CVE-2026-125652: Red Hat: A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and…

A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks fo...

CVE-2026-125703: Red Hat: A flaw was found in the GStreamer gst-plugins-bad MXF plugin

A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing...

CVE-2026-125704: Red Hat: A use-after-free flaw was found in GStreamer core buffer value deserialization

A use-after-free flaw was found in GStreamer core buffer value deserialization. When crafted serialized buffer data contains an invalid character, an error path frees a mapped buffer before unmapping it. An application that parses untrusted caps or structure data could crash; a network-facing...

CVE-2026-106007: Unknown FraudLabs Pro SMS Verification: The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server…

The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting the site owner's paid SMS credits and...

CVE-2026-125357: munin-monitoring munin: Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of…

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handlerequest that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../ to bypass the '/../' substring che...

CVE-2026-125370: kubero-dev kubero: Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers…

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWTSECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions...

CVE-2026-125377: pig-mesh pig: Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users…

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...

CVE-2026-60037: MB connect line, Helmholz: A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function…

A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability...

CVE-2026-60042: MB connect line, Helmholz: An unauthenticated remote attacker can perform an authentication bypass on the com_check function, potentially…

An unauthenticated remote attacker can perform an authentication bypass on the comcheck function, potentially triggering traffic on other systems and email alerts. This can result in some loss of availability due to higher system loads...

CVE-2026-120286: nerves-hub nerves_hub_web: Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an…

Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerveshubweb allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete...

CVE-2026-125375: zmister2016 MrDoc: MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort…

MrDoc through 1.1.1 contains a missing authorization vulnerability in the projectdocsort and manageprojectdocsort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sortdata. Attackers owning any project can reparent and reorder documents...

CVE-2026-125381: gcpaas DataRoom: DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role…

DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL...

CVE-2026-95646: Zohocorp DDI Central: Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection…

Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting ...

CVE-2026-115640: LimeSurvey LimeSurvey Community Edition: LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants…

LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participantid containing HTML. The import flow persists that...

CVE-2026-60040: MB connect line, Helmholz: An unauthenticated remote attacker can perform a DoS in the backends backup creation function

An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availability...

CVE-2026-120997: nerves-hub nerves_hub_web: Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in…

Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerveshubweb allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard read...

CVE-2026-125367: picosh pico: Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up…

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through...

CVE-2026-125358: rehan-remade universal-modder: Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation…

Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can...

CVE-2026-125359: fancydirty mediary-scout: Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated…

Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger probePanSou to send server-side POST...

CVE-2026-125360: Southclaws storyden: Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant…

Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGEROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator...

CVE-2026-125363: SecOps-7 MikroDash: MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including…

MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels. Attackers can set webhook or mail destinations to loopback, LAN or link-local addresses and call POST...

CVE-2026-125372: getrebuild rebuild: REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and…

REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-details and comments-list endpoints to...

CVE-2026-125384: go2ismail Asp.Net-Core-Inventory-Order-Management-System: INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers…

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no...

CVE-2026-125386: moyangzhan langchain4j-aideepin: langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in…

langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows authenticated users to access other users' message references due to missing owner checks. Attackers can supply another user's message uuid to the...

CVE-2026-60044: MB connect line, Helmholz: The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access…

The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content. This can result in a total loss of confidentiality...

CVE-2026-124908: Mozilla Firefox: Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160...

CVE-2026-124935: Mozilla Firefox: Undefined behavior in the WebRTC: Networking component

Undefined behavior in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-66332: AMI AptioV: AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Out-of-Bound Read” by local access

AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Out-of-Bound Read” by local access. Successful exploitation of this vulnerability may lead to a denial of service during firmware update processing, such as a crash or failed update if the out-of-bounds read hits...

CVE-2026-124913: Mozilla Firefox: Site isolation issue in the Networking component

Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-120326: vaadin: DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header…

DownloadEvent.setFileNameString in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename=" " with the name inserted verbatim, so a double quote in the name ends the quoted strin...

CVE-2026-121191: TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote: Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows…

Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects eta-remote: from 0.0.2 before 0.0.3...

CVE-2026-95651: Zohocorp DDI Central: Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab…

Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update vulnerability in the Linux Node Agent...

CVE-2026-97870: Apache Software Foundation Apache TomEE: When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport…

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments...

CVE-2026-97872: Apache Software Foundation Apache TomEE: When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured…

When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module...

CVE-2026-97890: Apache Software Foundation Apache TomEE: The embedded HTTP server does not invalidate the previous session identifier when an application changes the session…

The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...

CVE-2026-102803: j2commerce.com J2Store extension for Joomla: Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store…

Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon maxuses / maxcustomeruses = 1, on more than one order. By starting several checkout...

CVE-2026-112191: Eclipse Foundation Eclipse Kura: In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0,…

In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider do not check identity and permission management requests against the permissions of the requesting identity. An authenticated identity...

CVE-2026-123179: Ivanti Sentry: An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Ivanti Sentry before versions…

An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a local authenticated attacker to cause a denial of service...

CVE-2026-124036: Flock FlockOS: Missing authorization checks in the visual alert feature of FlockOS, Flock's hosted public safety platform, prior to…

Missing authorization checks in the visual alert feature of FlockOS, Flock's hosted public safety platform, prior to 2026-09-28, allowed an authenticated user with permission to manage saved searches in their own organization to read, modify or delete another organization's saved-search alerts an...

CVE-2026-125748: Parabol: Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation…

Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. Attackers can pair their own meetingId with a reactableId of another tenant's reflection,...

CVE-2026-125271: AWS aws-api-mcp-server: Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server…

Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or require elicitation for, via calls t...

CVE-2026-111249: Apache Software Foundation Apache TomEE: The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket…

The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and...

CVE-2026-111248: Apache Software Foundation Apache TomEE: The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored…

The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users fi...

CVE-2026-111257: Apache Software Foundation Apache TomEE: With the default configuration and no users defined in the default user database, TomEE silently adds an administrative…

With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any...

CVE-2026-63651: PsychQuant livedocs: LiveDocs is a primary-source-first documentation for AI agents

LiveDocs is a primary-source-first documentation for AI agents. Prior to version 0.7.0, fetchdocs and introspect kinds openapi/graphql, and resolvesource's docsurl pass a client-supplied URL straight to URLSession with no scheme or host allowlist, and redirects are followed unconditionally. A...

CVE-2026-123717: Eclipse CSI otterdog: OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through…

OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their...

CVE-2026-124863: Mozilla Firefox: Use-after-free in the DOM: HTML Parser component

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7...

CVE-2026-124861: Mozilla Firefox: Sandbox escape due to use-after-free in the Audio/Video: cubeb component

Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7...

CVE-2026-124864: Mozilla Firefox: Sandbox escape due to use-after-free in the DOM: Service Workers component

Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7...

CVE-2026-124868: Mozilla Firefox: Incorrect boundary conditions in the DOM: Core & HTML component

Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...