CVE-2026-126318

REDAXO versions before 5.21.6 are susceptible to an authorization bypass vulnerability where editors lacking the version[live_version] permission can modify live article versions. The root cause is a failure in working version enforcement , allowing authenticated editors to bypass approval workfl...

CVE-2026-126320

Dockhand versions before 1.0.55 are affected by an improper authorization vulnerability in the files/download endpoint. The flaw allows authenticated Enterprise RBAC users with only containers:view permissions to download arbitrary container files, as the system fails to enforce the required cont...

CVE-2026-126319

The software Dockhand before version 1.0.55 is vulnerable to an arbitrary file read vulnerability. Authenticated users possessing the stacks:create permission can exploit this by supplying an arbitrary composePath during the stack adoption process. This allows an attacker to read sensitive files—...

CVE-2026-126321

Versions of Dockhand before 1.0.55 are vulnerable to a path traversal flaw in the file-browser endpoints. Authenticated users with stacks:edit privileges can bypass path guards by combining symlinks with .. sequences. This allows attackers to read sensitive files such as /proc/self/environ, the S...

CVE-2026-126322

OpenEMR versions before 8.3.0 are vulnerable to an unsanitized deserialization flaw within the interface/orders/patient_match_dialog.php component. An authenticated attacker can exploit this by supplying a crafted serialized key parameter, allowing them to control patient-matching criteria. Pract...

CVE-2026-126369

Versions of Vvveb through 1.0.8.6 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The issue resides in the sanitizeHTML() function, where a regex blacklist bypass allows low-privilege author or vendor users to inject scripts. Attackers can achieve this by saving post or produ...

CVE-2026-126323

The Vvveb platform, through version 1.0.8.6 , is vulnerable to a cross-site request forgery (CSRF) vulnerability. The root cause is that the checkCsrf() function in admin/controller/base.php only validates tokens for POST requests, failing to secure GET requests. An attacker could lure a logged-i...

CVE-2026-126370

The Vvveb content management system, versions through 1.0.8.6 , is vulnerable to Remote Code Execution (RCE) via a .sql Code Injection flaw in the editor/code/save function. This vulnerability allows users with restricted site_admin roles to inject PHP code by saving .sql files through the admin ...

CVE-2026-126371

Vvveb versions through 1.0.8.6 are vulnerable to an SQL injection flaw in the Admin_Auth_TokenSQL::update() function. The root cause is the interpolation of admin_auth_token array keys into an INSERT column list without utilizing a column whitelist or backtick escaping. Authenticated admin-panel ...

CVE-2026-126372

Vvveb versions through 1.0.8.6 are affected by a template upload bypass due to an incomplete fix for CVE-2026-41934. Authenticated users with editor or site_admin privileges can write server-side templates by bypassing save restrictions. Specifically, attackers can upload or rename .tpl files via...

CVE-2026-126373

The Vvveb software, versions 1.0.8.4 through 1.0.8.6 , is susceptible to an authorization bypass vulnerability within the content/revisions revision action. The root cause is that the revision() action fails to enforce an admin_id ownership restriction . This allows low-privileged Authors to acce...

CVE-2026-126374

The Vvveb application (versions through 1.0.8.6 ) is vulnerable to an SQL injection flaw. The root cause is that the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without proper escaping. Additionally, certain procedures in admin/sql/mysqli/product.sql and admin_a...

CVE-2026-126375

Versions of Vvveb through 1.0.8.6 are affected by a missing authorization vulnerability that enables cross-tenant digital asset tampering. A low-privilege vendor can access the shared storage/digital_assets directory to rename , delete , or overwrite files belonging to other vendors. By sending s...

CVE-2026-126376

Versions 1.0.8.4 through 1.0.8.6 of Vvveb are vulnerable to a Broken Object Level Authorization (BOLA) flaw due to an incomplete authorization fix. Low-privilege authors and vendors can bypass admin_id owner scoping by supplying a filter[admin_id] parameter. This allows unauthorized access to oth...

CVE-2026-126377

The Vvveb software (versions before 1.0.9.0 ) is susceptible to an authentication bypass vulnerability within the generateCookie() function in system/user/user.php. The root cause is the use of loose comparison to validate MD5 cookie hashes, which is exploitable via PHP Type Juggling . An unauthe...

CVE-2026-126378

Vvveb versions through 1.0.8.6 are vulnerable to a file upload flaw in the validFile() function of the theme installer. The root cause is the use of strpos() instead of strict path matching. Attackers with admin credentials can exploit this by uploading a ZIP file containing a PHP file with a pat...

CVE-2026-126379

Vvveb version 1.0.8.6 is vulnerable to a Server-Side Request Forgery (SSRF) flaw due to an incomplete fix that allows authenticated admin users to bypass DNS pinning . By providing a rebinding hostname to the oEmbedProxy URL parameter, an attacker can request non-443 URLs to access loopback servi...

