CVE-2026-111490: TPC Software Matchpoint: Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP…

Insecure direct object reference IDOR vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private...

IBM MQ 9.2 < 9.2.0.46 LTS / 9.3 < 9.3.0.43 LTS / 9.4 < 9.4.0.30 LTS / 9.4 CD < 10.0.1.0 / 10.0 < 10.0.0.6 (7294654)

The version of IBM MQ Server running on the remote host is 9.2.0.0 prior to 9.2.0.46 LTS, or 9.3.0.0 prior to 9.3.0.43 LTS, or 9.4.0.0 prior to 9.4.0.30 LTS, or 9.4.0.0 through 9.4.5.1 CD, or 10.0.0.0 through 10.0.0.5. It is, therefore, affected by a vulnerability as referenced in the 7294654...

CVE-2026-92693: pavel-odintsov fastnetmon: FastNetMon is a high-performance DDoS detector and sensor

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parserawpackettosimplepacketfull in src/simplepacketparserng.cpp dereferences ipv6extensionheaderfragmentt when IpProtocolNumberIPV6FRAG is present without first verifying that the eight-byte Fragment header...

CVE-2026-100144: Unknown IVPAY payments: The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it…

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database...

CVE-2026-107774: Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted…

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather tha...

CVE-2026-63217: SuiteCRM: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the generatePdf entry point loads an arbitrary record through BeanFactory::getBean without checking the requesting user's record access. The affected flow begins at...

CVE-2026-73101: Apache Software Foundation Apache Juneau: Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau

Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error body, even when...

CVE-2026-54140: tinyhumansai openhuman: OpenHuman is an open-source agent harness available as a desktop application and Rust library

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or...

CVE-2026-82912: Improper Neutralization of Special Elements used in an Expression Language Statement

Improper Neutralization of Special Elements Used in an Expression Language Statement 'Expression Language Injection' in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLSVIEW and ACCOUNTINGVIEW, the two view-level...

CVE-2026-81808: Missing Authorization

Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to bulk-modify product category and feature associations across arbitrary search results by seeding a broad product searc...

CVE-2026-111768: modelcontextprotocol, @modelcontextprotocol: The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context…

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of arr...

CVE-2026-104136: openemr: OpenEMR is a free and open source electronic health records and medical practice management application

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the newrecall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege...

CVE-2026-106713: An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the…

An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the com.dramawave.feature.web.WebPageActivity component...

CVE-2026-122324: oss-apps SplitPro: SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other…

SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense...

CVE-2026-116790: signalwire freeswitch: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to…

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryptographically...

CVE-2026-116785: signalwire freeswitch: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to…

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, wsreadframe decoded a WebSocket frame's 64-bit extended payload length with a 32-bit byte swap an...

CVE-2026-119344: ultravioletrs cocos: Cocos AI is a confidential computing system for AI

Cocos AI is a confidential computing system for AI. In version 0.8.2 and earlier, Cocos AI accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique machine identity an...

CVE-2026-111493: TPC Software Matchpoint: Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be…

Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be...

CVE-2026-69143: Rejected reason: This CVE is a duplicate of another CVE.

Rejected reason: This CVE is a duplicate of another CVE...

CVE-2026-123205: accel-ppp: accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that…

accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOGMAXSIZE. Attackers within client-ip-range can send an L2TP...