CVE-2026-5426, a hardcoded ASP.NET machineKey in KnowledgeDeliver, was exploited as a zero-day in ViewState deserialization ...
Reported over three years ago and allegedly still not properly fixed, the vulnerability enables attacks to execute JavaScript ...