CVE-2026-125203: FFmpeg: FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder…

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the Cook multichannel decoder in libavcodec/cook.c that fails to verify subpacket channel masks are disjoint. Attackers can supply a crafted RealMedia Cook stream with overlapping subpacket masks, causing...

CVE-2026-125207: FFmpeg: FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows…

FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attacker-controlled block size. Attackers can supply a crafted ACM file with maximum level and row count in extradata, making decodeinit alloca...

CVE-2026-121875: Unknown Post Duplicator: The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its…

The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management...

CVE-2026-121764: FolioVision FV Flowplayer Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212...

CVE-2026-121760: weDevs weDocs: Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control…

Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1...

CVE-2026-123131: Unknown GemBooking: The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own…

The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and...

CVE-2026-123091: Unknown Vigilant: The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than…

The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user...

CVE-2026-119504: DynamiApps Frontend Admin by DynamiApps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DynamiApps…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Stored XSS.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1...

CVE-2026-119483: 10Web Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.50...

CVE-2026-115256: Unknown Mail Debug for WooCommerce: The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce…

The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone to read the full body of every email...

CVE-2026-115212: Unknown mView 豆瓣电影: The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file,…

The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a subscriber to upload arbitrary PHP fil...

CVE-2026-111454: Apache Software Foundation Apache Airflow: Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset…

Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to...

CVE-2026-111421: Apache Software Foundation Apache Airflow: Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied…

Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the...

CVE-2026-111452: Apache Software Foundation Apache Airflow: Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under…

Apache Airflow's secrets masker matched sensitive key names only in their snakecase form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template...

CVE-2026-113508: Apache Software Foundation Apache Airflow: Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during…

Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL for example the FAB or Keycloak auth managers,...

CVE-2026-50204: Apache Software Foundation Apache Airflow: Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because…

Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the Log.extra column because the secrets masker matched only on configured sensitive key names. An authenticated low-privilege user with read access to the event-log / audit API — with no prior access to the...

CVE-2026-76185: Apache Software Foundation Apache Airflow Task SDK: Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters,…

Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped delimiters, so different team, secret id pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only...

CVE-2026-86468: Apache Software Foundation Apache Airflow: Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported…

Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing --description on Variable commands, --conn-extra, and the inline --password of airflow keycloak-auth-manager...

CVE-2026-112171: GALENO SISTEMI MAGISTRA: An attacker can inject malicious SQL statements through user-controlled input, allowing unauthorized access to,…

An attacker can inject malicious SQL statements through user-controlled input, allowing unauthorized access to, modification of, or disclosure of database data...

CVE-2026-112204: Fundacja Widzialni WidzialniCMS: WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint

WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft. This issue has been fixed in version 2.5...

CVE-2026-112164: laservideo lasergest: The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV,…

The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext...

CVE-2026-125066: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in…

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak CLJR decoder in libavcodec/cljrdec.c because decodeframe ignores initgetbits failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads...

CVE-2026-124999: n/a braindecode: A security vulnerability has been detected in braindecode up to 1.8.2

A security vulnerability has been detected in braindecode up to 1.8.2. This affects the function EEGModuleMixin.frompretrained of the file braindecode/models/base.py of the component Hub Integration. Such manipulation of the argument filename leads to path traversal. The attack can be executed...

CVE-2026-118458: CompuGroup Medical: The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application…

The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts...

CVE-2026-125196: FFmpeg: FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapve_encode() in libavcodec/liboapvenc.c that…

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapveencode in libavcodec/liboapvenc.c that allows attackers to corrupt heap memory by supplying frames larger than the configured encoder dimensions. Attackers can craft videos whose resolution changes mid-stream so that...

CVE-2026-125075: SourceCodester Smart Attendance System with QR Code Scanner: A vulnerability has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0

A vulnerability has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This impacts the function getMessage of the file createadmin.php of the component Admin Account Creation. Such manipulation of the argument e leads to missing authentication. The attack may be...

CVE-2026-125068: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame()…

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decodeframe in libavcodec/bink.c ignores initgetbits failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for...

CVE-2026-124079: rConfig: rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability…

rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without...

CVE-2026-121612: WPZOOM WPBruiser {no- Captcha anti-Spam}: Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication…

Weak Authentication vulnerability in WPZOOM WPBruiser no- Captcha anti-Spam goodbye-captcha allows Authentication Abuse.This issue affects WPBruiser no- Captcha anti-Spam: from n/a through 3.6.2...

CVE-2026-122661: wpWax Directorist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.7...

CVE-2026-121689: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure…

FrodoBots EarthRover Mini+ firmware v6.2.46.2.50.614.0 exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpasupplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB...

CVE-2026-115337: Progress Software WS_FTP Server: Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with…

Improper access control in Progress WSFTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users...

CVE-2026-115338: Progress Software WS_FTP Server: Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network…

Insufficient protection of communications in Progress WSFTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used...

CVE-2026-123811: dynatrace-oss dynatrace-mcp: Dynatrace MCP Server is an MCP server for Dynatrace Observability

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, a server started with the --http option accepts JSON-RPC tools/call requests without authentication, session validation, or Host and Origin protections before dispatching them under the server's configured Dynatrac...

CVE-2026-113961: Apple: An authorization issue was addressed with improved validation

An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage...

CVE-2026-123814: pyload: pyLoad is a free and open-source download manager written in Python

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/saveconfig by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in...

CVE-2026-123813: pyload: pyLoad is a free and open-source download manager written in Python

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/setuserpermission or /api/changepassword. Api.setuserpermission and...

CVE-2026-114031: Illumio Core Ven: Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for…

Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within the VEN installer, which grants LOCAL...

CVE-2026-118460: CompuGroup Medical: Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary…

Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests...

CVE-2026-118462: CompuGroup Medical: Update components download and execute code without proper authenticity verification, relying on ignored hashes or…

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution...

CVE-2026-118792: CompuGroup Medical Wingesfar: Default credentials permit access through AcuXDBC.

Default credentials permit access through AcuXDBC...

CVE-2026-118795: CompuGroup Medical: Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation…

Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access...

CVE-2026-125074: SourceCodester Smart Attendance System with QR Code Scanner: A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0

A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file resetpassword.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be...

CVE-2026-125106: wagtail: Wagtail is an open source content management system built on Django

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the...

CVE-2026-125268: FFmpeg: FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows…

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwttmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights,...

CVE-2026-125267: FFmpeg: FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in…

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstreamindex triggers an integer overflow, bypassing the reallocation...

CVE-2026-125259: FFmpeg: FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff_prores_kostya_encode_init() that miscalculates…

FFmpeg through 9.0.2 contains an integer overflow vulnerability in ffproreskostyaencodeinit that miscalculates framesizeupperbound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the proresks encoder, causing encodeframe to write...

CVE-2026-125261: FFmpeg: FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode_frame() in…

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encodeframe in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorotate vflip, so transcoding to SGI images...

CVE-2026-95778: Hewlett Packard Enterprise (HPE) HPE Morpheus Software: A remote code execution vulnerability exists in HPE Morpheus Software.

A remote code execution vulnerability exists in HPE Morpheus Software...

CVE-2026-125184: FFmpeg: FFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c)…

FFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerability in the CamStudio decoder libavcodec/cscd.c that copies uninitialized heap memory into decoded frames when decompressed payloads are short. Attackers can supply a crafted AVI with a CSCD stream whose LZO or zlib frames...