CVE-2026-124897: Mozilla Firefox: Use-after-free in the JavaScript: GC component

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-124898: Mozilla Firefox: Use-after-free in the DOM: Editor component

Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7...

CVE-2026-124952: Mozilla Firefox: Use-after-free in the Audio/Video component

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45...

CVE-2026-125402: ettercap: Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in…

Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslwgetclienthellosni in src/ecsslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory...

CVE-2026-91755: Hitachi Hitachi Dynamic Link Manager for VMware: Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware

Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01...

CVE-2026-109797: SAP_SE SAP/astonish: In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers…

In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenan...

CVE-2026-109803: SAP_SE SAP NetWeaver Knowledge Management (XML Forms): SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations…

SAP NetWeaver Knowledge Management XML Forms does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be...

CVE-2026-125077: SourceCodester Smart Attendance System with QR Code Scanner: A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0

A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been public...

CVE-2026-124932: Mozilla Firefox: Use-after-free in the Graphics component

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-113422: Eclipse Foundation Eclipse Kura: In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire…

In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 available since 5.1.0, org.eclipse.kura.rest.wire.provider, determine whether a configuration update targets a Wire Component, Driver or Asset from the factory...

CVE-2026-111260: Apache Software Foundation Apache TomEE: The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a…

The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's...

CVE-2026-109830: Siemens meta-iot2050: A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01)

A vulnerability has been identified in meta-iot2050 All versions = V01.03.01. Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device...

CVE-2026-120016: SAP_SE SAP NetWeaver Visual Composer: SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data

SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft a malicious link containing specially crafted input. If a victim clicks the link, the injected script executes in the victim's browser...

CVE-2026-60043: MB connect line, Helmholz: An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of…

An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability...

CVE-2026-46632: n/a Intel(R) Application Optimization User Interface: Uncontrolled search path for some Intel(R) Application Optimization User Interface within Ring 3: User Applications may…

Uncontrolled search path for some IntelR Application Optimization User Interface within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result...

CVE-2026-107243: Versa VOS: The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the…

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS...

CVE-2026-97874: Apache Software Foundation Apache TomEE: When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian…

When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to...

CVE-2026-60035: MB connect line, Helmholz: A high privileged remote attacker can perform a code injection in the backends network auth function leading to code…

A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability...

CVE-2026-111261: Apache Software Foundation Apache TomEE: The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows…

The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade...

CVE-2026-124907: Mozilla Firefox: Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component

Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-124940: Mozilla Firefox: Mitigation bypass in the File Handling component

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-124562: D-Link DIR-878: A vulnerability was identified in D-Link DIR-878 1.20B05

A vulnerability was identified in D-Link DIR-878 1.20B05. Affected is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument ConfigDNS/Primary/ConfigDNS/Secondary leads to buffer overflow. The attack may be initiated remotely. The exploit is publicly available...

CVE-2026-124564: D-Link DIR-878: A weakness has been identified in D-Link DIR-878 1.20B05

A weakness has been identified in D-Link DIR-878 1.20B05. Affected by this issue is the function GetListDirectory of the file bin/prog.cgi of the component HNAP Handler. This manipulation of the argument ListDirectoryPath causes path traversal. Remote exploitation of the attack is possible. The...

CVE-2026-40913: Apache Software Foundation Apache Airflow: Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the…

Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the ImportError.canread permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are...

CVE-2026-118798: CompuGroup Medical Wingesfar: Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and…

Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise...

CVE-2026-123370: tmatens compose-lint: compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion...

CVE-2026-123368: tmatens compose-lint: compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an...

CVE-2026-124636: kevquirk PureBlog: A security flaw has been discovered in kevquirk PureBlog up to 3.7.2

A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function savepage of the file includes/lib/content.php of the component Page Editor. Performing a manipulation of the argument page slug results in path traversal. Remote exploitation of the attack i...

CVE-2026-125227: FFmpeg: FFmpeg through 9.0.2 contains an integer overflow in cbs_jpeg_write_scan() in libavcodec/cbs_jpeg.c that causes a heap…

FFmpeg through 9.0.2 contains an integer overflow in cbsjpegwritescan in libavcodec/cbsjpeg.c that causes a heap buffer overflow on 32-bit builds. Attackers can supply a crafted MJPEG/JPEG stream with a scan of 512 MiB or more, processed by CBS bitstream filters like filterunits, to corrupt the...

CVE-2026-123800: supertokens supertokens-core: SuperTokens Core is an open source authentication server

SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in...

CVE-2026-119514: Webful Creations RepairBuddy: Incorrect Privilege Assignment vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Privilege…

Incorrect Privilege Assignment vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through 4.1234...

CVE-2026-121601: Red Hat: A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad)

A flaw was found in GStreamer's MXF demuxer plugin gst-plugins-bad. When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A loc...

CVE-2026-113437: DOS Co., Ltd., Rococo Co. Ltd.: Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd

Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd. and the ODM product rocoeyes provided by Rococo Co. Ltd. Arbitrary files may be deleted...

CVE-2026-123753: Apache Software Foundation Apache Axis2/Java: Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java

Server-Side Request Forgery SSRF vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and...

CVE-2026-123751: Unknown WP Duplicate: The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not…

The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This...

CVE-2026-120409: Unknown All-in-One Video Gallery: The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before…

The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted...

CVE-2026-115213: Unknown EASY-JS-WPAPI Client HANDLE for the WordPress REST-API: The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the…

The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator...

CVE-2026-118201: Unknown Limit Login Attempts Security: The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every…

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access...

CVE-2026-111403: WP Inventory WP Inventory Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Inventory WP…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Reflected XSS.This issue affects WP Inventory Manager: from n/a through 2.5.9...

CVE-2026-115204: Unknown AZEXO Store Locator: The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions…

The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an arbitrary name, location, and content...

CVE-2026-113504: Apache Software Foundation Apache Airflow: Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered…

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs a...

CVE-2026-119497: wpWax Directorist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.6...

CVE-2026-123770: Apache Software Foundation Apache Axis2/Java: Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not...

CVE-2026-123766: Apache Software Foundation Apache Axis2/Java: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module…

Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injectio...

CVE-2026-66675: StylemixThemes Motors: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Stored XSS.This issue affects Motors: from n/a through 1.4.128...

CVE-2026-81422: Unknown Advanced Appointment Booking & Scheduling: The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration…

The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in,...

CVE-2026-125211: FFmpeg: FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaption_trans_ass_subtitle()…

FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free vulnerability in aribcaptiontransasssubtitle in libavcodec/libaribcaption.c that frees subtitle rectangles using regioncount instead of numrects. Attackers can supply crafted ARIB captions whose later region exceeds the 8 KiB...

CVE-2026-123270: Redpanda Data Connect: Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated…

Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution RCE. In streams mode, the management HTTP API is exposed on 0.0.0.0:4195, but authentication is disabled by default and there is no authentication gate...

CVE-2026-112168: GALENO SISTEMI MAGISTRA: The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database,…

The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets...

CVE-2026-96285: Apache Software Foundation Apache Airflow: Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a…

Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded nextkwargs value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list...