CVE-2026-105323

MediumCVSS 6.1/10Last modified Nov 4, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software allows Reflected XSS.

This issue affects Kulga News Software: from v26.7.4 before v26.10.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Kulga Software and Telecommunications Limited Company	Kulga News Software	>= v26.7.4, < v26.10.0

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1405

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1053249.2An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on CVE-2026-1053257.5Missing check for ACCOUNTING_UPDATE / ACCOUNTING_CREATE in accounting in allows user with only ACCOUNTING_VIEW permission to update/create CVE-2026-1053262.5An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription request CVE-2026-1053296.3A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/CVE-2026-105335.0A flaw was found in OpenShift Container Platform. Completed pods with restartPolicy: Never do not count toward ResourceQuota pod limits, and CVE-2026-1053309.8Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthentic CVE-2026-1053315.2Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the ag CVE-2026-105349.8IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser.CVE-2026-105357.8IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.CVE-2026-105369.8A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS CVE-2026-105375.3A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users CVE-2026-105388.0Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in th