CVE-2026-92194: Quest Foglight for Databases: Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability

Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. T...

CVE-2026-92198: Quest Foglight for Databases: Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit th...

CVE-2026-118626: MLflow: MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability

MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the configuratio...

CVE-2026-120631: Inefficient Regular Expression Complexity (ReDoS)

CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitution pattern that...

CVE-2026-120643: Cross-site Scripting (XSS)

CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and selfurl. Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostroph...

CVE-2026-120647: Improper Encoding or Escaping of Output

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header-attachment = $name writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passe...

CVE-2026-121589: spatie url-signer: A weakness has been identified in spatie url-signer up to 2.1.3

A weakness has been identified in spatie url-signer up to 2.1.3. Affected is the function AbstractUrlSigner::validate of the file AbstractUrlSigner.php of the component URL Validation. This manipulation of the argument expires causes incorrect type conversion. It is possible to initiate the attac...

CVE-2026-118627: MLflow: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

MLflow SHAP loadexplainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-121609: Qihoo 360 Whole Home Router M5: A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566

A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly...

CVE-2026-10859: IBM MQ: IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through…

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of...

CVE-2026-122009: DataLinkDC Dinky: A flaw has been found in DataLinkDC Dinky up to 1.2.5

A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flinkweb Proxy Endpoint. This manipulation of...

CVE-2026-57565: readest: Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading…

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user's identifier and a client-controlled...

CVE-2026-122015: NPC-Worldwide npcpy: A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27

A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function getmlxresponse of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-120757

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5Lexterntraverse in src/H5Lexternal.c, the default traversal callback for external links...

Linux Distros Unpatched Vulnerability : CVE-2026-121228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations...

Linux Distros Unpatched Vulnerability : CVE-2026-121390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.2 built with WITHAAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing or non-string...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Gin CORS middleware vulnerability (USN-8983-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8983-1 advisory. It was discovered that the Gin CORS middleware incorrectly handled wildcards at the end of origin strings. A remote attacker could possibl...

Linux Distros Unpatched Vulnerability : CVE-2026-121009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL::Abstract versions from 1.9001 before 2.00000104 for Perl skip the injectionguard check for function names given with -func. injectionguard is documented to...

Linux Distros Unpatched Vulnerability : CVE-2026-120648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing --...