Latest CVE vulnerabilities, exploits and security patches
Actively exploited and high-severity vulnerabilities with CVSS and EPSS scores, affected versions and fixes, updated every 10 minutes.
Data updated:
CVE-2026-1185274.3Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityIvanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitedFix availableIvanti Connect SecureCVE-2026-631977.3traQ: XSS in the User Uploaded File Retrieval APItraQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NVerify fixtraPtitech traQCVE-2026-634178.2Logging Redactor: PII data in str/repr of non primitive objects was not being redactedLogging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when such non-primitive objects are logged, causing sensitive values to appear in logs that are expected to mask them. This issue is fixed in version 0.0.7.CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NVerify fixarmurox loggingredactorCVE-2026-1199228.8Babelfish for PostgreSQL Privilege EscalationImproper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCloudFix availableAWS babelfish-for-postgresqlCVE-2026-634187.0Monitoring Plugins check_icmp: -H argument count overflow leads in setuid-root binaryMonitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HLPEVerify fixmonitoring-plugins monitoring-pluginsCVE-2026-442679.8Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access### Summary An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — `defaultFormats.elo.parse()`, the `bin/elo` CLI, or the live browser playground at `elo-lang.org/try` — can execute arbitrary code in the host JavaScript runtime. A payload built from the `.constructor.constructor` chain compiles, without modification, to a live `Function` invocation in the emitted JavaScript, escaping any sandbox assumption around "Elo is a safe data/DSL language." ### Vulnerable sink and root cause Three interacting sites in `src/` produce the bug at commit `749af7b`: 1. **`src/transform.ts:144–158`** — the `member_access` handler allows access on types `any`, `object`, or `array` without filtering the property name. This is the only place an integrator could have plugged a denylist. 2. **`src/compilers/javascript.ts:210`** — the JS emitter writes `${objectExpr}.${ir.property}` verbatim into the output, so any property name that survives the transform step flows unescaped into emitted JavaScript. 3. **`src/parser.ts:163–170, 748–750`** — the parser accepts `constructor` (and other JS meta-property names) as an ordinary identifier, so `.constructor` clears type-checking without triggering any warning. Combined, the Elo expression `({}).constructor.constructor('…')()` compiles to a live `Function('…')()` call in the emitted JS, executing in the realm of whichever sink runs the compiled code. ### Attack surfaces All three surfaces share the same root cause (no denylist in `transform.ts`) and are addressed by the same one-file patch: | # | Entry point | Threat model | |---|---|---| | 1 | Browser playground — `https://elo-lang.org/try/?code=…&run=1` | **0-click XSS / account takeover** against elo-lang.org. `?run=1` triggers `setTimeout(() => this.run(), 100)` in `playground_controller.ts:531`; the server issues a 301 that preserves `?code=`. Any shared URL that contains a payload compromises the visitor's session on elo-lang.org. | | 2 | `bin/el…CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HFix available@enspirit/eloCVE-2026-442669.8Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels### Summary Elo's Ruby backend emits attacker-controlled text into Ruby double-quoted strings without escaping the `#` character. Because `#` begins Ruby's interpolation sequences — `#{expr}`, `#@ivar`, `#@@cvar`, `#$gvar` — and any expression wrapped in `#{...}` may use backticks for shell execution, an Elo program that contains a crafted string literal or a labelled subtype constraint compiles to Ruby that evaluates attacker-chosen Ruby, and through backticks runs attacker-chosen shell commands, at runtime. The same Elo source compiled to JavaScript, Python, or SQL is benign, so the bug also breaks the cross-target portability guarantee the rest of the compiler honours. ### Vulnerable sinks Two sinks exist in `src/compilers/ruby.ts` at commit `749af7b`: 1. **String-literal emitter — lines 180–184.** The emitter escapes backslash, double quote, and control characters, but not `#`. Any `#{...}` sequence in an Elo string literal flows straight into the emitted Ruby source. 2. **Labelled subtype-constraint branch — lines 405–412.** The error message passed to `p_fail(p, "...")` is wrapped in a Ruby double-quoted string with no escape pass at all. Because the parser at `src/parser.ts:1339–1348` accepts single-quoted Elo strings as constraint labels, a label such as `'#{` `` `id` `` `}'` flows unchanged into the emitted Ruby. ### Attack surfaces All three surfaces share the same root cause (the missing `#` escape in the Ruby double-quoted-string emission path) and are addressed by the same patch: | # | Entry point | Threat model | |---|---|---| | 1 | `/try` playground on elo-lang.org (Ruby target) | 0-click server-side RCE against elo-lang.org infrastructure from a shared PoC URL | | 2 | `bin/eloc -t ruby -x` on a CI or DevOps host | RCE on any host that passes Elo strings through the CLI | | 3 | Library API — `defaultFormats.elo.parse()` with a Ruby emission step | Ruby RCE for any downstream integrator using Elo as a rule engine, configuration DSL, or form builder DS…CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HRCEFix available@enspirit/eloCVE-2026-442657.4Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fieldsElo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1.CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HRCEFix availableenspirit eloCVE-2026-118008.1Keycloak has authentication bypass via jwt algorithm confusion### Description A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NFix availableorg.keycloak:keycloak-servicesCVE-2026-283278.2SolarWinds Dameware DLL Hijacking VulnerabilitySolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges.CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HVerify fixSolarWinds DamewareCVE-2026-283358.4SolarWinds Dameware