CVE-2026-122007: oqtane oqtane.framework: Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an…

Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type...

CVE-2026-121745: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when NVMAUTHHEADER is set, nvmdownload passes the credential to curl or wget as a --header "Authorization: ..." command-line argument. Process arguments are...

CVE-2026-121938: moyangzhan langchain4j-aideepin: langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated…

langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/uuid, which CharacterService.detail resolves...

CVE-2026-105702: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive…

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to exposure of error messages containing internal implementation details...

CVE-2026-122048: Campcodes Division Regional Athletic Meet Game Result Matrix System: A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1

A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2026-113782: espressif esp-idf: ESP-IDF is the Espressif Internet of Things (IOT) Development Framework

ESP-IDF is the Espressif Internet of Things IOT Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the...

CVE-2026-100235: Apache Software Foundation Apache ZooKeeper: Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of…

Incorrect authorization due to a time-of-check to time-of-use TOCTOU race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepare...

CVE-2026-121929: EmpireSoft EmpireCMS: A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0

A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.php. The manipulation of the argument spacename results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to...

CVE-2026-14252: IBM MQ: IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through…

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive information in log files that could be read by a local user...

CVE-2026-110964: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the…

The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators...

CVE-2026-108767: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response…

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers...

CVE-2026-121007: SQL Injection

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These...

CVE-2026-120642: Improper Use of Validation Framework

CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some pathinfo and scriptname values, Accept results, and the name lists from urlparam and cookie are returned without the taint flag, as is a cookie named expires fr...

CVE-2026-62365: wazuh: Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte joindata heap buffer but passes t...

CVE-2026-55368: h2o: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %errorx, %q when t...

CVE-2026-118628: MLflow: MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability

MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within th...

CVE-2026-120633: URL Redirection to Untrusted Site ('Open Redirect')

CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, selfurl, virtualhost and virtualport. These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and selfurl are t...

CVE-2026-121585: InfiniFlow RAGFlow: A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2

A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may b...

CVE-2026-121600: TOTOLINK A950RG: A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow. The attack can be...

CVE-2026-102340: telepresenceio telepresence: Telepresence enables local development against a remote Kubernetes or OpenShift cluster

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only the ManagesNamespace manager watchlist...