CVE-2026-129456 frr: bgpd use-after-free of Tunnel Encapsulation sub-TLVs after a malformed attribute length from a peer

In FRRouting, bgpd accepts a Tunnel Encapsulation attribute type 23 whose outer TLV length does not match the length of the attribute: the mismatch is only logged and the attribute is processed anyway. A BGP neighbor can send UPDATE messages carrying such an attribute that put the reference count...

CVE-2026-129447

Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascript: hyperlinks by supplying crafted DBML table url, headercolor, or TableGroup color settings. Attackers can send a crafted SVG link that,...

CVE-2026-129267

The sergix44 XBackBone software, version 3.8.2 and below , is vulnerable to a cross-site scripting (XSS) flaw in the MediaController::getRawById function within app/Controllers/MediaController.php. This vulnerability allows for remote attacks through input manipulation. While a public exploit exi...

CVE-2026-129264

The sox_ng software, up to version 14.8.1 , is vulnerable to a remote out-of-bounds write flaw within the VOC Decoder component. The vulnerability is specifically located in the read_samples_voc function of the src/voc.c file. An attacker can exploit this issue remotely to perform an out-of-bound...

CVE-2026-129262

The Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System (up to version 3.5) is vulnerable to an unrestricted file upload flaw. The issue exists in the DiyFileUpload function of the /ws.asmx file, which allows for remote exploitation. Public exploits ar...

CVE-2026-129261

A vulnerability exists in Kingston FURY CTRL RGB Control Software up to version 2.0.66.0 . The flaw is located in an unknown function within the NTIOLib_X64.sys library, specifically affecting the IOCTL Handler component. Due to insufficient access control , an attacker with local access can perf...

CVE-2026-129260

A path traversal vulnerability exists in Mereithhh VanBlog up to version 0.54.0 . The flaw is located in the fs.readFileSync function within the local.provider.ts file of the Custom Page Handler component. An attacker can exploit this remotely by manipulating the path argument to access unauthori...

CVE-2026-116753

The Multi Step for Contact Form 7 plugin for WordPress (versions up to and including 2.9.1 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the 'multipart field name (array key)' parameter. An unaut...

CVE-2026-127115

The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.10.6 . The root cause is insufficient input sanitization and output escaping regarding the buddyforms_form_content parameter. This flaw allows unauthenticated attackers to inje...

CVE-2026-120687

The Lightbox & Modal Popup WordPress Plugin (FooBox) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in versions up to and including 2.8.7 . The flaw stems from insufficient input sanitization and output escaping of the img alt attribute within .wp-caption containers . This allows un...

CVE-2026-110531

The FV Player 8 plugin for WordPress (versions up to and including 8.1.9 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the fv_player_videos parameter due to insufficient input sanitization and output escaping. An authenticated attacker with Subscriber-level access or h...

CVE-2026-129259

A cross-site scripting (XSS) vulnerability exists in Mereithhh VanBlog versions up to 0.54.0 . The flaw is located within an unspecified part of the packages/server/src/types/access/access.ts file, specifically affecting the Image Upload Endpoint component. An attacker can execute a remote manipu...

CVE-2026-129258

The Tenda AC18 (firmware versions 15.03.05.05_multi/15.03.05.19 Build 6318 ) is vulnerable to an insufficient verification of data authenticity within the Firmware Upgrade Handler component. Specifically, manipulating the upgradeFile argument in the /cgi-bin/upgrade file allows for a remote attac...

CVE-2011-10042

The HTTP::Session Perl module (versions before 0.43 ) is vulnerable to memcached command injection via the HTTP::Session::Store::Memcached component. The root cause is the lack of filtering on session IDs derived from client cookies, which are used directly as cache keys. An attacker can inject C...

CVE-2026-19907

The Shipo plugin for WordPress (versions 1.6 through 1.8.0 ) is vulnerable to an Authentication Bypass that can lead to Administrator privileges. The root cause is the authenticate_rest_user() function, which parses the LOGGED_IN_COOKIE value and authenticates the named user without verifying the...

CVE-2026-18053

The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 1.8.7 . The root cause is a mass-assignment vulnerability within the user_account_manager() function's edit_profile branch. The application iterates through all submitted $_POST fields an...

CVE-2026-120522

The Cloud Storage Manager for Fluent Forms WordPress plugin (versions up to and including 1.2.0 ) is vulnerable to unauthenticated arbitrary file write via Google Drive filename path traversal. The root cause is a lack of authorization checks on the connection/{driver}/save and /download/single-f...

CVE-2025-71464

The @kolkov/angular-editor library (versions before 3.0.4 ) is vulnerable to a Cross-Site Scripting (XSS) flaw within the toggleEditorMode() function. The root cause is the assignment of source view text to innerHTML without utilizing DomSanitizer for proper sanitization. An attacker can trick a ...

CVE-2026-129428

Pulse versions 5.0.17 before 6.8.0 are vulnerable to a missing authorization flaw in the /api/ai/approvals endpoints. This vulnerability allows authenticated users with viewer-level privileges to manage approval requests, enabling them to list pending requests to expose proposed commands and targ...

CVE-2025-71465

The @kolkov/angular-editor library (versions prior to 3.0.3 ) is vulnerable to a cross-site scripting (XSS) flaw within the refreshView() function. The root cause is the direct injection of HTML from ngModel or reactive form controls into the innerHTML without using DomSanitizer , effectively byp...

CVE-2026-129429

The Frappe india-payroll software, in versions prior to 16.0.4 , is vulnerable to a missing authorization flaw within the tax_regime_selector.py file. Specifically, the get_employee_details, compute_tax_comparison, and set_tax_regime methods do not sufficiently restrict access, allowing authentic...

CVE-2026-129430

Axeloz Filesharing versions prior to 2.14.3 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input when authenticated users store raw HTML or javascript: Markdown links in bundle descriptions. When recipients view the public bun...

CVE-2026-129432

The software Ettercap through version 0.8.5.1 is vulnerable to a heap out-of-bounds read within the dissector_mountd() function located in src/dissectors/ec_mountd.c. The root cause is that the application validates RPC credential and directory lengths independently rather than verifying them aga...

CVE-2026-129431

Ettercap versions through 0.8.5.1 are vulnerable to a heap out-of-bounds read in the dissector_socks() function located in src/dissectors/ec_socks.c. The root cause is the lack of length checks on SOCKS5 username and password fields. A network-adjacent attacker can exploit this by sending a craft...

CVE-2026-129433

Dokploy versions prior to 0.31.1 are vulnerable to an OS command injection flaw in the getComposeContainerCommand() function. Authenticated organization members can exploit this by providing serviceName values containing shell metacharacters through the backup.create or backup.update tRPC procedu...

CVE-2026-129255

A vulnerability exists in CoolerMaster MASTERPLUS+ version 1.9.6. The issue resides in the sub_11504 function within the WinRing0x64.sys library of the Device Driver component. By manipulating the PhysicalAddress argument, an attacker can cause incorrect default permissions . This attack is restr...

CVE-2026-129254

A reflected cross-site scripting (XSS) vulnerability exists in Opixido OCMS affecting the admin/TUI/index.php file. The flaw is caused by the improper neutralization of the img parameter, which allows an attacker to inject and execute arbitrary JavaScript in the victim's browser context. Practica...

CVE-2026-129115

The JSON::XS module for Perl (versions 3.0 through 4.04) contains a Use After Free (CWE-416) vulnerability. When the allow_tags option is enabled, the encode_rv function calls an object's FREEZE method in a list context, using a saved Perl stack pointer to encode each returned value. If a callbac...

CVE-2026-129114

The JSON::XS module for Perl (versions 3.04 to 4.04 ) is vulnerable to a one-byte heap out-of-bounds write in the incr_parse function. The root cause is an off-by-one error where the incremental buffer grows to 1.5x the required length without reserving space for the terminating NUL byte. Specifi...

CVE-2026-129113

The JSON::XS Perl module (versions 4.0_00 before 4.05) contains a vulnerability where the incremental parser corrupts the incremental buffer length during an incr_skip operation following a top-level number. Specifically, the parser maintains an offset into undecoded bytes; when the buffer is emp...

CVE-2026-124541

The JSON::XS module for Perl (versions before 4.05) is vulnerable to a memory leak in the decode_str function. When decoding strings, the module uses a fixed-size buffer; once filled, contents are moved into new scalars. If the input string is rejected due to control characters, invalid escapes, ...

CVE-2026-124540

The JSON::XS module for Perl (versions before 4.05 ) is vulnerable to stack exhaustion due to uncontrolled recursion in the decode_tag function. When allow_tags is enabled, nested tagged values initiated by the ( byte are decoded recursively but are not counted against the max_depth limit. This a...

CVE-2026-124539

The JSON::XS Perl module (versions before 4.05 ) is vulnerable to a memory leak in the decode_hv function. When an object is rejected due to a missing colon after a quoted key (that is not short plain ASCII), the decoded key scalar is not freed. A long-running process can have its memory exhauste...

CVE-2026-124536

The JSON::XS module for Perl (versions before 4.05 ) is vulnerable to memory exhaustion due to an issue in the incr_parse function. The parser incorrectly compares the max_size limit against the progress made rather than the actual buffer length. Because the parser treats a NUL byte as the end of...

CVE-2026-129251

A vulnerability exists in hrshadhin CloudSchool up to version 3.0.1 within the Event Description Handler component. Specifically, an unknown function in the file app/Http/Controllers/Backend/EventController.php fails to properly handle argument data, leading to cross-site scripting (XSS) . This f...

CVE-2026-129250

A buffer overflow vulnerability exists in the Edimax BR6478ACV2 firmware (version 1.23 ). The flaw is located in the formPPTPSetup function within the webs file, specifically caused by the improper handling of the pptpUserName argument. This vulnerability can be exploited remotely, and the exploi...

CVE-2026-129427

The Cervantes software, version v1.3-beta , is vulnerable to a Stored XSS flaw via the avatar upload feature. When chained with an authentication bypass in the /Attachments endpoint, an attacker could execute arbitrary code in another user's browser with elevated privileges, potentially leading t...

CVE-2026-37643

The Tenda HG21 (AX3000 Wi-Fi 6 VoIP XPON ONT, HW V1.0) is vulnerable to arbitrary root command execution via an Unrestricted Upload of File with Dangerous Type (CWE-434) and OS Command Execution (CWE-78) in the Boa 0.93.15 web server. The /boaform/formImportOMCIShell endpoint allows an attacker t...

CVE-2026-129248

A weakness exists in Akaunting versions up to 3.3.0 within the Invoice Item Validation component. The vulnerability is located in the calculation_to_quantity function of the helpers.php file, where a manipulation of the quantity argument leads to a numeric range comparison without a minimum check...

CVE-2026-129247

A path traversal vulnerability exists in yangzongzhuan RuoYi (up to version 4.8.3 ). The flaw is located in the Code Generator component, specifically within the getFileName function of the VelocityUtils.java file. By manipulating the className argument, a remote attacker can perform a path trave...

CVE-2026-129353

Technical details for CVE-2026-129353 are not publicly available in the provided documents. Monitor for updates as the entry is currently reserved.

CVE-2026-18742

The Flatsome theme for WordPress (versions up to and including 3.20.12 ) is vulnerable to DOM-Based Stored Cross-Site Scripting (XSS) . The flaw exists in the Custom HTML Block due to insufficient input sanitization and output escaping. Specifically, because wp_kses_post permits data-* attributes...

CVE-2026-129181

The projectworlds Visitor Management System 1.0 contains a SQL injection vulnerability within the Login Endpoint component. Specifically, the mysqli_query function in the file /img/user%20page.php fails to properly sanitize the Username argument. This flaw allows for remote attacks. The exploit f...

CVE-2026-129319

The create-ecdh library, a browserifiable implementation of Node.js crypto.createECDH, is vulnerable in versions 4.0.4 and below . The JavaScript implementation (browser.js) fails to validate peer public keys in ECDH.prototype.computeSecret or ECDH.prototype.setPublicKey, allowing an attacker to ...

CVE-2026-129354

Technical details are not publicly available in the provided documents. This CVE candidate has been reserved, and further information will be provided once publicized. Monitor for updates.

CVE-2026-129349

Technical details for CVE-2026-129349 are not publicly available in the provided documents at this time. Monitor for updates as the entry is currently reserved.

CVE-2026-129348

Technical details are not publicly available in the provided documents for CVE-2026-129348 . Monitor for future updates.

CVE-2026-129347

Technical details are not publicly available in the provided documents for CVE-2026-129347. Action: monitor for updates.

CVE-2026-126640

The WP Ultimate CSV Importer WordPress plugin versions before 9.3 is vulnerable to SQL injection . The flaw occurs because the plugin fails to escape values from imported files before using them in SQL queries during the LifterLMS content import process. This vulnerability allows high-privilege u...

CVE-2026-126697

The Quick Page/Post Redirect WordPress plugin (versions before 5.2.4 ) was distributed with a hidden update mechanism that bypassed WordPress.org to fetch updates from a private server. This allowed an attacker to push a backdoored build (version 5.2.3) that injected a the_content filter. The bac...