CVE-2026-117679: SHIRASAGI Project SHIRASAGI: A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute…

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's web browser when the user accesses a website using the affected product...

CVE-2026-54141: tinyhumansai openhuman: OpenHuman is an open-source agent harness available as a desktop application and Rust library

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic channel AgentTurnRequest that uses the default tool policy without establishing an...

CVE-2026-87856: Unknown Subscriptions for WooCommerce: The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on…

The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content...

CVE-2026-123197: wppconnect wppconnect-server: WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers…

WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file .webp requests to retrieve stickers from any session,...

CVE-2026-122049: Campcodes Bitcoin Wallet System: A flaw has been found in Campcodes Bitcoin Wallet System 1.0

A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function randomint of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is...

CVE-2026-81815: SQL Injection

SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request e.g. ic=Y with a crafted...

CVE-2026-100361: SuiteCRM: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at...

CVE-2026-114604: ardatan graphql-tools: GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment ca...

CVE-2026-103021: openemr: OpenEMR is a free and open source electronic health records and medical practice management application

OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate tempauthuserid and load that account's usersettings before authentication succeeds...

CVE-2026-88981: kubeflow pipelines: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend artifact download path for source=s3 or source=minio accepts providerInfo.Params.endpoint, and the archived pod-log path accepts S3-compatible endpoint metadata from...

CVE-2026-104137: openemr: OpenEMR is a free and open source electronic health records and medical practice management application

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the smssearch branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot...

CVE-2026-82960: Code Injection

Improper Control of Generation of Code 'Code Injection' in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a...

CVE-2026-49407: tinyhumansai openhuman: OpenHuman is an open-source agent harness available as a desktop application and Rust library

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.44, its local /ws/dictation WebSocket endpoint lacks client authentication and browser-origin validation. An unauthenticated client, including a malicious web page able to reach the...

CVE-2026-100363: SuiteCRM: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the V8 module API exposes CRUD operations for administrator-only modules to any authenticated OAuth2 user. The affected flow begins at /Api/V8/module and uses...

CVE-2026-122050: Campcodes Complete Sales and Inventory System with Credit Management: A vulnerability was found in Campcodes Complete Sales and Inventory System with Credit Management 1.0

A vulnerability was found in Campcodes Complete Sales and Inventory System with Credit Management 1.0. This issue affects some unknown processing of the file /ahira/login.php. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out...

CVE-2026-122313: kyverno: Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to…

Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression CEL output lacking namespace checks. Attackers can emit a literal target...

CVE-2026-111771: modelcontextprotocol, @modelcontextprotocol: The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context…

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprotocol/express, and...

CVE-2026-111494: TPC Software Matchpoint: Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any…

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify...

CVE-2026-122144: nliautaud pico-content-editor: A security flaw has been discovered in nliautaud pico-content-editor up to 02d5ad6c820c5050c542ab9505819b5e0a0ba1af

A security flaw has been discovered in nliautaud pico-content-editor up to 02d5ad6c820c5050c542ab9505819b5e0a0ba1af. This vulnerability affects unknown code. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the publi...

CVE-2026-122190: SourceCodester Online Food Ordering System: A vulnerability was found in SourceCodester Online Food Ordering System 1.0

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/addcategory.php of the component Category Management. Performing a manipulation of the argument categorytitle results in cross site scripting. The attack may ...