CVE-2026-111225: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...

CVE-2026-36436

An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated administrator can retrieve these credentials by inspecting the client-side code using standard browser developer tools. A vendor patch was rel...

UBUNTU-CVE-2026-106430

The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an...

PT-2026-115304

Name of the Vulnerable Software and Affected Versions MinDoc versions prior to 2.2-beta.3 Description An insecure direct object reference IDOR exists in the DocumentController.Content function. This allows authenticated users with a non-observer role on any book to access markdown and HTML conten...

GitLab 16.2 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-100755)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have...

CVE-2026-110832

FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wtsreaddrdynvcdatafirst that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATAFIRST message on an opened DVC declaring a large 32-bit length, causing...

CVE-2026-110851

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user...

CVE-2026-110841

n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members' private agent...

DEBIAN-CVE-2026-110832

FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wtsreaddrdynvcdatafirst that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATAFIRST message on an opened DVC declaring a large 32-bit length, causing...

CVE-2026-110832

FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wtsreaddrdynvcdatafirst that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATAFIRST message on an opened DVC declaring a large 32-bit length, causing...

CVE-2026-107795

Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload...

CVE-2026-110851 n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user...

CVE-2026-110832 FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via DRDYNVC DATA_FIRST

FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wtsreaddrdynvcdatafirst that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATAFIRST message on an opened DVC declaring a large 32-bit length, causing...

CVE-2026-110832

FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wtsreaddrdynvcdatafirst that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATAFIRST message on an opened DVC declaring a large 32-bit length, causing...

CVE-2026-110832 FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via DRDYNVC DATA_FIRST

FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wtsreaddrdynvcdatafirst that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATAFIRST message on an opened DVC declaring a large 32-bit length, causing...

CVE-2026-110832

FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wtsreaddrdynvcdatafirst that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATAFIRST message on an opened DVC declaring a large 32-bit length, causing...

CVE-2026-110832

FreeRDP versions 2.0.0 before 3.32.0 are vulnerable to a memory exhaustion flaw in the wts_read_drdynvc_data_first function. An authenticated client can trigger the server to commit large memory allocations by sending a seven-byte DATA_FIRST message on an opened DVC with a large 32-bit length. Th...

Exploit for CVE-2026-107081

CVE-2026-107081 — SQL Injection via Identifier Injection in SL...

CVE-2026-62664

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::createFolder constructs and creates the destination. An...

CVE-2026-104107

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input before ACL inheritance evaluates the uncanonicalized string. Wi...