CVE-2026-118487: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser`…

In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, the FrameParser in vertx-stomp creates a RecordParser without setting maxRecordSize, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the...

CVE-2026-121397: FreeRDP: FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP…

FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in savepngtobuffer that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CFDIB BIBITFIELDS image that, when converted to PNG for a local application, embeds client he...

CVE-2026-121451: amir1376 ab-download-manager: AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated…

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with...

CVE-2026-121445: darylldoyle svg-sanitizer: darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the…

darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE...

CVE-2026-121562: CTFd: CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that…

CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when...

CVE-2026-121409: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers…

FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a...

CVE-2026-121545: robiningelbrecht dreeve: Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that…

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strav...

CVE-2026-108058: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality

A stored Cross-Site Scripting XSS vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation require...

CVE-2026-121449: Finsys dockhand: Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret…

Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack...

CVE-2026-121260: Ziroom ZHOME A0101: A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploi...

CVE-2026-108055: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality

A stored Cross-Site Scripting XSS vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation require...

CVE-2026-121448: Finsys dockhand: Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and…

Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/name/env/raw to disclose cross-environment...

CVE-2026-121439: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that…

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set unvalidated content-length headers. Malicious wasip3 guests can splice an existing body into a new response with an incorrect content-length to perform...

CVE-2026-111362: djangoproject Django: An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.OGRGeometry does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected...

CVE-2026-121412: FreeRDP: FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets…

FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATAFIRST length and keep sending fragments without completing the message...

CVE-2026-28327: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability

SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges...

CVE-2026-119215: team-alembic ash_authentication: Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an…

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ashauthentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor...

CVE-2026-121395: FreeRDP: FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR…

FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit range to abort the client process...

CVE-2026-119742: Nagios Enterprises, LLC Nagios XI: Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the…

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before...

CVE-2026-121417: surrealdb: SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed…

SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawnlocal closures relying on future Drop for safety. Rust embedders that leak a dispatched future e.g. via mem::forget and drop the transaction...