CVE-2026-114425: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer…

SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message...

CVE-2026-97701: zulip: Zulip is an open-source team collaboration tool

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit...

CVE-2026-122233: php frankenphp: FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP…

FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling httpgetlastresponseheaders can read...

CVE-2026-102345: zammad: Zammad is a web based open source helpdesk/customer support system

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket article content without the expected output encoding. An authenticated user can store markup in an article that is interpreted when another user views the ticke...

CVE-2026-94459: I.R.I.S S.A. IRISPowerscan: IRISPowerscan contain default user accounts with predictable credentials

IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected accounts, potentially resulting in...

CVE-2026-121931: Linksys WRT54GL: A security vulnerability has been detected in Linksys WRT54GL 4.30.18

A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of the component Traceroute Diagnostic Function. Such manipulation of the argument tracerouteip leads to os command injection. The attack can be launched...

CVE-2026-105991: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security…

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing Content Security Policy header...

CVE-2026-76419: Cisco Cisco Unified Communications Manager: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco…

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user o...

CVE-2026-101166: Unknown Mollie Payments for WooCommerce: The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before…

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products...

CVE-2026-90631: Apache Software Foundation Apache OpenOffice: Apache OpenOffice documents can contain links

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process. This issue...

CVE-2026-54384: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to…

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownershi...

CVE-2026-122016: yangzongzhuan RuoYi-Vue: A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2

A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of the argument perms causes improper privilege management. Th...

CVE-2026-108041: Unknown SEOPress: The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before…

The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate t...

CVE-2026-97373: jgraph drawio: draw.io is a configurable diagramming and whiteboarding application

draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An...

CVE-2026-119749: AyeCode Ltd: The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows…

The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in processitem ...

CVE-2026-121008: Cross-site Scripting (XSS)

SQL::Abstract::Tree versions before 2.00000104 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The...

CVE-2026-90634: Apache Software Foundation Apache OpenOffice: An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF…

An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue...

CVE-2026-121620: CoopCycle coopcycle-web: CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated…

CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to...

CVE-2026-54374: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows…

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embedded WeChat, Tencent QQ, and Fitbit credentials from the...

CVE-2026-110022: Phoenix Contact PLCnext Engineer: The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin…

The PFI plugin framework deploys executable assemblies DLLs from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker ca...