CVE-2026-107319: Authorization Bypass Through User-Controlled Key

The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and...

CVE-2026-110593: Improper Neutralization of Special Elements Used in a Template Engine

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the sendemail Celery task, which compiles the user-supplied AccountEmail messagebody with django.template.Template. Authenticated organization members can submit template tags through POST /api/accounts/...

CVE-2026-107320: Exposure of Sensitive Information to an Unauthorized Actor

The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450...

CVE-2026-105107: Improper Neutralization of Special Elements used in an SQL Command

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-105236: Improper Certificate Validation

Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there. A server that serves several SNI nam...

CVE-2026-105261: Improper Neutralization of Input During Web Page Generation

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting elemen...

CVE-2026-105066: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9...

CVE-2026-53614: Improper Privilege Management

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility reads the attacker-controlled LIBMOUNTFORCEMOUNT2 environment variable with getenv, allowing a local low-privileged user to force the non-atomic legacy...

CVE-2026-53613: Time-of-check Time-of-use (TOCTOU) Race Condition

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy mount2 path is used without /proc, restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. ...

CVE-2026-110735: Signed to Unsigned Conversion Error

Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader core/io/resourceformatbinary.cpp, ResourceLoaderBinary::getunicodestring. A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a...

CVE-2026-102755: Improper Neutralization of Input During Web Page Generation

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save. The datasource and dataset Move to dialogs in...

CVE-2026-104103: Improper Limitation of a Pathname to a Restricted Directory

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

CVE-2026-103907: Missing Authorization

The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkitpostblock' and 'jegfindauthor' AJAX actions in versions up to, and including, 3.2.19. The 'wpajaxjkitpostblock' handler registered generically for eve...

CVE-2026-103905: Missing Authentication for Critical Function

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which...

CVE-2026-102899: Improper Authentication

Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the...

CVE-2026-102748: Missing Authentication for Critical Function

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to...

CVE-2026-103369: Improper Neutralization of Input During Web Page Generation

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-103414: Out-of-bounds Write

The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...

CVE-2026-103081: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0...

CVE-2026-110670: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the...

CVE-2026-102682: Insufficient Verification of Data Authenticity

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-103415: Out-of-bounds Write

When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication...

CVE-2026-103988: Improper Access Control

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against the source folder but does not...

CVE-2026-103307: Improper Neutralization of Special Elements used in an SQL Command

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL...

CVE-2026-103308: Insufficient Verification of Data Authenticity

The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to...

CVE-2026-103671: External Control of Assumed-Immutable Web Parameter

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

CVE-2026-103930: Improper Neutralization of CRLF Sequences in HTTP Headers

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

CVE-2026-102185: Loop with Unreachable Exit Condition

A Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihoming with preference-based designated-forwarder election...

CVE-2026-102084: Improper Validation of Syntactic Correctness of Input

An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control of the device. If an SRX device configured for AutoDiscovery VPN ADVPN receives a message fr...

CVE-2026-102080: Improper Resource Locking

An Improper Resource Locking vulnerability in the clock synchronization daemon clksyncd of Juniper Networks Junos OS on MX Series allows a unauthenticated, logically adjacent attacker to cause a Denial-of-Service DoS. If a SyncE or PTP upstream node sends a malformed message to an MX device...

CVE-2026-102078: Use After Free

A Use After Free vulnerability in the packet forwarding engine pfe of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihoo...

CVE-2026-102175: Heap-based Buffer Overflow

A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via ...

CVE-2026-102082: Improper Handling of Missing Special Element

An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service DoS. This issue is will occur when 'ssl-proxy' is configured on SRX platforms and during a TLS...

CVE-2026-102179: Out-of-bounds Write

An Out-of-bounds Write vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to cause a denial of service via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed...

CVE-2026-102079: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device. A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended...

CVE-2026-102177: Out-of-bounds Write

An Out-of-bounds Write vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured...

CVE-2026-102070: Reachable Assertion

A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol TWAMP client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet...

CVE-2026-102072: Improper Handling of Highly Compressed Data (Data Amplification)

An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an authenticated network-based attacker to cause a denial of service via a compressed gRPC request...

CVE-2026-102071: Reachable Assertion

A Reachable Assertion vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a specific RSVP packet...

CVE-2026-102058: Reachable Assertion

A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic...

CVE-2026-101945: Integer Overflow or Wraparound

An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker with an established EVPN BGP peering relationship to cause a denial of service via EVPN BGP route processing. The issue affects EVPN-enabled routing...

CVE-2026-102178: Stack-based Buffer Overflow

A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is...

CVE-2026-102180: Stack-based Buffer Overflow

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP...

CVE-2026-101957: Improper Initialization

An Improper Initialization vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group...

CVE-2026-101949: NULL Pointer Dereference

A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is...

CVE-2026-101948: NULL Pointer Dereference

A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated BGP peer to cause a denial of service via a specific BGP FlowSpec update received by an affected BGP session...

CVE-2026-102024: Integer Overflow or Wraparound

An Integer Overflow or Wraparound vulnerability in the routing daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated BGP peer to cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled...

CVE-2026-102017: Out-of-bounds Write

An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of service via Auto-RP mapping announcements received when Auto-RP mapping is enabled...

CVE-2026-102018: NULL Pointer Dereference

A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed PIM Bidir message...

CVE-2026-102014: Stack-based Buffer Overflow

A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response...