CVE-2026-108901
A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the
CVSS
3.5
Baixa
EPSS
0.2%
p10
KEV
—
Exploit Today
3
0-100
Publicado: 12 de out. de 2026 · Última mod.: 13 de out. de 2026 · CWE-1021
0.2%EPSS · 30 dias0.3%
2026-10-132026-11-06
A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1238503.5 BAI—
——0In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives6hCVE-2026-218343.1 BAI—
——0HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responses. Without this header, the browser does not restrict the sources of scripts and other content, increasing exposure to cross-site scripting and content-injection attacks, potentially resulting in unintended behavior or security impact under certain conditions.10hCVE-2026-1233115.3 MÉD—
——0In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 command execution via a hidden run control in the Markdown preview was possible11hCVE-2026-181594.3 MÉD10.3%
——3A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking.
This issue affects OpenText Directory Services (OTDS): from 10.5 through 26.2.6hCVE-2026-1085364.6 MÉD5.0%
——1IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames.2dCVE-2026-108049—36.5%
——11Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.3d