CVE-2026-121144: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application packag...

CVE-2026-122130: CESNET ipfixcol2: CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that…

CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16t message length counters. Attackers can send near-65535-byte data sets and large templates to a...

CVE-2026-122129: CESNET ipfixcol2: CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that…

CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::readstartheader that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes...

CVE-2026-122131: hapijs joi: Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js…

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile and merge that fails to reject a proto language key. Attackers supplying untrusted message configuration via any.messages, prefs, validate options or Joi.extend can replace...

CVE-2026-122126: resiprocate: reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader() that…

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader that allows malicious TURN servers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the...

CVE-2026-122124: Yealink UVC40 E2: On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi…

On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform aud...

CVE-2026-122137: romkatv: Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install…

Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted...

Linux Distros Unpatched Vulnerability : CVE-2026-121243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium...

CVE-2026-121945: CoopCycle coopcycle-web: CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read…

CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLECOURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/id/action to re-price, canc...

CVE-2026-121946: zbateson mail-mime-parser: zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in…

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such a...

CVE-2026-121750: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, nvmdownloadartifact downloads a release archive directly to its final path in $NVMDIR/.cache and verifies its checksum afterwards; on a checksum mismatch it...

CVE-2026-121937: blackholll loonflow: loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any…

loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticketflowhistory endpoint, which skips ticketviewpermissioncheck, to...

CVE-2026-121928: InfiniFlow RAGFlow: A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2

A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/fileutils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly...

Linux Distros Unpatched Vulnerability : CVE-2026-121043

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a...

Linux Distros Unpatched Vulnerability : CVE-2026-121050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromi...

Linux Distros Unpatched Vulnerability : CVE-2026-121059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross- origin data via a crafted HTML page. Chromium security...

CVE-2025-71454: vtenext: vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in…

vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrfcheck in include/utils/VteCsrf.php skips csrftoken validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read fro...

CVE-2026-115474: zulip: Zulip is an open-source team collaboration tool

Zulip is an open-source team collaboration tool. From 8.0 until 12.2, in organizations where the Who can view all other users in the organization setting restricted guests from viewing other users, saving or editing a direct message draft did not verify that the sender could access the draft...

CVE-2026-116376: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack…

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack due to an open redirect vulnerability...

CVE-2026-110282: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security…

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control...