CVE-2026-79759 Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values...

CVE-2026-79759 Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values...

CVE-2026-96746 Heap buffer overflow via mid-scan command list growth in client topology monitoring

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the...

CVE-2026-96746

The MongoDB C Driver contains an out-of-bounds write vulnerability within its connection-monitoring logic . Specifically, a heap buffer overflow can occur due to mid-scan command list growth during client topology monitoring. This flaw may allow an unauthenticated party —who controls name resolut...

CVE-2026-96746

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the...

CVE-2026-96746

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the...

CVE-2026-96746 Heap buffer overflow via mid-scan command list growth in client topology monitoring

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the...

EUVD-2026-86263

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the...

CVE-2026-96746 Heap buffer overflow via mid-scan command list growth in client topology monitoring

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the...

Heap buffer overflow via mid-scan command list growth in client topology monitoring

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the...

CVE-2026-97179

A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/xbasecoreproject/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of t...

CVE-2026-97179 O2OA Cipher Connection CipherConnectionAction.java list information disclosure

A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/xbasecoreproject/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of t...

CVE-2026-97179

The O2OA software (up to versions 9.5.3/10.0.2 ) contains a security vulnerability in the Cipher Connection Handler component. Specifically, the list function within the file o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java is susceptible t...

CVE-2026-97179 O2OA Cipher Connection CipherConnectionAction.java list information disclosure

A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/xbasecoreproject/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of t...

EUVD-2026-85845

A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/xbasecoreproject/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of t...

CVE-2026-82195 10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion

The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a...

CVE-2026-82195 10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion

The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a...

CVE-2026-82195

The 10Web Booster WordPress plugin (versions before 2.34.0 ) contains a vulnerability where it fails to restrict access to the routine responsible for issuing the shared secret used for cloud connection authentication. This flaw allows unauthenticated visitors to view the secret and repeatedly de...

CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

PT-2026-98232

Name of the Vulnerable Software and Affected Versions PyMongo affected versions not specified Description Connection string parsing decodes percent-encoded characters in the host portion before the host list is separated by its delimiters. If an application incorporates a hostname provided by an...