CVE-2026-77372: VeraCrypt: VeraCrypt provides disk encryption with strong security based on TrueCrypt

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.30, the Unix, macOS, and FreeBSD serialization paths in src/Platform/Serializer.cpp and src/Volume/VolumePassword.cpp accept untrusted length and count values when deserializing data that can cross from the...

CVE-2026-82033: deepseek-ai deepseek-harness: DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication…

DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local process, including those running as a different OS user, to reach unauthenticated session methods...

CVE-2026-112116: ASUS System Control Interface: An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user…

An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through crafted device control requests, ultimately resulting in a complete compromise of the affected system. Refer to the ' Security...

CVE-2026-121803: Out-of-bounds Write

In UFS Field Firmware Update FFU functionality, there is a possible out-of-bounds write due to missing bounds checking on the PRDT table size. This could lead to local code execution or denial of service with no additional execution privileges needed...

CVE-2026-84730: ASUS Router firmware: Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute…

Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name. Refer to the ' Security Update for ASUS Router AiCloud Feature ' section on the ASUS Security Advisory for more...

CVE-2026-122019: 6amTech 6valley: A vulnerability was identified in 6amTech 6valley 16.0

A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument userresponse leads to authorization bypass. The attack may be launched...

CVE-2026-122235: janhq jan: Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows…

Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to make the write or edit tools follow...

CVE-2026-121818: About Time Technologies Herowatch Go: Herowatch Mini developed by About Time Technologies has a system signing vulnerability

Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code...

CVE-2026-119748: AyeCode Ltd: The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows…

The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybeuseinvoice parameter in processinvoice, bypassing the ownership and key checks...

CVE-2026-77779: Zohocorp ManageEngine Key Manager Plus: ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that…

ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope...

CVE-2026-118407: Unknown Premium Packages: The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original…

The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplyin...

CVE-2026-111740: Unknown Post Duplicator: The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before…

The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts...

CVE-2026-113783: espressif esp-idf: ESP-IDF is the Espressif Internet of Things (IOT) Development Framework

ESP-IDF is the Espressif Internet of Things IOT Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dnslookup in dns.c copies every cached address into a caller-provided single ipaddrt output buffer without a length parameter or...

CVE-2026-56065: Doofinder Doofinder for WooCommerce: Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder…

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through 2.17.2...

CVE-2026-16725: IBM Watson Speech Services Cartridge: IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote authenticated attacker to read arbitrary…

IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote authenticated attacker to read arbitrary files from the local filesystem due to path traversal...

CVE-2026-119366: AdvancedCoding wpDiscuz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.73...

CVE-2026-122020: NST Labs Tech Nstbrowser: A security flaw has been discovered in NST Labs Tech Nstbrowser up to 1.2.1

A security flaw has been discovered in NST Labs Tech Nstbrowser up to 1.2.1. The affected element is the function stopAllBrowsers of the file /api/agent/browser/stopAll of the component Local Agent Management Service. Performing a manipulation results in denial of service. Remote exploitation of...

CVE-2026-119746: ProSoft Technology: ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module…

ProSoft Technology ICX35 devices X35-HWC-A and ICX35-HWC-E contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and...

CVE-2026-121967: coder: Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5,…

Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them...

CVE-2026-76806: solidtime-io solidtime: Solidtime is an open-source time-tracking app

Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because...