CVE-2026-111691: Authentication Bypass by Spoofing

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

CVE-2026-111386: Observable Response Discrepancy

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denie...

CVE-2026-18799: Missing Authorization

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to force-add existing Mattermost users to their team a...

CVE-2026-111447: External Control of Assumed-Immutable Web Parameter

Wheels 1.1 through 4.1.2 resolves nestedProperties records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when...

CVE-2026-109400: Improper Privilege Management

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via addmanagementpage using a role name returned by InstaWPSetting::getallowedrole as...

CVE-2026-102551: Improper Verification of Source of a Communication Channel

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router...

CVE-2026-109513: Improper Neutralization of Input During Web Page Generation

The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficien...

CVE-2026-18795: Missing Authorization

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...

CVE-2026-111651: Authorization Bypass Through User-Controlled Key

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to...

CVE-2026-111608: Authorization Bypass Through User-Controlled Key

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENTDIVISIONRECEIVERDELETE who own a receiver group whose i...

CVE-2026-107674: Improper Locking

IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager DCM for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service from starting or cause it to fallback to non-secure connections...

CVE-2026-15219: Authorization Bypass Through User-Controlled Key

Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

Red Hat: CVE-2026-111555: luksmeta: Missing slot-range validation permits out-of-gap device I/O

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with...

Red Hat: CVE-2026-111379: freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistentcachereadentryv3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persistcachegetdata,...

Red Hat: CVE-2026-111378: freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parsenlamodepdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffe...

CVE-2026-111668: Missing Authorization

AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read...

Red Hat: CVE-2026-111373: freerdp: FreeRDP: Denial of Service via zero-length WebSocket ping

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an...

Red Hat: CVE-2026-111581: libblockdev: libblockdev: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus method

A flaw was found in libblockdev. The bdfsntfssetlabel and bdfsvfatsetlabel functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label...

CVE-2026-105974: Exposure of Sensitive Information to an Unauthorized Actor

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user Subscriber and above to read other users' submitted contact information, including names, email...

CVE-2026-110366: Missing Authorization

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.4...

Red Hat: CVE-2026-85985: mariadb: MariaDB: Unauthorized file access via CONNECT engine functions

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

Red Hat: CVE-2026-111376: freerdp: freerdp: Denial of Service via short clipboard response

FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStreamNew that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTSSIZE request with a cbRequested of fewer...

CVE-2026-111399: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1...

CVE-2026-104715: Improper Neutralization of Argument Delimiters in a Command

A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System CIFS share using a user-controlled credentials file, input values are not properly sanitized before being assembled into moun...

CVE-2026-110012: Exposure of Sensitive Information to an Unauthorized Actor

The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data...

CVE-2026-96628: Incorrect Authorization

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

CVE-2026-104726: Improper Neutralization of Input During Web Page Generation

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-110703: Improper Neutralization of Input During Web Page Generation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-102693: Buffer Copy without Checking Size of Input

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's atwinc15x0stasetcurrentssid function uses strcpy to copy an SSID without checking the destination size. When...

CVE-2026-111445: Incorrect Resource Transfer Between Spheres

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

CVE-2026-111723: Missing Authorization

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap...

CVE-2026-109193: Improper Neutralization of Input During Web Page Generation

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. hpcustomlink' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-18560: Observable Discrepancy

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754...

CVE-2026-59962: Improper Neutralization of Special Elements in Data Query Logic

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sortorder and orderfield strings into Django ORM orderby calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or...

CVE-2026-111673: Missing Authentication for Critical Function

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/ is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any...

CVE-2026-109414: Improper Neutralization of Special Elements used in an SQL Command

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-68498: Uncontrolled Resource Consumption

StreamReadConstraints.maxNameLength default 50,000 characters is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength default 100,000,000 characters that bounds ordinary string values. For parsers bui...

CVE-2026-110029: Missing Authorization

The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives,...

CVE-2026-19541: Insertion of Sensitive Information Into Sent Data

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret...

CVE-2026-108372: Origin Validation Error

Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, loopx serve-status in loopx/statusserver.py uses StatusRequestHandler.sendjson and doOPTIONS to send Access-Control-Allow-Origin: for unauthenticated...

CVE-2026-111605: Authorization Bypass Through User-Controlled Key

Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload,...

CVE-2026-111178: Improper Neutralization of Special Elements used in an SQL Command

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'dataorderby' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-107346: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-111802: Improper Link Resolution Before File Access

A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage...

CVE-2026-111448: Improper Handling of Case Sensitivity

Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct...

CVE-2026-14452: URL Redirection to Untrusted Site

Improper validation of the reseturl parameter of the Setup in-page search in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by...

CVE-2026-49410: Cross-Site Request Forgery (CSRF)

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegramauthhandler consumes an attacker-supplied one-time Telegram login...

CVE-2026-111695: Authorization Bypass Through User-Controlled Key

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

CVE-2026-95183: Undefined Security Weakness

An issue in the context-compaction feature of DeepSeek Harness dsh commit c291e796 allows attackers to execute a prompt injection attack via crafted external content...

CVE-2026-89088: Out-of-bounds Write

A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversize...