync permission or repository write access. Both delivery paths require prior operator enablement of --enable-helm; deployments that do not enable it are not affected. Kustomize 4.1.0 first passed helmGlobals.configHome through to Helm. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.14hCVE-2026-869498.8 HIG2.7%
——1This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.6hCVE-2026-1113577.0 HIG15.0%
——5Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.5dCVE-2026-1110917.8 HIG2.7%
——1In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration6dCVE-2026-738008.8 HIG44.1%
——13Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.3dCVE-2026-962377.5 HIG44.8%
——13Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.7d