CVE-2026-115573: openemr: OpenEMR is a free and open source electronic health records and medical practice management application

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLERACLMAP, and checkControllerAcl returns without enforcing any...

CVE-2026-123024: agentscope-ai AgentScope: A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11

A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function getcurrentuserid of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed...

CVE-2026-114235: Apache Software Foundation Apache OFBiz: Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows…

Direct Request 'Forced Browsing' in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Use...

CVE-2026-73117: Apache Software Foundation Apache Juneau: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target fr...

CVE-2026-123207: LibreSpark LibreTV: LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass…

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...

CVE-2026-111489: TPC Software Matchpoint: A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint…

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services...

CVE-2026-82894: Use of Externally-Controlled Input to Select Classes or Code

Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side...

CVE-2026-73578: Authentication Bypass Using an Alternate Path or Channel

Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted LASTVIEWNAME value, which is stored as saved-vi...

CVE-2026-100228: Apache Software Foundation Apache OFBiz: Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user…

Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGRCREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling. Users are...

CVE-2026-49393: tinyhumansai openhuman: OpenHuman is an open-source agent harness available as a desktop application and Rust library

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the core server protects HTTP POST requests to /rpc with bearer middleware but exposes Socket.IO rpc:request and chat:start handlers without equivalent transport or handler-level...

CVE-2026-110930: OpenAI: Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer

Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code...

CVE-2026-116571: signalwire freeswitch: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to…

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmprtp2rtmpH264 built an AVC decoder configuration record in a fixed stack buffer by copying...

CVE-2026-77604: vitali87 code-graph-rag: Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing…

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.readfile implementation in codebaserag/mcp/tools.py joins attacker-controlled filepath input to projectroot without...

CVE-2026-116573: signalwire freeswitch: FreeSWITCH is an open-source software telecommunications platform

FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 until 1.11.1, a stack-based buffer overflow in modsofia when generating dialog-event notifications. A peer can establish a dialog with an excessively long SIP To-header user part and subsequently subscribe to that...

CVE-2026-54913: bytecodealliance wasm-micro-runtime: WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime

WebAssembly Micro Runtime WAMR is a lightweight standalone WebAssembly Wasm runtime. Prior to 2.4.5, loadinitexpr in core/iwasm/interpreter/wasmloader.c accepts a non-reference heap-type byte for ref.null when WASMENABLEGC=0, while the local WASMValue curvalue union is not zero-initialized and...

CVE-2026-103019: openemr: OpenEMR is a free and open source electronic health records and medical practice management application

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, userSessionLogout in src/RestControllers/AuthorizationController.php uses decodeToken to process an idtokenhint without verifying its signature and, when the referenced trusted...

CVE-2026-122051: Edimax BR-6208AC: A flaw has been found in Edimax BR-6208AC 1.32

A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted...

CVE-2026-70659: leejet stable-diffusion.cpp: stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image,…

stable-diffusion.cpp is a pure C/C++ library for running diffusion model Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::loadimatrix in src/runtime/imatrix.cpp reuses the values and counts vectors for entrie...

CVE-2026-85068: networkupstools nut: Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS,…

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ipponcommand in drivers/blazerusb.c partially initializes char tmp64 with a short Megatec status query and then passes a fixed...

CVE-2026-102523: MariaDB server: MariaDB server is a community developed fork of MySQL server

MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An...