Linux Distros Unpatched Vulnerability : CVE-2026-121203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag...

CVE-2026-120634: Exposure of Data Element to Wrong Session

CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Unde...

Linux Distros Unpatched Vulnerability : CVE-2026-120684

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file conte...

CVE-2026-92187: Quest Foglight for Databases: Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability

Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this...

CVE-2026-121817: About Time Technologies Herowatch Go Server: Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability

Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions...

CVE-2026-108500: Apache Software Foundation Apache ActiveMQ: Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an…

Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters such as comma, plus, equals, backslash can manipulate the LDAP search ba...

CVE-2026-11749: LY Corporation Armeria: A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for…

A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validity period...

CVE-2026-118628: MLflow: MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability

MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within th...

CVE-2026-120631: Inefficient Regular Expression Complexity (ReDoS)

CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitution pattern that...

CVE-2026-120643: Cross-site Scripting (XSS)

CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and selfurl. Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostroph...

CVE-2026-120647: Improper Encoding or Escaping of Output

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header-attachment = $name writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passe...

CVE-2026-121816: About Time Technologies Herowatch Mini: Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability

Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability. Unauthenticated remote attackers can connect to the affected device's ADB service and obtain an ADB shell, thereby accessing device resources or performing related operations...

CVE-2026-119745: Sender: Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated…

Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the adminpostsenderdebugdownload action handled by downloadDebugFile without any capability, nonc...

CVE-2026-92185: Quest Foglight for Databases: Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability

Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this...

CVE-2026-121969: quozl netrek-client-cow: netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c…

netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SPSMESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connecti...

CVE-2026-122048: Campcodes Division Regional Athletic Meet Game Result Matrix System: A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1

A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2026-114420: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated…

SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated account-selection input in its GINA web interface. A remote unauthenticated attacker can enumerate email addresses...

CVE-2026-19721: TÜBİTAK BİLGEM Software Technologies Research Institute İmzager: Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research…

Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute İmzager allows Serialized Data External Linking. This issue affects İmzager: from 2.10.5 before 2.10.7...

CVE-2026-114421: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose…

SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that...

CVE-2026-92186: Quest Foglight for Databases: Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability

Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerabilit...