CVE-2026-115448: Apache Software Foundation Apache ZooKeeper: Uncontrolled recursion in Apache ZooKeeper

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...

CVE-2026-102340: telepresenceio telepresence: Telepresence enables local development against a remote Kubernetes or OpenShift cluster

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only the ManagesNamespace manager watchlist...

CVE-2026-113372: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds…

Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that holds the key can sign repository metadat...

CVE-2026-113780: espressif esp-idf: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework

ESF-IDF is the Espressif Internet of Things IOT Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esptee trap entry in espteevectorsplic.S and espteevectorsclic.S saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE...

CVE-2026-113374: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability

Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission nexus:capabilities:create can create this capability, which turns on header-based authentication for the instance. A...

CVE-2026-102339: telepresenceio telepresence: Telepresence enables local development against a remote Kubernetes or OpenShift cluster

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without...

CVE-2026-102337: webmin: Webmin is a web-based system administration tool for Unix-like servers

Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not...

CVE-2026-121145: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of...

CVE-2026-121146: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session...

CVE-2026-122148: Yealink MeetingBoard Pro: In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass…

In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot...

Linux Distros Unpatched Vulnerability : CVE-2026-121132

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross- origin data via a crafted HTML page. Chromium security...

Linux Distros Unpatched Vulnerability : CVE-2026-121107

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page...

CVE-2026-122266: AWS: Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC…

Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 VPC CNI before 1.22.3 might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AFPACKE...

Linux Distros Unpatched Vulnerability : CVE-2026-121199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local...

CVE-2026-122009: DataLinkDC Dinky: A flaw has been found in DataLinkDC Dinky up to 1.2.5

A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flinkweb Proxy Endpoint. This manipulation of...

CVE-2026-122008: oqtane oqtane.framework: Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of…

Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync withou...

Linux Distros Unpatched Vulnerability : CVE-2026-121187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page...

CVE-2026-122048: Campcodes Division Regional Athletic Meet Game Result Matrix System: A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1

A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2026-121638: WatchGuard AuthPoint Authentication Gateway: An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path…

An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers...

CVE-2026-121639: WatchGuard AuthPoint Authentication Gateway: A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote…

A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration...