CVE-2026-111855: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Dependin...

CVE-2026-111898: Improper Authentication

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...

CVE-2026-92715: Authorization Bypass Through User-Controlled Key

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wi...

CVE-2026-111823: Detection of Error Condition Without Action

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider...

CVE-2026-111854: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access...

CVE-2026-111881: Integer Underflow (Wrap or Wraparound)

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-111907: Cross-Site Request Forgery (CSRF)

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...

CVE-2026-104736: Deserialization of Untrusted Data

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitizetextfield, which does not stri...

CVE-2026-108123: Missing Authorization

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers t...

CVE-2026-109368: Missing Authorization

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private...

CVE-2026-109701: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45...

CVE-2026-109983: Improper Neutralization of Input During Web Page Generation

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-111920: Improper Privilege Management

Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser pkg/models/projectaccess.go, which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write...

Red Hat: CVE-2026-46471: gstreamer1-plugins-good: gstreamer1-plugins-good: information disclosure via out-of-bounds read during MP4 parsing

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents...

FreeBSD: VID-0cb42b4a-9f19-11f1-a655-3497f65b111b (CVE-2026-68498): jackson-core -- StreamReadConstraints can be bypassed

StreamReadConstraints.maxNameLength default 50,000 characters is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength default 100,000,000 characters that bounds ordinary string values. For parsers bui...

FreeBSD: VID-05aadfcc-55f5-11f1-915c-8974b59277b5 (CVE-2026-46472): gstreamer1 -- multiple vulnerabilities

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure...

CVE-2026-111620: Authorization Bypass Through User-Controlled Key

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

Ubuntu: (CVE-2026-111380): freerdp3 vulnerability

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends audinmac.m, audinios.m, which compute the audio queue buffer size as FramesPerPacket 2 nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^...

CVE-2026-111675: Improper Restriction of Excessive Authentication Attempts

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...

CVE-2026-97470: Improper Neutralization of Input During Web Page Generation

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfilteredhtml Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escapin...

Red Hat: CVE-2026-110757: perl-text-csv_xs: Text::CSV_XS: CSV record splitting via unquoted numeric fields

Text::CSVXS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric...

CVE-2026-57487: Allocation of Resources Without Limits or Throttling

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser-contentlength at zero while parserparsechunkyentity and parserparsechunkybody accumulate decode...

CVE-2026-63619: Missing Authorization

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This...

CVE-2026-64610: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

CVE-2026-64959: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...

CVE-2026-104715: Improper Neutralization of Argument Delimiters in a Command

A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System CIFS share using a user-controlled credentials file, input values are not properly sanitized before being assembled into moun...

CVE-2026-110758: Buffer Under-read

Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace. Under allowwhitespace, striptrailwhitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of onl...

CVE-2026-111555: Improper Validation of Specified Index, Position, or Offset in Input

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with...

CVE-2026-89098: Reachable Assertion

A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an...

CVE-2026-97380: Unverified Password Change

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor...

Red Hat: CVE-2026-110756: perl-text-csv_xs: Text::CSV_XS: Data corruption via invalid UTF-8 byte sequences

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

Red Hat: CVE-2026-111555: luksmeta: Missing slot-range validation permits out-of-gap device I/O

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with...

Red Hat: CVE-2026-89098: nfs-utils: nfs-utils: Denial of Service via assertion failure in fsidd

A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an...

Red Hat: CVE-2026-111374: freerdp: freerdp: Denial of Service via unadvertised camera stream requests

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigur...

CVE-2026-111373: NULL Pointer Dereference

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an...

Red Hat: CVE-2026-111373: freerdp: FreeRDP: Denial of Service via zero-length WebSocket ping

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an...

CVE-2026-94169: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1...

CVE-2026-26846: Undefined Security Weakness

Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.51020251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component...

CVE-2026-111380: Integer Overflow or Wraparound

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends audinmac.m, audinios.m, which compute the audio queue buffer size as FramesPerPacket 2 nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^...

Red Hat: CVE-2026-111381: freerdp: freerdp: Arbitrary code execution via crafted persistent cache file

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistentcachereadentryv2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes...

CVE-2026-111381: Heap-based Buffer Overflow

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistentcachereadentryv2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes...

Red Hat: CVE-2026-111382: freerdp: freerdp: Arbitrary code execution via crafted display frames

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

CVE-2026-111379: Heap-based Buffer Overflow

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistentcachereadentryv3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persistcachegetdata,...

CVE-2026-111382: Out-of-bounds Write

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

Red Hat: CVE-2026-111379: freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistentcachereadentryv3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persistcachegetdata,...

CVE-2026-111378: Uncontrolled Resource Consumption

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parsenlamodepdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffe...

Red Hat: CVE-2026-111378: freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parsenlamodepdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffe...

CVE-2026-111377: Uncontrolled Resource Consumption

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory...

Red Hat: CVE-2026-111377: freerdp: FreeRDP: Denial of Service via unbounded static channel reassembly

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory...

CVE-2026-111376: Out-of-bounds Read

FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStreamNew that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTSSIZE request with a cbRequested of fewer...