CVE-2026-121640: WatchGuard AuthPoint Authentication Gateway: An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has…

An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services...

CVE-2026-121745: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when NVMAUTHHEADER is set, nvmdownload passes the credential to curl or wget as a --header "Authorization: ..." command-line argument. Process arguments are...

CVE-2026-121746: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, nvm use --save and nvm install --save or -w write the resolved version to $PWD/.nvmrc with tee, which follows a symbolic link. A repository that commits .nvmrc a...

Linux Distros Unpatched Vulnerability : CVE-2026-121252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium...

CVE-2026-121939: David-Crty Databasement: Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser()…

Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser that links OIDC identities to local users by email without checking emailverified. Attackers can register an identity provider account with a victim's unverified email to log in as an...

CVE-2026-121938: moyangzhan langchain4j-aideepin: langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated…

langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/uuid, which CharacterService.detail resolves...

Linux Distros Unpatched Vulnerability : CVE-2026-121257

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a...

CVE-2026-121929: EmpireSoft EmpireCMS: A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0

A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.php. The manipulation of the argument spacename results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to...

Linux Distros Unpatched Vulnerability : CVE-2026-121255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page...

CVE-2026-122015: NPC-Worldwide npcpy: A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27

A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function getmlxresponse of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely...

CVE-2026-122028: NST Labs Tech Nstbrowser: A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0

A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0. Affected by this vulnerability is an unknown functionality of the file /agent/info of the component Local Agent API. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has...

Linux Distros Unpatched Vulnerability : CVE-2026-121216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HT...

CVE-2026-121965: parse-community parse-server: Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building…

Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building objects for Cloud Code triggers and LiveQuery, where a dot notation key whose intermediate segment resolves through an inherited member writes onto a process-wide built-in. Clien...

Linux Distros Unpatched Vulnerability : CVE-2026-121217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted networ...

Linux Distros Unpatched Vulnerability : CVE-2026-121224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially...

Linux Distros Unpatched Vulnerability : CVE-2026-120634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. Warnings are held in a...

Linux Distros Unpatched Vulnerability : CVE-2026-121189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML pag...

Linux Distros Unpatched Vulnerability : CVE-2026-121210

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit...

Linux Distros Unpatched Vulnerability : CVE-2026-121084

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code...