Buffer Overflow VulnerabilitySolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required.CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:LRCEVerify fixSolarWinds DamewareCVE-2026-283369.9SolarWinds Dameware Command Injection VulnerabilitySolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HVerify fixSolarWinds DamewareCVE-2026-1196758.6mongorestore may bypass collection guards through a system.buckets prefixMongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HFix availableMongoDB Database ToolsCVE-2026-1095939.1An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exAn unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HVerify fixSonicWall Global Management System (GMS)CVE-2026-1039168.4Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directoryDocker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XFix availableDocker Docker SandboxesCVE-2026-1216247.6Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate ValidationNanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NFix availableNanosystems SupremoCVE-2026-1157147.4Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS ConnectionsImproper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NVerify fixElastic Elastic Docker imagesCVE-2026-1152947.3Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource DeletionImproper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can result in the deletion of resources such as Kibana spaces and other organizational assets that the low-privileged user cannot delete directly. Exploitation requires an administrator to interact with the affected Fleet interface.CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:HVerify fixElastic KibanaCVE-2026-1152907.5Uncontrolled Recursion in Elasticsearch Leading to Denial of ServiceUncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HVerify fixElastic ElasticsearchCVE-2026-1216028.5Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOINSolanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NRCEFix availablesolanum-ircd solanumCVE-2026-1216038.5Solanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL HandlerSolanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution.CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NRCEFix availablesolanum-ircd solanumCVE-2026-651687.0NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HVerify fixNVIDIA SlurmCVE-2026-1215617.7Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export DownloadsLabel Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COCO with images to read responses, and spoof Host to capture the organization owner's API token.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NFix availableHumanSignal label-studioCVE-2026-1192157.6AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's accountAuthorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NFix availableteam-alembic ash_authenticationCVE-2026-1212609.4Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injectionA flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:PRCEVerify fixZiroom ZHOME A0101CVE-2026-1184877.5Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParserIn Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HVerify fixEclipse Foundation Eclipse Vert.xCVE-2026-1197418.7rsync through 3.5.1 Denial of Service via hash_search() Checksum Collisionsrsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NFix availableRsyncProject rsyncCVE-2026-1069917.1hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control.hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:LVerify fixUnknown productCVE-2026-733288.6Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NVerify fixvolmarg personal-management-systemCVE-2026-1215607.1LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/postsLogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:NFix availablelogchimp logchimpCVE-2026-1215598.6GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User CloningGLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, yielding an attacker-controlled Super-Admin account.CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NFix availableglpi-project GLPICVE-2026-1215578.2WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwootWPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:NFix availablewppconnect wppconnect-serverCVE-2026-1215568.7FastBee through 2.1.0 IDOR via /iot/product By-ID EndpointsFastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:NFix availablebeecue FastBeeCVE-2026-1215548.2cordova-plugin-advanced-http through 3.3.1 Cookie Leak via Cross-Origin Redirectscordova-plugin-advanced-http through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts by forwarding an explicitly set Cookie header across cross-origin redirects. Attackers controlling a redirect target, via an open redirect or attacker-supplied URL, can receive the original host's session cookies and hijack user sessions.CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NFix availablesilkimen cordova-plugin-advanced-httpCVE-2026-1215558.7Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumbFoxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NFix availableDrizzleTime FoxelCVE-2026-1215488.4nnn through 5.3 OS Command Injection via togglex PluginJarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NFix availablejarun nnnCVE-2026-1215438.7smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalationsmart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset passwords, and manage users, roles, and applications across integrated systems.CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NFix availablea466350665 smart-ssoCVE-2026-1214518.7AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRFAB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NFix availableamir1376 ab-download-managerCVE-2026-1214528.3bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Servicebbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NFix availablemlogclub bbs-goCVE-2026-1214507.7CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUIDCFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCloudFix availablePAICNI CFNextCVE-2026-1184897.5CachingWebClient shares user-specific HTTP responses across users via the shared cache tierIn Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NVerify fixEclipse Foundation Eclipse Vert.xCVE-2026-1214497.1Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack WebhookDockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack webhook, manual deploy, or create-and-deploy endpoints to receive stored and external-provider secrets such as 1Password or Vault values.CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NFix availableFinsys dockhandCVE-2026-1214488.7Dockhand before 1.0.54 Path Traversal via Stack Environment RoutesDockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/[name]/env/raw to disclose cross-environment secrets, write into protected directories, or poison deployment variables.CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:NFix availableFinsys dockhandCVE-2026-1214458.2svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Strippingdarylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens() when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE limits causing sanitize() to throw a TypeError and leave unsanitized content.CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NFix availabledarylldoyle svg-sanitizerCVE-2026-1214448.7svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graphsvg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NFix availabledarylldoyle svg-sanitizerCVE-2026-1214378.7Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimitersMistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "*a_b" to trigger an O(n²) index-fixup loop, stalling workers for seconds.CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NFix availablelepture mistuneCVE-2026-1214368.6Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.phpFroxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NFix availablefroxlor froxlorCVE-2026-1214298.7AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_license_key, which are executed via /bin/sh on station restart, compromising the container.CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NRCEVerify fixAzuraCast AzuraCastCVE-2026-1214278.7AzuraCast through 0.23.8 Config Injection via frontend_config.custom_configAzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NVerify fixAzuraCast AzuraCastCVE-2026-1214288.7AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in TimezoneAzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NRCEVerify fixAzuraCast AzuraCastCVE-2026-1214268.3Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparserNodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NFix availablenodemailer nodemailerCVE-2026-1214248.3Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested CommentsNodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NFix availablenodemailer nodemailerCVE-2026-1214258.3Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group ParsingNodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NFix availablenodemailer nodemailerCVE-2026-1214237.1SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value SerializationSurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NFix availablesurrealdb surrealdbCVE-2026-1214198.6SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject CollisionSurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NFix availablesurrealdb surrealdbCVE-2026-1214178.8SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV BackendsSurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HFix availablesurrealdb surrealdbCVE-2026-1214167.1SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style InvocationsSurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NFix availablesurrealdb surrealdbCVE-2026-1214148.2Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer UpdateParse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writable without a session, can send such an update to crash the Node process.CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NFix availableparse-community parse-serverCVE-2026-1214127.1FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC ReassemblyFreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NFix availableFreeRDP FreeRDPCVE-2026-1214098.2FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing TokenFreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a FixedTarget freerdp-proxy, triggering a tpdu_write_header assertion that crashes the process.CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NFix availableFreeRDP FreeRDPCVE-2026-769558.8A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to eA buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLPEVerify fixZyxel NWA110AX firmwareCVE-2026-1200918.7Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service hostTemporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from the client configuration supplied in the caller's request rather than from operator configuration, and building and using that client could run a command of the caller's choosing on the Worker Service host, under the account the server process runs as. Two frontend operations reach the provider. CreateWorkerDeploymentVersion requires a namespace write role. ValidateWorkerDeploymentVersionComputeConfig is registered as a read-only namespace operation, so an authenticated caller holding only a read role in a single namespace can reach the provider through it, and that route does not require a worker deployment to already exist. Execution happens while the submitted configuration is validated, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The control that keeps it unreachable is the compute provider allowlist, the dynamic configuration setting workercontroller.compute_providers.enabled. On Temporal Server 1.31.0 through 1.31.2 that allowlist does not deny by default: when the setting is unset the check is skipped and every registered compute provider is permitted, k8s included, so a stock deployment of those releases is exposed. On 1.31.3 and later 1.31 releases, and on 1.32.0 and later 1.32 releases, the allowlist denies by default, and a deployment is exposed only where k8s has been added to it. The 1.30 release line d…CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NRCECloudFix availableTemporal Technologies, Inc. Temporal Server
Nothing in this class right now.
- 7.3CVE-2026-63197traQ: XSS in the User Uploaded File Retrieval APIVerify fixtraPtitech traQ
1 min read - 8.2CVE-2026-63417Logging Redactor: PII data in str/repr of non primitive objects was not being redactedVerify fixarmurox loggingredactor
1 min read - 8.8CVE-2026-119922Babelfish for PostgreSQL Privilege EscalationCloudFix availableAWS babelfish-for-postgresql
1 min read - 7.0CVE-2026-63418Monitoring Plugins check_icmp: -H argument count overflow leads in setuid-root binaryLPEVerify fixmonitoring-plugins monitoring-plugins
1 min read - 9.8CVE-2026-44267Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member accessFix available@enspirit/elo
2 min read - 9.8CVE-2026-44266Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labelsRCEFix available@enspirit/elo
2 min read - 7.4CVE-2026-44265Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fieldsRCEFix availableenspirit elo
1 min read - 8.1CVE-2026-11800Keycloak has authentication bypass via jwt algorithm confusionFix availableorg.keycloak:keycloak-services
1 min read - 8.2CVE-2026-28327SolarWinds Dameware DLL Hijacking VulnerabilityVerify fixSolarWinds Dameware
1 min read - 8.4CVE-2026-28335SolarWinds Dameware Buffer Overflow VulnerabilityRCEVerify fixSolarWinds Dameware
1 min read - 9.9CVE-2026-28336SolarWinds Dameware Command Injection VulnerabilityVerify fixSolarWinds Dameware
1 min read - 8.6CVE-2026-119675mongorestore may bypass collection guards through a system.buckets prefixFix availableMongoDB Database Tools
1 min read - 9.1CVE-2026-109593An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exVerify fixSonicWall Global Management System (GMS)
1 min read - 8.4CVE-2026-103916Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directoryFix availableDocker Docker Sandboxes
1 min read - 7.6CVE-2026-121624Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate ValidationFix availableNanosystems Supremo
1 min read - 7.4CVE-2026-115714Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS ConnectionsVerify fixElastic Elastic Docker images
1 min read - 7.3CVE-2026-115294Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource DeletionVerify fixElastic Kibana
1 min read - 7.5CVE-2026-115290Uncontrolled Recursion in Elasticsearch Leading to Denial of ServiceVerify fixElastic Elasticsearch
1 min read - 8.5CVE-2026-121602Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOINRCEFix availablesolanum-ircd solanum
1 min read - 8.5CVE-2026-121603Solanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL HandlerRCEFix availablesolanum-ircd solanum
1 min read - 7.0CVE-2026-65168NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.Verify fixNVIDIA Slurm
1 min read - 7.7CVE-2026-121561Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export DownloadsFix availableHumanSignal label-studio
1 min read - 7.6CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's accountFix availableteam-alembic ash_authentication
1 min read - 9.4CVE-2026-121260Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injectionRCEVerify fixZiroom ZHOME A0101
1 min read - 7.5CVE-2026-118487Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParserVerify fixEclipse Foundation Eclipse Vert.x
1 min read - 8.7CVE-2026-119741rsync through 3.5.1 Denial of Service via hash_search() Checksum CollisionsFix availableRsyncProject rsync
1 min read - 7.1CVE-2026-106991hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control.Verify fixUnknown product
1 min read - 8.6CVE-2026-73328Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/Verify fixvolmarg personal-management-system
1 min read - 7.1CVE-2026-121560LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/postsFix availablelogchimp logchimp
1 min read - 8.6CVE-2026-121559GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User CloningFix availableglpi-project GLPI
1 min read - 8.2CVE-2026-121557WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwootFix availablewppconnect wppconnect-server
1 min read - 8.7CVE-2026-121556FastBee through 2.1.0 IDOR via /iot/product By-ID EndpointsFix availablebeecue FastBee
1 min read - 8.2CVE-2026-121554cordova-plugin-advanced-http through 3.3.1 Cookie Leak via Cross-Origin RedirectsFix availablesilkimen cordova-plugin-advanced-http
1 min read - 8.7CVE-2026-121555Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumbFix availableDrizzleTime Foxel
1 min read - 8.4CVE-2026-121548nnn through 5.3 OS Command Injection via togglex PluginFix availablejarun nnn
1 min read - 8.7CVE-2026-121543smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin EscalationFix availablea466350665 smart-sso
1 min read - 8.7CVE-2026-121451AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRFFix availableamir1376 ab-download-manager