CVE-2026-126381

The n8n workflow automation tool is vulnerable to an SQL injection in the Vector Store (OracleDB) node, affecting versions before 2.43.5 , 2.44.x before 2.44.1 , and 3.x before 3.0.1 . The root cause is a failure to validate Metadata Filter keys used in vector search queries. An attacker can prov...

CVE-2026-126380

Vvveb versions before 1.0.9.0 are vulnerable to Remote Code Execution (RCE) due to a denylist bypass in system/traits/media.php. The vulnerability occurs because the .phar extension is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files . Attackers ca...

CVE-2026-126382

The software n8n versions prior to 2.38.0 and 3.x before 3.0.1 is vulnerable to an authentication bypass in the Asana Trigger . The root cause is a missing authentication check that allows the application to accept a new webhook verification secret from any request containing an X-Hook-Secret hea...

CVE-2026-126384

The n8n workflow automation tool is vulnerable to Remote Code Execution (RCE) due to a dependency on a vulnerable version of GraphicsMagick bundled within its official Docker image. The vulnerability specifically affects the Edit Image node when processing images. Affected versions include those ...

CVE-2026-126383

The n8n workflow automation tool is vulnerable to a NoSQL injection in the MongoDB node's Update and Find And Replace operations. The root cause is insufficient validation of the update key value when processed from incoming items. Affected versions include before 1.123.89 , 2.x before 2.45.5 , 2...

CVE-2026-126385

The n8n platform (versions before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1) contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow. The system fails to verify that the browser completing the flow belongs to the user who initiated it. An attacker with ac...

CVE-2026-126386

The n8n software (versions before 1.123.89 , 2.x before 2.45.5 , 2.46.x before 2.46.1 , and 3.x before 3.0.1 ) is vulnerable to an open redirect in the unauthenticated MCP OAuth dynamic client registration flow. The vulnerability exists because the /mcp-oauth/register endpoint accepts arbitrary r...

CVE-2026-126387

The software n8n (versions before 2.46.1 ) is vulnerable to an arbitrary file read vulnerability. Authenticated members can access sensitive server files, such as instance configurations, by providing absolute paths to the Browser Use browser_upload tool . This occurs because a connected remote b...

CVE-2026-126388

The n8n automation tool, in versions prior to 2.46.1 , is vulnerable to a credential exposure issue. The root cause is that the sendCredentialsOnCrossOriginRedirect parameter defaults to true , causing the application to forward Authorization headers and basic auth credentials during cross-origin...

CVE-2026-126390

The software n8n (versions before 1.123.89 ) is vulnerable to a credential leakage vulnerability within the NocoDB node . The root cause occurs when the node downloads attachments; if an attacker has write access to a NocoDB attachment cell, they can insert a URL pointing to a host they control. ...

CVE-2026-126389

The software n8n (versions before 1.123.89 ) is vulnerable to an authentication bypass within the Chat Trigger component. When operating in embedded chat mode , the setup GET webhook route fails to enforce user authentication, allowing unauthenticated attackers to send GET requests to the chat we...

CVE-2026-126391

The software n8n versions prior to 1.123.89 is vulnerable to a Remote Code Execution (RCE) flaw due to insufficient isolation in the workflow expression evaluation sandbox. Authenticated users with permissions to create or modify workflows can craft expressions that reference unexpected JavaScrip...

CVE-2026-126392

Parse Server versions 9.10.6-alpha.1 before 9.10.8-alpha.1 are vulnerable to an information disclosure vulnerability. The issue occurs because clients with write access (but no read access) can use dot notation operations on top-level fields during updates. By observing whether the server returns...

CVE-2026-126394

The vLLM library (versions 0.30.0 before 0.31.0 ) contains a resource exhaustion vulnerability in the OpenCVDynamicOpenPanguVideoBackend . The issue stems from the component using request-controlled num_frames without an effective ceiling. Unauthenticated attackers can trigger a denial of service...

CVE-2026-126393

SiYuan versions prior to 3.8.10 are vulnerable to a Server-Side Request Forgery (SSRF) in the skill-install download path . The root cause is that the fetchBytes function performs only a parse-time hostname check instead of utilizing ssrfSafeClient . An attacker can provide a skill URL via the MC...

CVE-2026-126395

The vLLM library (versions 0.14.0rc1 before 0.31.0) is vulnerable to a heap address disclosure in the sanitize_message() function. The root cause is a lowercase-only regex that fails to scrub uppercase PIL image addresses. Unauthenticated attackers can exploit this by sending a crafted PNG to end...

