CVE-2026-124500: Fengoffice Feng Office: A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2

A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function uploaddocumentimage of the file application/controllers/FilesController.class.php of the component File Handler. The manipulation of the argument url results in server-side request...

CVE-2026-118790: CompuGroup Medical Wingesfar: Multiple hardcoded credentials are embedded within product components and administrative functionalities

Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments...

CVE-2026-124555: n/a JeecgBoot: A weakness has been identified in JeecgBoot 3.9.5

A weakness has been identified in JeecgBoot 3.9.5. This vulnerability affects the function JimuFormApiService.getTableDictList of the file /jeecg-boot/jmreport/form/getTableDictList of the component Table Dictionary API. Executing a manipulation of the argument searchSql can lead to sql injection...

CVE-2026-124589: lxtGH OMG-Seg: A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0

A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function loadstatedictintomodel of the file omgllava/xtuner/utils/handlemoeloadandsave.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weightm...

CVE-2026-120367: Apache Software Foundation Apache Axis2/Java: Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON reques...

CVE-2026-124556: kekingcn kkFileView: A security vulnerability has been detected in kekingcn kkFileView up to 5.0.3

A security vulnerability has been detected in kekingcn kkFileView up to 5.0.3. This issue affects the function BaseUrlFilter.getBaseUrl of the file server/src/main/java/cn/keking/web/filter/BaseUrlFilter.java. The manipulation of the argument X-Base-Url leads to open redirect. The attack is...

CVE-2026-125105: wagtail: Wagtail is an open source content management system built on Django

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, Wagtail applies ETag conditional request processing to the document serve endpoint before document permission and filename checks complete. An unauthenticated attacker who knows a docume...

CVE-2026-125110: rack: Rack is a modular Ruby web server interface

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...

CVE-2026-125096: FFmpeg: FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows…

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attackers to leak stack contents by triggering failed RLE unpacking. Attackers can supply a crafted Tiertex SEQ file so seqdecodeop1 copies an uninitialized 64-byte stack block...

CVE-2026-125097: FFmpeg: FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c…

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in rawdecode in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets...

CVE-2026-118450: CompuGroup Medical Venere: Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged…

Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files...

CVE-2026-125253: FFmpeg: FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c that wraps the…

FFmpeg through 9.0.2 contains an integer overflow in cbsvp9splitfragment in libavcodec/cbsvp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame sizes, causing out-of-bounds reads that crash...

CVE-2026-123804: supertokens supertokens-core: SuperTokens Core is an open source authentication server

SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated...

CVE-2026-124582: n/a WebTorrent: A vulnerability was identified in WebTorrent up to 2.8.5/3.0.21

A vulnerability was identified in WebTorrent up to 2.8.5/3.0.21. Affected by this vulnerability is the function getFileModtimes of the file torrent.js of the component File Path Handler. Such manipulation of the argument file.path leads to path traversal. The attack may be performed from remote...

CVE-2026-125099: FFmpeg: FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in…

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into...

CVE-2026-90591: zephyrproject zephyr: The NXP ENET-QOS Ethernet driver's receive work handler eth_nxp_enet_qos_rx() in drivers/ethernet/eth_nxp_enet_qos…

The NXP ENET-QOS Ethernet driver's receive work handler ethnxpenetqosrx in drivers/ethernet/ethnxpenetqos hands each processed descriptor back to the DMA by writing desc-read.control = rxdescrefreshflags, which sets OWNFLAG and BUF1ADDRVALIDFLAG. RDES0 of a receive descriptor is the DMA buffer...

CVE-2026-90589: zephyrproject zephyr: When CONFIG_THREAD_STACK_MEM_MAPPED is enabled, each thread stack is mapped into the kernel virtual address space with…

When CONFIGTHREADSTACKMEMMAPPED is enabled, each thread stack is mapped into the kernel virtual address space with a guard page on either side, and the mapping is released during abort cleanup. kthreadabortcleanup in kernel/thread.c has two paths: a deferred one for self-abort, which stashes the...

CVE-2026-124000: nasa-jpl ION-DTN: NASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allocation vulnerability in the Asynchronous Message…

NASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allocation vulnerability in the Asynchronous Message Service daemon amsd that allows a rogue or misconfigured peer to trigger an out-of-bounds write by sending crafted Meta-AMS MAMS configuration management messages that are...

CVE-2026-125103: FFmpeg: FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff_mlz_decompression() in libavcodec/mlz.c,…

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

CVE-2026-125095: FFmpeg: FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c,…

FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decodeframe never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so drawncolor writes uninitialized stack bytes...

CVE-2026-125041: Red Hat: A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer

A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause an out-of-bounds heap read while the...

CVE-2026-125248: FFmpeg: FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1enc_vulkan.c that undersizes the…

FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in libavcodec/ffv1encvulkan.c that undersizes the float remap GPU buffer for large frames. Attackers can supply large GBRPF32 or GBRAPF32 images or videos that, when transcoded to FFV1 with the Vulkan encoder, trigger out-of-boun...

CVE-2026-63496: electrovir augment-vir: augment-vir is a collection of helper functions

augment-vir is a collection of helper functions. Prior to version 31.73.5, the grep function exported by @augment-vir/node inserts caller-controlled search patterns directly into a double-quoted shell command string without sanitization grep.ts:310. When the constructed command is passed to spawn...

CVE-2026-90588: zephyrproject zephyr: The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser…

The HTTP client's debug helper printheaderfield in subsys/net/lib/http/httpclient.c formatted an httpparser data-callback slice with a %s conversion: snprintkoutput, len + 1, "%s", str. The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not...

CVE-2026-125172: FFmpeg: FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c…

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevdreceiveframe in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to read...

CVE-2026-84410: Canonical apport: In apport before 2.37.0, an improper privilege management vulnerability allows an unprivileged local attacker to gain…

In apport before 2.37.0, an improper privilege management vulnerability allows an unprivileged local attacker to gain root privileges on systems where automatic crash reporting is enabled. The automatic crash report processing pipeline runs as root and executes ldd on the attacker-controlled...

CVE-2026-125119: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype.castConditions and query casting check other optio...

CVE-2026-123803: supertokens supertokens-core: SuperTokens Core is an open source authentication server

SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsByIdTransaction and getUserInfoByCredentialIdTransaction perform application-scoped WebAuthn lookups without constraining them to the...

CVE-2026-110468: Fundacja Widzialni WidzialniCMS: WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/savephoto.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the...

CVE-2026-125240: FFmpeg: FFmpeg through 9.0.2 contains a resource leak vulnerability in svt_jpegxs_dec_decode() in libsvtjpegxsdec.c that leaks…

FFmpeg through 9.0.2 contains a resource leak vulnerability in svtjpegxsdecdecode in libsvtjpegxsdec.c that leaks decoder instances when ffsetdimensions rejects frame dimensions. Attackers can supply a crafted JPEG XS stream, for example in MPEG-TS, with oversized headers to repeatedly leak decod...

CVE-2026-107474: Apache Software Foundation Apache Airflow: The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed…

The Apache Airflow connections API did not mask the apprise provider's config connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only. Users are...

CVE-2026-124001: nasa-jpl ION-DTN: NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR)…

NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission DGR convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers...

CVE-2026-122665: Kitae Park Mang Board WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kitae Park Mang Board WP mangboard allows Stored XSS.This issue affects Mang Board WP: from n/a through 2.4.7...

CVE-2026-121570: WP Chill RSVP and Event Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill RSVP and Event Management rsvp allows Stored XSS.This issue affects RSVP and Event Management: from n/a through 2.7.17...

CVE-2026-125252: FFmpeg: FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust…

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapidecode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to parse on every frame, continuously leaking ...

CVE-2026-122664: VideoWhisper.com Broadcast Live Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Reflected XSS.This issue affects Broadcast Live Video: from n/a through 7.3.14...

CVE-2026-124994: Turboderp-org ExLlamaV3: A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3

A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngramdequant of the file exllamav3/exllamav3ext/ngram.cu of the component NGramEmbedding. The manipulation of the argument headbias results in out-of-bounds read. The attack may be...

CVE-2026-124586: Tencent RapidJSON: A vulnerability was determined in Tencent RapidJSON 1.1.0

A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-123463: WP Wham Checkout Files Upload for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through 2.4.0...

CVE-2026-125232: FFmpeg: FFmpeg through 9.0.2 contains a division by zero vulnerability in estimate_motion_b() in libavcodec/motion_est.c,…

FFmpeg through 9.0.2 contains a division by zero vulnerability in estimatemotionb in libavcodec/motionest.c, caused by frame timestamp distances truncated to 16 bits. Attackers can supply input with timestamp gaps that are multiples of 65536, crashing MPEG-4 Part 2 or MPEG-1/2 B-frame encoding wi...

CVE-2026-125181: FFmpeg: FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in flic_decode_frame_15_16BPP() in…

FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in flicdecodeframe1516BPP in libavcodec/flicvideo.c that allows attackers to corrupt heap memory on big-endian builds. Attackers can supply a crafted 15/16 bpp FLIC/FLX file with an FLIBRUN chunk whose non-terminating byte-swap lo...

CVE-2026-121763: WPMU DEV Hummingbird: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPMU DEV Hummingbird hummingbird-performance allows Stored XSS.This issue affects Hummingbird: from n/a through 3.21.2...

CVE-2026-123482: Crocoblock JetFormBuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8...

CVE-2026-113964: Apple: A logic issue was addressed with improved state management

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An...

CVE-2026-120855: TemplateInvaders TI WooCommerce Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TemplateInvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.14.0...

CVE-2026-123476: fifu.app Featured Image from URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifu.app Featured…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Stored XSS.This issue affects Featured Image from URL: from n/a through 6.1.4...

CVE-2026-124916: PrestaShop: PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode…

PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debugcookiename or debugcookievalue that is written without sufficient escaping into a PH...

CVE-2026-122666: Kitae Park Mang Board WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kitae Park Mang Board WP mangboard allows Reflected XSS.This issue affects Mang Board WP: from n/a through 2.4.7...

CVE-2026-125225: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aac_adtstoasc_filter() that allows attackers…

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aacadtstoascfilter that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so initgetbits fails unchecked and...

CVE-2026-115341: Progress Software WS_FTP Server: Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions…

Improper access restrictions in the Thin Client Web Transfer component of Progress Software WSFTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope...