CVE-2026-87857: Temporal Technologies, Inc. Temporal Server: Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request…

Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch...

CVE-2026-95779: Hewlett Packard Enterprise (HPE) HPE Morpheus Software: An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager…

An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager software...

CVE-2026-95648: C-Prot Inc. C-Prot AppDefense: Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc

Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc. C-Prot AppDefense allows Privilege Escalation. This issue affects C-Prot AppDefense: before 1.0.2729...

CVE-2026-124034: AWS amazon-braket-sdk: Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a…

Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3...

CVE-2026-119755: arendst Tasmota: Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows…

Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess by crafting a Referer header where the device hostname or IP appears as a substring...

CVE-2026-121687: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed…

FrodoBots EarthRover Mini+ firmware version 6.2.46.2.50.614.0 contains several local interfaces that are exposed without authentication. 1. HTTP REST API port 80: motor control, telemetry/GPS/IMEI, plaintext WiFi password GET /api/v1/wifi/status, join-arbitrary-WiFi, diagnostic export. 2. ADB...

CVE-2026-121686: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code…

FrodoBots EarthRover Mini+ firmware version 6.2.46.2.50.614.0 is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport AWS IoT MQTT messages and...

CVE-2026-86692: Canonical apport: In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to…

In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack. The key-name validation added for CVE-2026-771...

CVE-2026-125250: FFmpeg: FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c…

FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gifimagewriteimage in libavcodec/gif.c because shrunkbuf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remapframetopalette to write past shrunkbuf a...

CVE-2026-125188: FFmpeg: FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in libavcodec/proresenc_anatoliy.c that occurs…

FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in libavcodec/proresencanatoliy.c that occurs when the proresaw encoder processes interlaced, odd-height frames. Attackers can supply odd-height video that causes subimagewithfilltemplate to fill padding rows from memory before...

CVE-2026-125177: FFmpeg: FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c…

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data terminates early so the decoded frame...

CVE-2026-125235: FFmpeg: FFmpeg through 9.0.2 contains a heap overflow vulnerability in libavcodec/qsvenc.c that allows attackers to corrupt…

FFmpeg through 9.0.2 contains a heap overflow vulnerability in libavcodec/qsvenc.c that allows attackers to corrupt memory by reusing an undersized pooled QSVFrame buffer when input dimensions increase. Attackers can supply crafted input whose resolution grows mid-stream, transcoded with Intel...

CVE-2026-125265: FFmpeg: FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails…

FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ffnvdecstartframe fails to reset ctx-bitstream after slice errors. Attackers can supply crafted video that abandons a picture before endframe, causing cuvidDecodePicture to read freed heap memory, crashing...

CVE-2026-125266: FFmpeg: FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of…

FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in oldcodec23 of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack...

CVE-2026-125257: FFmpeg: FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in…

FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in getexponentdynamic in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nellymoser with trellis enabled, causing idx t...

CVE-2026-125260: FFmpeg: FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/exrenc.c that allows attackers to…

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/exrenc.c that allows attackers to corrupt heap memory when encodescanlinerle processes frames taller than the encoder height. Attackers can supply crafted input whose resolution grows mid-stream, transcoded to OpenEX...

CVE-2026-124610: Rejected reason: 依 VUL-2026-008441 判定為主

Rejected reason: 依 VUL-2026-008441 判定為主...

CVE-2026-123779: Apache Software Foundation Apache Axis2/Java: Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java

Direct Request 'Forced Browsing' vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone...

CVE-2026-106466: Unknown JWT Auth: The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or…

The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or resets their password or removes a connected device, allowing an attacker who obtained a refresh token before such an event to keep issuing valid access tokens and retain...

CVE-2026-124587: elizaOS eliza: A vulnerability was identified in elizaOS eliza 2.0.3-beta.7

A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the...

CVE-2026-120761: Apache Software Foundation Apache Axis2/Java: Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java

Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:impor...

CVE-2026-115237: Unknown Grand Job: The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's…

The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site...

CVE-2026-118202: Unknown Limit Login Attempts Security: The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication…

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by...

CVE-2026-118492: Eclipse Foundation Eclipse Langium: In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages…

In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by addHoverPopupHandler. If a Langium grammar allows cross-reference text to contain HTML markup such as through a STRING...

CVE-2026-113362: NEC Corporation WebSAM WinShare: Improper Access Control in the program installation folder in NEC Corporation WebSAM Winshare Ver 7.5.0 and earlier…

Improper Access Control in the program installation folder in NEC Corporation WebSAM Winshare Ver 7.5.0 and earlier excluding Ver 7.3.3, Ver 7.6.0 and Ver 7.7.0 through 7.7.1 on Windows allows a locally authenticated low-privileged attacker to execute arbitrary code with SYSTEM privileges via a...

CVE-2026-124504: erupts erupt: A vulnerability was detected in erupts erupt up to 2.3.0

A vulnerability was detected in erupts erupt up to 2.3.0. Affected by this issue is the function ReportService.queryBiData of the file ReportService.java. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now...

CVE-2026-124508: floci-io Floci: A vulnerability was determined in floci-io Floci up to 2.4.0

A vulnerability was determined in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJsonHandler.java of the component Artifact Handler. This manipulation of the argument...

CVE-2026-124554: n/a JeecgBoot: A security flaw has been discovered in JeecgBoot 3.9.5

A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. T...

CVE-2026-125114: novuhq novu: Novu provides an API for sending notifications through multiple channels

Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhook in libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts passes the user-configured child.webhookUrl directly to axios.post without calling...

CVE-2026-125115: novuhq, @novu: Novu provides an API for sending notifications through multiple channels

Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The...

CVE-2026-124621: kongxin-github Java_Library_Management_System: A vulnerability was determined in kongxin-github Java_Library_Management_System up to…

A vulnerability was determined in kongxin-github JavaLibraryManagementSystem up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function...

CVE-2026-112322: Red Hat: clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client…

cleanclient in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 aka krb5 restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service CPU consumption in kadmind by accumulating a large number of AUTHGSSAPI client...

CVE-2026-106008: Unknown FraudLabs Pro SMS Verification: The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity…

The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS...

CVE-2026-123145: Unknown WooCommerce Stripe Payment Gateway: The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the…

The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the...

CVE-2026-86829: Apache Software Foundation Apache Airflow: Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies

Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for...

CVE-2026-92683: Neo4j @neo4j/graphql: Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions…

Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operato...

CVE-2026-124501: Tidelift moto: A weakness has been identified in Tidelift moto up to 5.2.4

A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remote exploitation of the attack is...

CVE-2026-124996: Turboderp-org ExLlamaV3: A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3

A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routingselnormkernel of the file exllamav3/exllamav3ext/routing.cu of the component hash-MoE routing. This manipulation of the argument gate.tid2eid causes out-of-bounds read. Remote...

CVE-2026-84503: Red Hat: A flaw was found in ansible-core's ansible.builtin.git module

A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git ls-remote, clone, fetch with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that...

CVE-2026-121611: Red Hat: A flaw was found in GStreamer's gst-plugins-bad package

A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 HEVC bitstream parser when processing Video Parameter Sets that declare more than one HRD Hypothetical Reference Decoder parameter set. A remote attacker could exploit this by...

CVE-2026-118467: CompuGroup Medical: Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and…

Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection...

CVE-2026-123815: pyload: pyLoad is a free and open-source download manager written in Python

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar.safeextractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling...

CVE-2026-124992: n/a nushell: A vulnerability was identified in nushell up to 0.116.1

A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escapebytes of the file crates/nu-json/src/ser.rs of the component Data Conversion Handler. The manipulation leads to improper neutralization of escape, meta, or control sequences. The attack must be carried out...

CVE-2026-123805: sipsorcery-org sipsorcery: SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET

SIPSorcery is a WebRTC, SIP, and VoIP library for C and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk length. A negotiated...

CVE-2026-115252: Unknown Confection WordPress Cable: The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks…

The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the...

CVE-2026-112323: Red Hat: The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote…

The AUTHGSSAPI handler in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 aka krb5 1.5.2 and later allows remote attackers to cause a denial of service memory exhaustion in kadmind by sending repeated failed AUTHGSSAPIINIT requests. Each failed request allocates client state that is only freed after a...

CVE-2026-124505: Dianping CAT: A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1

A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The attack may be performed from remote. The exploit has been...

CVE-2026-124560: D-Link DIR-878: A vulnerability was found in D-Link DIR-878 1.20B05

A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been...

CVE-2026-124578: Pantum BP5100DW: A security vulnerability has been detected in Pantum BP5100DW 3.A.4.7

A security vulnerability has been detected in Pantum BP5100DW 3.A.4.7. The impacted element is an unknown function of the file /shtml/omDB.shtml of the component Web Interface. The manipulation leads to missing authentication. The attack may be initiated remotely. The vendor was contacted early...

CVE-2026-92606: TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer: Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research…

Time-of-check time-of-use TOCTOU race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer allows Leveraging Time-of-Check and Time-of-Use TOCTOU Race Conditions. This issue affects Pardus MyComputer: from 0.8.0 before 0.8.1...