CVE-2026-15966

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.

This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-942

Affected software

No affected versions have been published.

Timeline

Published
Jul 23, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-159679.8Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0CVE-2026-159685.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue CVE-2026-159699.8SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrCVE-2026-15978.8A vulnerability has been found in Bdtask SalesERP up to 20260116. This issue affects some unknown processing of the component AdministrativeCVE-2026-159704.2Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service prCVE-2026-159719.8SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT isCVE-2026-159727.5Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unboundedCVE-2026-159738.4LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An aCVE-2026-159746.5SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowinCVE-2026-159757.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 thCVE-2026-159769.8SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weiCVE-2026-159777.5SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when