CVE-2026-126396

The vLLM library (versions 0.24.0 to before 0.31.0 ) is vulnerable to a resource exhaustion issue within the MiniMax M3 VL video processor . The root cause is the lack of range validation or min_pixels

CVE-2026-126397

The vLLM library versions 0.10.1 through 0.31.0 are vulnerable to a Denial of Service (DoS) attack affecting Cohere2 Vision models. The root cause is the lack of a server-side upper bound on the mm_processor_kwargs.max_patches value, which is forwarded directly from request-controlled inputs to t...

CVE-2026-126398

The vLLM library (versions 0.28.0 to 0.30.0 ) contains a reachable assertion vulnerability in the GPUModelRunner._init_xdrope_positions component. This flaw allows remote attackers to cause a Denial of Service (DoS) by submitting specific embeddings-only requests. Specifically, an attacker can se...

CVE-2026-126399

The vLLM framework versions 0.19.0 before 0.31.0 is susceptible to a resource exhaustion vulnerability. An inference client can bypass server frame limits by manipulating the media_io_kwargs.video.num_frames parameter in chat completion requests. By providing a large value or -1 alongside multipl...

CVE-2026-126400

The software Password Pusher versions 1.49.0 before 2.17.0 is vulnerable to IP spoofing due to the use of unanchored trusted-proxy regular expressions. This flaw allows remote clients—specifically those in the 110.0.0.0/8 or 210.0.0.0/8 ranges, or those connecting directly—to supply X-Forwarded-F...

CVE-2026-126402

Versions of Fleet before 4.89.0 are vulnerable to a broken access control flaw within the user administration API . The root cause is an incorrect authorization check that allows the API to accept user creation or modification requests if the caller administers at least one assigned team. Exploit...

CVE-2026-126401

Versions of Fleet prior to 4.86.2 are vulnerable to an unauthenticated Denial of Service (DoS) attack. The root cause is quadratic XML canonicalization of unsigned SAML responses. An attacker can crash the Fleet server by sending a single crafted SAML response containing deeply nested elements wi...

CVE-2026-126403

The Coder platform versions 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 are vulnerable to an improper authorization flaw in the external agent credentials endpoint. This flaw allows users with only workspace read access to ob...

CVE-2026-126404

The Coder platform (versions 2.28.0 to 2.29.24, 2.30.0 to 2.34.16, 2.35.0 to 2.36.11, 2.37.0 to 2.37.8, and 2.38.0 to 2.38.4) is vulnerable to privilege escalation due to a lack of restrictions on new API keys. Specifically, the system fails to restrict newly created keys to the scopes, allow lis...

CVE-2026-126405

The Coder platform versions 2.21.0 before 2.29.24 , 2.30.0 before 2.34.16 , 2.35.0 before 2.36.11 , 2.37.0 before 2.37.8 , and 2.38.0 before 2.38.4 are vulnerable to a Memory Exhaustion Denial of Service (DoS) . The root cause is that the webpushSend function uses io.ReadAll to process Web Push e...

CVE-2026-126406

The wasmtime-wasi-http p2 implementation in Wasmtime is vulnerable to HTTP Request Smuggling . Affected versions include prior to 36.0.20 , 37.0.0 before 48.0.8 , 49.0.0 before 49.0.5 , and 50.0.0 before 50.0.1 . The root cause is the ability of the component to send outgoing requests with confli...

CVE-2026-126407

The Wasmtime runtime is vulnerable to a Denial of Service (DoS) attack in versions before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1. The root cause is that the engine allocates untracked host memory when a component receives a borrow of a resource it defined it...

CVE-2026-126409

Wasmtime versions 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 are vulnerable to a cross-engine type confusion issue. The root cause is that the StructType::with_finality_and_supertype function fails to verify that a supplied supertype belongs to the same Engine . This all...

CVE-2026-126408

The Wasmtime runtime versions 47.0.0 before 48.0.8 , 49.0.0 before 49.0.5 , and 50.0.0 before 50.0.1 are vulnerable to a Denial of Service (DoS) condition. The root cause is an insufficient type-check within the TypedFunc embedder API for specific parameter or result types, including I31 , Option...

CVE-2026-126410

The wasmtime-wasi crate in Wasmtime versions 48.0.0 before 48.0.8 , 49.0.0 before 49.0.5 , and 50.0.0 before 50.0.1 is vulnerable to a time-of-check/time-of-use (TOCTOU) race condition. The flaw exists in the wasip3 wasi:sockets udp-socket host implementation, allowing a malicious guest to bypass...

CVE-2026-126411

Frappe HRMS versions 16.0.0 before 16.50.0 are vulnerable to a Missing Authorization flaw (CWE-862) in certain HR workflow endpoints. This allows any authenticated user, even those with only the Employee role , to access restricted records. Specifically, an attacker can read candidate record deta...

CVE-2026-126412

Frappe HRMS versions 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 are vulnerable to a Missing Authorization flaw in a bulk record processing action. The root cause is a lack of write permission checks, which allows users with only read access to the related setup record to modify data. Authent...