CVE-2026-119748: AyeCode Ltd: The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows…

The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybeuseinvoice parameter in processinvoice, bypassing the ownership and key checks...

CVE-2026-115762: jgraph drawio: draw.io is a configurable diagramming and whiteboarding application

draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign...

CVE-2026-121940: Stonewuu ai-fusion-video: Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows…

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to rea...

CVE-2026-16725: IBM Watson Speech Services Cartridge: IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote authenticated attacker to read arbitrary…

IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote authenticated attacker to read arbitrary files from the local filesystem due to path traversal...

CVE-2026-101165: Unknown Mollie Payments for WooCommerce: The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the…

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment...

Linux Distros Unpatched Vulnerability : CVE-2026-121411

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers...

Linux Distros Unpatched Vulnerability : CVE-2026-120632

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST Content-Type contains...

Linux Distros Unpatched Vulnerability : CVE-2026-121520

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on...

Linux Distros Unpatched Vulnerability : CVE-2026-121392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tlsverifycertificate that accepts Common Name fallback despite non-matching S...

CVE-2026-121957: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client…

FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more t...

Linux Distros Unpatched Vulnerability : CVE-2026-54881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - ofono - None CVE-2026-54881 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

CVE-2026-106554: FasterXML jackson-dataformat-cbor: One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time…

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth CPU/GC-exhaustion DoS, PoC-proven. PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x...

CVE-2026-121950: FreeRDP: FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX…

FreeRDP before 3.32.2 does not check the product of surface dimensions in gdiCreateSurface when handling an RDPGFX CREATESURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A malicious RDP server can send a...

Linux Distros Unpatched Vulnerability : CVE-2026-120633

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, selfurl, virtualhost and virtualport. These take the host name and port from...

Linux Distros Unpatched Vulnerability : CVE-2026-114627

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTML::Tags or use...

Linux Distros Unpatched Vulnerability : CVE-2026-120758

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HLunprotect in src/H5HL.c. H5HLprotect pins a single metadata cache entry for a local...

Linux Distros Unpatched Vulnerability : CVE-2026-121401

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a denial of service vulnerability where rdgprocesspacket dispatches a PKTTYPEEXTENDEDAUTHMSG without verifying negotiated mode or...

CVE-2026-79405: Unisoc (Shanghai) Technologies Co., Ltd. Modem: In Modem Firmware, there is a possible system crash due to improper input validation of dedicated PUCCH configuration

In Modem Firmware, there is a possible system crash due to improper input validation of dedicated PUCCH configuration. This could lead to remote denial of service with no additional execution privileges needed...

CVE-2026-85036: zephyrproject zephyr: The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: bt_avdtp_l2cap_disconnected() in…

The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: btavdtpl2capdisconnected in subsys/bluetooth/host/classic/avdtp.c ends with kworksubmit&session-releasework, placing the embedded struct kwork on the system work queue's pending list. When the same struct btavdtp...

Linux Distros Unpatched Vulnerability : CVE-2026-121085

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page v...