CVE-2026-125242: FFmpeg: FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vdpau.c that allows attackers to exhaust heap…

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vdpau.c that allows attackers to exhaust heap memory by aborting pictures before endframe. Attackers can supply crafted H.264 streams with malformed NAL units that repeatedly abandon pictures, leaking the bitstreambuffers tab...

CVE-2026-125258: FFmpeg: FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi_configure_ext() in libavcodec/dovi_rpuenc.c that…

FFmpeg through 9.0.2 contains a division by zero vulnerability in doviconfigureext in libavcodec/dovirpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a nonzero frame rate numerator and zero...

CVE-2026-56712: replicate cog: Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the…

Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with attacker-controlled URLs that are not validated against the resolved destination host or IP befor...

CVE-2026-103906: am_automatic_machines am_club: Use of hard-coded MQTT credentials in the AM CLUB mobile application allows an authenticated attacker to connect to the…

Use of hard-coded MQTT credentials in the AM CLUB mobile application allows an authenticated attacker to connect to the MQTT broker and access data or perform actions across tenant boundaries...

CVE-2026-119505: Welcart Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.6...

CVE-2026-121722: WP E-Signature Formidable Forms Signature Online Contract Automation: Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation…

Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation forms-signature-formidable-online-contract-automation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms Signature Online Contract...

CVE-2026-125224: FFmpeg: FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbis_parser.c that re-parses invalid…

FFmpeg through 9.0.2 contains a denial of service vulnerability in libavcodec/vorbisparser.c that re-parses invalid extradata for every packet when validextradata remains false. Attackers can supply crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets to exhaust CP...

CVE-2026-125070: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi_decode_frame() in libavcodec/eatqi.c,…

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqidecodeframe in libavcodec/eatqi.c, which ignores initgetbits failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial o...

CVE-2026-125104: FFmpeg: FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape_decode_frame() in libavcodec/apedec.c that fails…

FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in apedecodeframe in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale...

CVE-2026-122056: Red Hat: A flaw was found in OpenSCAP

A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format XCCDF document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application...

CVE-2026-112170: GALENO SISTEMI MAGISTRA: The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.

The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates...

CVE-2025-10248: OpenText Filr: XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a…

XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS attack...

CVE-2026-104620: PackageKit: A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local…

A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges...

CVE-2026-104989: Chaos Software V-Ray Swarm: Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows…

Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries...

CVE-2026-124581: itsourcecode Airline Reservation System: A vulnerability was determined in itsourcecode Airline Reservation System 1.0

A vulnerability was determined in itsourcecode Airline Reservation System 1.0. Affected is an unknown function of the file /admin/manageflight.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed...

CVE-2026-121874: Unknown Post Duplicator: The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site…

The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves...

CVE-2026-123808: nuxt ui: Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind CSS

Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind CSS. Prior to 4.8.1, the server-rendered form element produced by UForm in src/runtime/components/Form.vue omits the method and action attributes and relies solely on the hydrated @submit.prevent handler to stop native...

CVE-2026-125102: FFmpeg: FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in tak_decode_frame() in…

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in takdecodeframe in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting channels from the list, causing undecoded...

CVE-2026-113364: NEC Corporation WebSAM WinShare: Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and…

Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value ...

CVE-2026-119474: HAVELSAN Inc. Liman Render Engine: Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc

Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation. This issue affects Liman Render Engine: before 1.2-81...

CVE-2026-125244: FFmpeg: FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds write vulnerability in the VVC decoder's…

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds write vulnerability in the VVC decoder's shentrypoints function in libavcodec/vvc/ps.c. Attackers can supply a crafted VVC H.266 bitstream whose SPS/PPS tile and WPP layout produces excess entry points, overflowing...

CVE-2026-124568: fushengqian fuintCatering: A vulnerability has been found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133

A vulnerability has been found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. Impacted is the function RefundServiceImpl.agreeRefund of the component Refund Agreement. The manipulation leads to improper access controls. It is possible to initiate the attack remotely...

CVE-2026-125111: rack: Rack is a modular Ruby web server interface

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with...

CVE-2026-124590: zhangbw409 library_manager_system: A security vulnerability has been detected in zhangbw409 library_manager_system…

A security vulnerability has been detected in zhangbw409 librarymanagersystem f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/UserController.java. The manipulation of t...

CVE-2026-125191: FFmpeg: FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2_buffers.c that allows attackers to deadlock the…

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ffv4l2m2mcodecreinit wait forever an...

CVE-2026-112165: laservideo lasergest: The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"),…

The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode"nocheck", allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications...

CVE-2026-123484: Crocoblock JetFormBuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8...

CVE-2026-125186: FFmpeg: FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that…

FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 packet with many slices of alternating picture order counts,...

CVE-2026-125189: FFmpeg: FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevc_metadata bitstream filter caused by a…

FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevcmetadata bitstream filter caused by a process block position mismatch in lcevcmetadatahandlevui. Attackers can supply crafted LCEVC access units with two IDR or non-IDR NAL units to trigger an avassert0 failure in...

CVE-2026-124249: Python Software Foundation CPython: http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it,…

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie...

CVE-2026-111453: Apache Software Foundation Apache Airflow: Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id`…

Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the dagid query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress...

CVE-2026-111395: Apache Software Foundation Apache Airflow: Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`

Apache Airflow did not reject reserved serialization keys inside a Dag run's conf. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a conf that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects...

CVE-2026-123372: tmatens compose-lint: compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. ...

CVE-2026-95779: Hewlett Packard Enterprise (HPE) HPE Morpheus Software: An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager…

An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager software...

CVE-2026-84503: Red Hat: A flaw was found in ansible-core's ansible.builtin.git module

A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git ls-remote, clone, fetch with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that...

CVE-2026-124996: Turboderp-org ExLlamaV3: A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3

A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routingselnormkernel of the file exllamav3/exllamav3ext/routing.cu of the component hash-MoE routing. This manipulation of the argument gate.tid2eid causes out-of-bounds read. Remote...

CVE-2026-125115: novuhq, @novu: Novu provides an API for sending notifications through multiple channels

Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The...

CVE-2026-125265: FFmpeg: FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails…

FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ffnvdecstartframe fails to reset ctx-bitstream after slice errors. Attackers can supply crafted video that abandons a picture before endframe, causing cuvidDecodePicture to read freed heap memory, crashing...

CVE-2026-95648: C-Prot Inc. C-Prot AppDefense: Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc

Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc. C-Prot AppDefense allows Privilege Escalation. This issue affects C-Prot AppDefense: before 1.0.2729...

CVE-2026-86692: Canonical apport: In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to…

In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack. The key-name validation added for CVE-2026-771...

CVE-2026-119755: arendst Tasmota: Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows…

Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess by crafting a Referer header where the device hostname or IP appears as a substring...

CVE-2026-123145: Unknown WooCommerce Stripe Payment Gateway: The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the…

The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the...

CVE-2026-8640: IBM: IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute…

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the...

CVE-2026-124460: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that…

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to...

CVE-2026-82830: IBM Guardium Data Protection: IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to…

IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters...

CVE-2026-114189: WPVibes AnyWhere Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere…

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0...

CVE-2026-124498: Convene Azeus Convene Board Management Portal: A vulnerability was determined in Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72

A vulnerability was determined in Convene Azeus Convene Board Management Portal 7.0.2.73 p72. The impacted element is an unknown function of the file /jsp/ge/dummylauncher.jsp. Executing a manipulation of the argument REDIRECTURL can lead to cross site scripting. The attack can be launched...

CVE-2026-104337: Unknown Razorpay for WooCommerce: The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a…

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs...

CVE-2026-85344: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX…

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to ed...

CVE-2026-75879: IBM Content Navigator: IBM Content Navigator 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0 is vulnerable to LDAP injection

IBM Content Navigator 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0 is vulnerable to LDAP injection. A remote authenticated attacker could send a specially crafted request that could allow enumeration of LDAP directory information...