1 min read - 8.3CVE-2026-121452bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email ServiceFix availablemlogclub bbs-go
1 min read - 7.7CVE-2026-121450CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUIDCloudFix availablePAICNI CFNext
1 min read - 7.5CVE-2026-118489CachingWebClient shares user-specific HTTP responses across users via the shared cache tierVerify fixEclipse Foundation Eclipse Vert.x
1 min read - 4.3CVE-2026-118527Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityExploitedFix availableIvanti Connect Secure
1 min read - 7.1CVE-2026-121449Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack WebhookFix availableFinsys dockhand
1 min read - 8.7CVE-2026-121448Dockhand before 1.0.54 Path Traversal via Stack Environment RoutesFix availableFinsys dockhand
1 min read - 8.2CVE-2026-121445svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS StrippingFix availabledarylldoyle svg-sanitizer
1 min read - 8.7CVE-2026-121444svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference GraphFix availabledarylldoyle svg-sanitizer
1 min read - 8.7CVE-2026-121437Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimitersFix availablelepture mistune
1 min read - 8.6CVE-2026-121436Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.phpFix availablefroxlor froxlor
1 min read - 8.7CVE-2026-121429AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()RCEVerify fixAzuraCast AzuraCast
1 min read - 8.7CVE-2026-121427AzuraCast through 0.23.8 Config Injection via frontend_config.custom_configVerify fixAzuraCast AzuraCast
1 min read - 8.7CVE-2026-121428AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in TimezoneRCEVerify fixAzuraCast AzuraCast
1 min read - 8.3CVE-2026-121426Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparserFix availablenodemailer nodemailer
1 min read - 8.3CVE-2026-121424Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested CommentsFix availablenodemailer nodemailer
1 min read - 8.3CVE-2026-121425Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group ParsingFix availablenodemailer nodemailer
1 min read - 7.1CVE-2026-121423SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value SerializationFix availablesurrealdb surrealdb
1 min read - 8.6CVE-2026-121419SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject CollisionFix availablesurrealdb surrealdb
1 min read - 8.8CVE-2026-121417SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV BackendsFix availablesurrealdb surrealdb
1 min read - 7.1CVE-2026-121416SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style InvocationsFix availablesurrealdb surrealdb
1 min read - 8.2CVE-2026-121414Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer UpdateFix availableparse-community parse-server
1 min read - 7.1CVE-2026-121412FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC ReassemblyFix availableFreeRDP FreeRDP
1 min read - 8.2CVE-2026-121409FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing TokenFix availableFreeRDP FreeRDP
1 min read - 7.1CVE-2026-121407FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk ChannelFix availableFreeRDP FreeRDP
1 min read - 7.1CVE-2026-121404FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATAFix availableFreeRDP FreeRDP
1 min read - 7.1CVE-2026-121402FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphicsFix availableFreeRDP FreeRDP
1 min read - 7.1CVE-2026-121400FreeRDP before 3.32.2 CPU Exhaustion via RDG Control PacketFix availableFreeRDP FreeRDP
1 min read - 8.2CVE-2026-121398FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump ModuleFix availableFreeRDP FreeRDP
1 min read - 7.1CVE-2026-121394FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoderFix availableFreeRDP FreeRDP
1 min read - 7.1CVE-2026-121395FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX DecoderFix availableFreeRDP FreeRDP
1 min read - 7.1CVE-2026-121393FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region AssertionFix availableFreeRDP FreeRDP
1 min read - 9.1CVE-2026-121392FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificateFix availableFreeRDP FreeRDP
1 min read - 7.1CVE-2026-121388FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRSTFix availableFreeRDP FreeRDP
1 min read - 8.7CVE-2026-121386FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image ReadersFix availableFreeRDP FreeRDP
1 min read - 7.5CVE-2026-121513Out-of-bounds Write in µD3TNFix availableD3TN GmbH µD3TN
1 min read - 7.5CVE-2026-121512Missing Release of Memory after Effective Lifetime in µD3TNFix availableD3TN GmbH µD3TN
1 min read - 7.1CVE-2026-121511Out-of-bounds Read in µD3TNFix availableD3TN GmbH µD3TN
1 min read - 7.5CVE-2026-121510Out-of-bounds Write in µD3TNFix availableD3TN GmbH µD3TN
1 min read - 8.8CVE-2026-85035Use-after-free via dynamically allocated message queue retained by the CAN RX filterFix availablezephyrproject zephyr
2 min read - 8.8CVE-2026-120572Incorrect boundary conditions in the Layout: Block and Inline componentVerify fixMozilla Firefox
1 min read - 7.0CVE-2026-119179MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's dataFix availableMongoDB Node.js Driver
1 min read - 7.4CVE-2026-121506Out-of-bounds Write in NTPsecFix availableNTPsec NTPsec
1 min read - 8.6CVE-2026-119742Nagios XI < 2026R2 OS Command Injection via mibs.phpRCEFix availableNagios Enterprises, LLC Nagios XI
1 min read - 8.6CVE-2026-108047Inadequate authorization vulnerability in Alosuite’s user invitation functionalityVerify fixAM System ALO Suite
1 min read - 7.1CVE-2026-121458Instatic before 0.0.21 Authorization Bypass via MCP Content Read ToolsFix availableCoreBunch Instatic
1 min read - 8.8CVE-2026-76124BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback EndpointRCEVerify fixBuddyBoss BuddyBoss App
1 min read - 9.2CVE-2026-89292Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured InfrastructuresFix availableEclipse Foundation Eclipse Mnestix
1 min read - 7.1CVE-2026-77777Improper access control vulnerabilityFix availableZohocorp ManageEngine Key Manager Plus
1 min read - 8.8CVE-2026-120333Broken Access Control in extension "Frontend User Registration" (sf_register)Fix availableTYPO3 Extension "Frontend User Registration"
1 min read - 8.1CVE-2026-77691Command injection vulnerabilityRCEFix availableZohocorp ManageEngine Key Manager Plus
1 min read - 7.1CVE-2026-120330Broken Access Control in extension "Mail" (mail)Fix availableTYPO3 Extension "Mail"
1 min read - 7.1CVE-2026-77778Improper access control vulnerabilityFix availableZohocorp ManageEngine Key Manager Plus
1 min read - 8.8CVE-2026-89293Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tamperingFix availableEclipse Foundation Eclipse Mnestix
1 min read - 8.6CVE-2026-105982Command Injection in IPsec VPNFix availableWelotec TK100
1 min read - 8.6CVE-2026-105981Command Injection in Digital I/ORCEFix availableWelotec TK100
1 min read - 8.6CVE-2026-105980Command Injection in WireGuard VPNFix availableWelotec TK100
1 min read - 8.6CVE-2026-105979Command Injection in ZeroTier VPNFix availableWelotec TK100
1 min read - 8.6CVE-2026-105978Command Injection in Management Control FunctionsRCEFix availableWelotec TK100
1 min read - 8.1CVE-2026-121022Default Administrator Password Change Not Enforced in Axxon One Web ClientFix availableAxxonSoft Axxon One
1 min read - 7.3CVE-2026-113421ThreadX Modules invokes trace-full callbacks after module unloadVerify fixEclipse Foundation Eclipse ThreadX
1 min read - 8.5CVE-2026-115231User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilegeVerify fixEclipse Foundation Eclipse ThreadX
1 min read - 9.8CVE-2026-4052Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)Fix availableWSO2 WSO2 API Manager
1 min read - 7.5CVE-2026-16900Authentication BypassFix availableZohocorp Log360
1 min read - 9.1CVE-2026-13594Improper Access Control vulnerabilityFix availableZohocorp Log360
1 min read - 7.7CVE-2026-77800Authentication bypass vulnerabilityFix availableZohocorp ManageEngine Key Manager Plus
1 min read - 8.1CVE-2026-120577FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' ParameterRCEVerify fixwpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
1 min read - 7.2CVE-2026-120558Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' ParameterVerify fixzorem Advanced Shipment Tracking for WooCommerce
1 min read - 7.5CVE-2026-120559Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path TraversalRCEVerify fixsatindersingh Contact Form Extender for Divi – Submissions DB & Extra Fields
1 min read - 8.1CVE-2026-120574SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account TakeoverVerify fixsurecart SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads…
1 min read - 8.1CVE-2026-120538Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal CaptureVerify fixsmub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
1 min read - 9.1CVE-2026-120518BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation HandlerRCEVerify fixkalengi BuddyPress XProfile Custom Image Field
1 min read - 9.8CVE-2026-120534Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field TypeVerify fixACF Extended Advanced Custom Fields: Extended PRO
1 min read - 7.4CVE-2026-77799Two-factor authentication bypassFix availableZohocorp ManageEngine Key Manager Plus
