Linux Distros Unpatched Vulnerability : CVE-2026-120638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-120641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file...

Linux Distros Unpatched Vulnerability : CVE-2026-120644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values...

Linux Distros Unpatched Vulnerability : CVE-2026-120650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX...

Linux Distros Unpatched Vulnerability : CVE-2026-120955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. Th...

CVE-2026-122135: mistralai mistral-vibe: Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by…

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute...

CVE-2026-119477: Jacob N. Breetvelt WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.05.003...

CVE-2026-104799: rnlab Mobile builder: The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,…

The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmpprofilesettings REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key allow-lis...

CVE-2026-114425: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer…

SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message...

CVE-2026-121951: FreeRDP: FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with…

FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can sen...

CVE-2026-121959: FreeRDP: FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO…

FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocketcontextread that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS closenotify, causing a client thread to spin and consume CPU until...

CVE-2026-121962: FreeRDP: FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User…

FreeRDP before 3.32.2 contains a heap buffer overflow in transportdefaultreadpdu when handling partial Early User Authorization reads during PROTOCOLHYBRIDEX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance the stream pointer beyond the 16 KiB...

CVE-2026-121963: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows…

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback threa...

CVE-2026-121971: Exposure of Sensitive Information

The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope such as authbearer or authbasic into a request before resolving a relative URL against the baseuri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together...

CVE-2026-122120: Yealink Plug-in Softwares: In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific…

In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution...

CVE-2026-122234: benjamine jsondiffpatch: jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by…

jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format or formatters.annotated.format can embed script that...

Linux Distros Unpatched Vulnerability : CVE-2026-121071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute...

Linux Distros Unpatched Vulnerability : CVE-2026-121091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain...

Linux Distros Unpatched Vulnerability : CVE-2026-121209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security...

Linux Distros Unpatched Vulnerability : CVE-2026-121212

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium...