medium · CVSS v3 5.5

CVE-2026-49935

In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path tr…

Description

In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path traversal. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Scores

Severity
medium
CVSS v2
2.1
CVSS v3
5.5
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-105605

An IDOR flaw in the Joomla DJ-Classifieds extension allows any logged‑in user to retrieve the full details of any advertisement by supplying its numeric ID. The issue exists in all versions prior to 3.11.3 and exposes sensitive advertiser information such as phone numbers, addresses, and prices. It can be exploited without any special privileges or external access.

View analysis

medium

CVE-2026-120237

A flaw in ag-ui-protocol ag-ui up to 0.0.58 allows manipulation of the isInterruptExpired function, leading to excessive resource consumption. The vulnerability can be exploited remotely and an exploit is publicly available. Patching to a fixed version is required to mitigate the risk.

View analysis

medium

CVE-2026-120334

A path‑traversal flaw exists in deepset‑ai farm 0.8.0 and earlier, allowing remote attackers to read arbitrary files via the vocab_filename argument in EmbeddingTokenizer.from_pretrained. The vulnerability is publicly known and can be exploited without authentication. It affects any deployments of the unsupported farm library.

View analysis

medium

CVE-2026-120343

A cross-site scripting (XSS) vulnerability exists in the manageassessment2.php file of the CloudClassroom-PHP-Project. This flaw allows remote attackers to inject malicious scripts via the ExamName and question parameters. The issue is significant because the vendor is unresponsive, leaving users without an official patch.

View analysis