CVE-2026-126091

Dental practice websites hosted with iDentalSoft are vulnerable to sensitive information exposure. The software sends a JSON response to any user who loads specific pages, potentially revealing OAuth credentials , password hashes , and Personally Identifiable Information (PII) . This vulnerabilit...

CVE-2026-63173

Omnispace Agora Project through version 26.10.0 is vulnerable to a broken access control issue in the isAutor() function within MdlObject.php. The flaw occurs because the system grants accessRight=3 based strictly on object authorship without verifying if the user still belongs to the object's sp...

CVE-2026-63170

Omnispace Agora Project (versions through 26.10.0 ) is vulnerable to a predictable token generation issue. An unauthenticated attacker can forge a shared-calendar iCal share token by deriving the md5Id() from predictable fields, such as the object creation time , which is disclosed via autorDate ...

CVE-2026-63167

The Omnispace Agora Project (versions through 26.10.0 ) is vulnerable to a SQL injection flaw. This issue occurs because the personsSort session value is concatenated unsanitized into ORDER BY clauses within the MdlUser.php and MdlSpace.php files. Authenticated general administrators can exploit ...

CVE-2026-63166

Omnispace Agora Project versions through 26.10.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in VuePersonsImportExport.php , where values from imported directory data or uploaded CSV files are rendered into table cell text and value attributes using only T...

CVE-2026-63164

The Omnispace Agora Project (through version 26.10.0 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists because the Ctrl::getCurObj() function in CtrlMail.php fails to perform a readRight() ownership check when processing the reloadMailTypeId parameter. This allows au...

CVE-2026-63155

The Omnispace Agora Project (through version 26.10.0 ) is vulnerable to an open redirect vulnerability. The root cause is located in the redir() function of Ctrl.php , where an attacker can manipulate the objUrl parameter to redirect users to arbitrary external URLs. By crafting malicious login l...

CVE-2026-63151

Omnispace Agora Project versions through 26.10.0 are vulnerable to a predictable token generation flaw. The root cause is a missing dateCrea value, which causes the md5Id token to collapse into md5(calendarId.userId). Since both calendarId and userId are small enumerable integers, an unauthentica...

CVE-2026-126173

The WordPress AutomatorWP Pro Webhooks plugin (versions

CVE-2026-124969

The Optimole WordPress plugin (versions

CVE-2026-63150

The Omnispace Agora Project (through version 26.10.0 ) is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is the application's failure to require an anti-CSRF token while merging $_GET and $_POST parameters. Furthermore, the vulnerability is exacerbated by SameSit...

CVE-2026-128986

Eclipse BaSyx Go Components versions up to and including 1.1.3 are vulnerable to an authorization bypass due to an interpretation conflict in how ABAC-enabled deployments handle URL encoding. The system matches ROUTE access rules against a fully decoded request path, but the router processes the ...

CVE-2026-129116

C-Kermit versions 7.0.197 before 11.1.515 are vulnerable to an authentication bypass in the IKSD SSL build. The root cause involves a flaw where a refused certificate login leaves the Telnet authentication state at AUTH_VALID . An attacker possessing a trusted certificate mapped to a refused acco...

CVE-2026-129117

C-Kermit versions 8.0.200 before 11.1.515 are vulnerable to an improper certificate validation flaw. The root cause is that the ssl_reply() function fails to call ssl_check_server_name(), leading to a lack of hostname verification during AUTHENTICATION SSL . This allows a machine-in-the-middle at...

CVE-2026-129118

C-Kermit versions 8.0.200 before 11.1.515 are vulnerable to an improper certificate hostname validation flaw within the dNSName_cmp() function in ck_ssl.c. Attackers can abuse wildcard matching—specifically involving asterisks, question marks, brackets, or empty labels—to impersonate hosts using ...

CVE-2026-129119

The C-Kermit file transfer utility (versions 6.0.192 before 11.1.515 ) contains a file collision protection bypass . A vulnerability in the gattr() function within ckcfn3.c allows a malicious sender to append data to existing files by marking transfers as RESEND . This process clears the REJECT d...

CVE-2026-129120

C-Kermit versions 11.0.506 before 11.1.515 are vulnerable to a RECEIVE CONFIRM bypass in the ckcfns.c component. The root cause is an error in the recursive GET root computation , which allows malicious Kermit servers to write unrequested files—such as .ssh/authorized_keys or shell startup files—...

CVE-2026-129121

C-Kermit versions 8.0.200 before 11.1.515 are vulnerable to a path traversal flaw in the doftpget() function within ckcftp.c. A malicious FTP server can exploit this by returning absolute paths, tilde names, or dot-dot components in NLST or MLSD listings during an MGET /RECURSIVE operation. This ...

CVE-2026-129122

C-Kermit versions 6.0.192 before 11.1.515 are vulnerable to a buffer overflow in the tn_snenv() function within ckctel.c. This flaw occurs when a malicious or machine-in-the-middle Telnet server sends oversized variable names during a NEW-ENVIRON SEND subnegotiation before authentication. The vul...

CVE-2026-129124

Versions of C-Kermit before 11.1.515 are vulnerable to an OS command injection vulnerability. The root cause is the improper neutralization of special elements in the syscmd() function, where unquoted arguments passed through REMOTE WHO or REMOTE SPACE are not properly sanitized. Attackers can ap...

CVE-2026-129123

The C-Kermit software (versions 8.0.200 before 11.1.515 ) is vulnerable to a buffer overflow in the getreply() function within ckcftp.c. A malicious or intercepted FTP server can overwrite client memory by sending overlong security replies. Specifically, the overflow occurs in the static reply_bu...

CVE-2026-129125

C-Kermit versions 6.0.192 before 11.1.515 are vulnerable to remote code execution (RCE) due to improper validation during REMOTE QUERY evaluation. An attacker can execute arbitrary shell commands on the server, even if host commands are disabled, by either directly invoking the command function v...

CVE-2026-129127

The SQLBot software, versions through 1.10.3 , contains a weak password hashing vulnerability. The application stores local account passwords in the sys_user.password table as unsalted MD5 digests generated by the md5pwd() function in security.py. Consequently, an attacker who gains access to the...

CVE-2026-129126

C-Kermit versions prior to 11.1.515 are susceptible to a heap buffer overflow in the putsrv() function within ckcfns.c. The vulnerability occurs during packet decoding when malicious peers send crafted packets utilizing kermit repeat-count compression in server command, GET, or file-header packet...

CVE-2026-129128

The Goose CLI (versions 1.35.0 before 1.53.0) is vulnerable to local code execution via the goose review command. The root cause is the improper handling of the diff.external setting in a repository's .git/config file. An attacker can provide a crafted repository that, when reviewed by a victim, ...

CVE-2026-129129

AiSOC versions 12.1.0 before 23.3.0 are vulnerable to a missing authentication flaw in the Next.js console rewrite routes. This allows unauthenticated attackers to query the enrichment service via the /api/v1/enrichment/lookup or /api/v1/enrichment/bulk endpoints. Impact includes the unauthorized...

CVE-2026-129130

The agent-device software, version 0.21.36 and earlier, is susceptible to a local file disclosure vulnerability. The root cause is the ability to open file:// URLs via an open command. Authenticated remote callers can exploit this by sending an open command with a file:// target through the /rpc ...

CVE-2026-129132

The MRBS application (versions before 1.13.0 ) is vulnerable to an LDAP injection in web/lib/MRBS/Auth/AuthLdap.php. The root cause is the interpolation of unescaped login usernames into DN search and group-membership filters. This allows attackers with valid directory credentials but without the...

CVE-2026-129131

Gameyfin versions prior to 2.6.2 are vulnerable to a missing authorization flaw in Hilla endpoints. The issue stems from the LiveSubscriptionSecurity component failing to check synchronous endpoint methods, such as GameEndpoint.sync , when they are annotated with @AnonymousAllowed . This allows u...

CVE-2026-129133

The Meeting Room Booking System (MRBS) version before 1.13.0 is vulnerable to a CSV formula injection vulnerability in the web/report.php component. The root cause is that the escape() function fails to neutralize leading formula characters, allowing authenticated users to inject malicious formul...

CVE-2026-129134

Versions of MRBS before 1.13.0 are vulnerable to a password reset poisoning vulnerability caused by a Host header injection . When the $url_base variable is unset, unauthenticated attackers can forge the Host header to redirect password reset links to a malicious host. This allows an attacker to ...

CVE-2026-129135

The picoquic library (versions before 2026.11.05.3e2e3d3 ) is vulnerable to an integer overflow within the picoquic_decode_time_stamp_frame() function. This flaw allows remote QUIC peers to corrupt stored timestamps by transmitting oversized TIME_STAMP values during connections using the TIME_STA...

CVE-2026-124279

The elixir-grpc grpc_server component (versions 1.0.0 before 1.1.0 ) is vulnerable to an Allocation of Resources Without Limits or Throttling (CWE-770) issue. The root cause lies in the GRPC.Server.Adapters.Cowboy.Handler.info/3 function, which requests up to 8,000,000 bytes per read from Cowboy ...

CVE-2026-121809

The elixir-grpc ecosystem is vulnerable to a CPU exhaustion attack due to a Loop with Unreachable Exit Condition in the grpc_server (versions 1.0.0 to 1.1.0) and grpc (versions 0.3.1 to 1.0.0) components. Specifically, the GRPC.Server.Adapters.Cowboy.read_stream/1 function fails to correctly hand...

CVE-2026-62974

The BACnet Stack C library for embedded systems contains a vulnerability where a malformed but non-empty BACnet WriteProperty request can trigger a non-terminating request-processing loop. Specifically, the issue occurs during the parsing of Life_Safety_Zone PROP_ZONE_MEMBERS within the official ...

CVE-2026-62973

The BACnet Stack C library for embedded systems contains a remote out-of-bounds read vulnerability in the official BACnet client application apps/readpropm (commit e2bdbf6). Specifically, when readpropm issues a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can p...

CVE-2026-62972

The BACnet Stack , an open source protocol stack C library for embedded systems, is vulnerable to an out-of-bounds read in the lighting_command_decode function located in src/bacnet/lighting.c. The flaw occurs because while the first field is decoded using a bounded size, subsequent nested decode...

CVE-2026-58265

The BACnet Stack , an open-source C library for embedded systems, contains a heap out-of-bounds read vulnerability in versions prior to 1.4.5, 1.5.1, and 1.6.0. The flaw exists in the bvlc_sc_decode_proprietary_option() function within the BACnet/SC header-option decoder. Specifically, the functi...

CVE-2026-124278

The elixir-grpc projects, specifically grpc_server (v1.0.0 to <1.1.0) and grpc (v0.8.0 to

CVE-2026-58498

The BACnet Stack C library for embedded systems contains a remote global-buffer-overflow in the official router-ipv6 application. The vulnerability exists in the routed APDU forwarding path and leads to an out-of-bounds write to the global transmit buffer under ASan. This issue affects versions p...

CVE-2024-58406

The Huatian Dynamic OA8000 collaborative office system is vulnerable to an unauthenticated path traversal vulnerability in the /OAapp/jsp/trace/ntkodownload.jsp endpoint. The application fails to restrict the filename request parameter to an intended directory or reject traversal sequences, allow...

CVE-2026-52790

The BACnet Stack C library for embedded systems contains a library-level memory safety issue in versions prior to 1.4.5, 1.5.1, and 1.6.0 . The vulnerability, located in writable Device string properties, is reachable via an unmodified official sample server (apps/server-basic/main.c) over BACnet...

CVE-2026-52789

The BACnet Stack C library for embedded systems is vulnerable to a Denial of Service (DoS) condition in the ReadPropertyMultiple (RPM) handler. Specifically, when processing a malformed RPM request packet lacking expected closing tags, the function handler_read_property_multiple enters an infinit...

CVE-2026-52788

The BACnet Stack C library for embedded systems contains three bugs in the bsc_node_parse_urls() function within src/bacnet/datalink/bsc/bsc-node.c. These bugs occur during the parsing of space-separated WebSocket URIs from a BACnet/SC Address Resolution ACK message. Specifically, two bugs result...

CVE-2026-52787

The BACnet Stack , an open-source protocol stack C library for embedded systems, contains a reachable out-of-bounds write vulnerability. The issue occurs during the encoding of the device.address-binding property, specifically within the address_list_encode() function, leading to a write in the g...

CVE-2026-49990

The BACnet Stack C library for embedded systems contains a vulnerability where a signed fileStartPosition from AtomicReadFile and AtomicWriteFile stream-access requests lacks sufficient validation before reaching RAM file backends . This flaw affects versions 1.4.2 to 1.4.4 and 1.5.0 . Consequenc...

CVE-2026-49341

The BACnet Stack C library for embedded systems contains a remotely reachable denial-of-service vulnerability in versions prior to 1.5.1 . The flaw specifically affects the default demo server built from the unmodified apps/server/main.c file. The root cause is identified as uncontrolled recursio...

CVE-2026-121808

The elixir-grpc grpc_core and grpc libraries are vulnerable to a Data Amplification memory exhaustion attack (CWE-409). The root cause is in GRPC.Codec.Erlpack.decode/2, which passes the message body to :erlang.binary_to_term/2 without enforcing a decoded size limit. Because the server's max_body...

CVE-2026-95377

Zenitel EdgeAudioClient devices—specifically VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT models—are vulnerable to an OS command injection in the TFTP provisioning module. The flaw exists in versions before 9.6.3.0 and 10.x before 10.1.3.0 . An unauthenticated adjacent attacker can execute arbitrary ...

CVE-2026-95614

The Zenitel Connect software (versions before 1.11.0 ) contains a vulnerability where the host configuration watcher applies an rsyslog configuration file from a data volume shared with the hiatus application container. A local attacker with write access to the hiatus container filesystem can exp...