1 min read - 8.8CVE-2026-76955A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to eLPEVerify fixZyxel NWA110AX firmware
1 min read - 8.8CVE-2026-107441An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adVerify fixZyxel GS1900-24E firmware
1 min read - 7.8CVE-2026-120833labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-DispatchFix availableNIST labbench
1 min read - 7.4CVE-2026-120830Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosureVerify fixRed Hat Red Hat Enterprise Linux 10
1 min read - 8.7CVE-2026-71450Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Verify fixJohnson Controls EasyIO Neo EC and CW Edge Controller
1 min read - 8.2CVE-2026-115403NULL pointer dereference in the BSD raw IPv6 send path when the destination table is fullVerify fixEclipse Foundation Eclipse ThreadX
1 min read - 7.7CVE-2026-120752PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() CalloutFix availablePyMuPDF PyMuPDF
1 min read - 8.7CVE-2026-115215NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session poolVerify fixEclipse Foundation Eclipse ThreadX
1 min read - 9.8CVE-2026-86596s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN ParameterRCEVerify fixclavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls…
1 min read - 8.7CVE-2026-120091Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service hostRCECloudFix availableTemporal Technologies, Inc. Temporal Server
2 min read - 8.4CVE-2026-58873In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check.Verify fixGoogle Android XR
1 min read - 7.8CVE-2026-49906An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.carVerify fixGoogle Android
1 min read - 7.1CVE-2026-116767Improper input handling in Secure Access serversFix availableAbsolute Software Secure Access
1 min read - 8.8CVE-2026-105476Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.Fix availableWebPros cPanel
1 min read - 8.7CVE-2026-105475Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.Fix availableWebPros cPanel
1 min read - 7.1CVE-2026-116768Missing length validation in Absolute Secure AccessFix availableAbsolute Software Secure Access
1 min read - 8.7CVE-2026-29508ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF ParserRCEFix availableReadyMedia ReadyMedia (MiniDLNA)
1 min read - 9.4CVE-2026-97718CSRF in Secure Access Server v14.60Verify fixAbsolute Security Secure Access
1 min read - 8.1CVE-2026-91898Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability.RCEFix availableDell Alienware Command Center (AWCC)
1 min read - 7.4CVE-2026-59042In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition.Verify fixGoogle Android
1 min read - 7.4CVE-2026-59043In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition.Verify fixGoogle Android
1 min read - 7.4CVE-2026-59045In multiple locations, there is a possible memory corruption due to a race condition.Verify fixGoogle Android
1 min read - 8.4CVE-2026-59016In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal.Verify fixGoogle Android
1 min read - 8.4CVE-2026-59004In multiple locations, there is a possible permission bypass due to an uncaught exception.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58957In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58944In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58946In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58934In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58866In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission Verify fixGoogle Android
1 min read - 8.4CVE-2026-58867In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check.Verify fixGoogle Android
1 min read - 7.8CVE-2026-58836In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideVerify fixGoogle Android
1 min read - 8.4CVE-2026-58837In multiple locations, there is a possible background activity launch due to a logic error in the code.Verify fixGoogle Android
1 min read - 7.5CVE-2026-58853In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check.Verify fixGoogle Android
1 min read - 8.4CVE-2026-55287In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading Verify fixGoogle Android
1 min read - 8.4CVE-2026-55271In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-55263In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading or insufficVerify fixGoogle Android
1 min read - 8.4CVE-2026-55257In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI.Verify fixGoogle Android
1 min read - 8.4CVE-2026-45514In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-49923In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-28588In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code.Verify fixGoogle Android
1 min read