CVE-2026-86531: Apache Software Foundation Apache TomEE: The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does…

The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deploymen...

CVE-2026-111251: Apache Software Foundation Apache TomEE: The admin service of the standalone OpenEJB server accepts stop requests without any authentication

The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the...

CVE-2026-120015: SAP_SE SAP Host Agent: SAP Host Agent does not sufficiently validate certain inputs

SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successful exploitation could lead to persiste...

CVE-2026-13409: Axis Communications AB AXIS OS: The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality

The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account...

CVE-2026-107405: Ivanti Endpoint Manager Mobile: An exposed dangerous function in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a local…

An exposed dangerous function in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a local authenticated attacker to trigger a denial of service...

CVE-2026-121885: Red Hat: A flaw was found in Podman

A flaw was found in Podman. An attacker can trigger a Denial of Service DoS by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container...

CVE-2026-105813: Ivanti User Workspace Manager: Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to…

Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token...

CVE-2026-124915: Mozilla Firefox: Incorrect boundary conditions in the Graphics: WebGPU component

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-124882: Mozilla Firefox: Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7...

CVE-2026-124901: Mozilla Firefox: Other issue in the Networking: JAR component

Other issue in the Networking: JAR component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7...

CVE-2026-124866: Mozilla Firefox: Use-after-free in the Layout component

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-124873: Mozilla Firefox: Invalid pointer in the DOM: Editor component

Invalid pointer in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-121267: TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote: Incorrect default permissions vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote…

Incorrect default permissions vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects eta-remote: from 0.0.2 before 0.0.3...

CVE-2026-63282: Axis Communications AB AXIS OS: Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which…

Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation...

CVE-2026-124867: Mozilla Firefox: Use-after-free in the DOM: Editor component

Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160...

CVE-2026-111239: Apache Software Foundation Apache TomEE: The optional SSH administration service grants full access to the administration shell to every user that authenticates…

The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged...

CVE-2026-63011: Intermesh groupoffice: Group-Office is an enterprise customer relationship management and groupware tool

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string tpl parameter that is passed without restriction to...

CVE-2026-92684: Neo4j @neo4j/graphql: Missing Authentication for Critical Function in aggregation queries in Neo4j @neo4j/graphql 5.0.0 before 5.12.17 and…

Missing Authentication for Critical Function in aggregation queries in Neo4j @neo4j/graphql 5.0.0 before 5.12.17 and 7.0.0 before 7.6.8 allows remote attackers to read protected data via GraphQL aggregation queries. Field-level @authentication is not enforced on string aggregates, which can retur...

CVE-2026-124604: GeoVision Inc. GV-Cloud: The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application…

The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to...

CVE-2026-125405: ettercap: Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c…

Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in ParseNTLMAuth in src/dissectors/echttp.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the proce...

CVE-2026-111258: Apache Software Foundation Apache TomEE: The optional request routing feature forwards requests to their configured destination without applying the security…

The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories. If a route copies client-controlled parts of the request path into its destination, ...

CVE-2026-124862: Mozilla Firefox: Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-86532: Apache Software Foundation Apache TomEE: The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner

The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or...

CVE-2026-125745: madalinungureanu Custom Post Types and Custom Fields creator – WCK: Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that…

Custom Post Types and Custom Fields creator WCK before 2.4.1 contains a missing authorization vulnerability that allows authenticated attackers with access to any WCK meta box to read custom-field values on posts they cannot edit by exploiting the wckshowupdateform AJAX handler, which lacks the...

WordPress Plugin: everest-forms: CVE-2026-120513: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...

CVE-2026-125121: tmatens compose-lint: compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before...

CVE-2026-125394: FreeRDP: FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and…

FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in updategdipatblt, updategdipolygoncb and updategdimem3blt that retain stale brush cache pointers. A malicious RDP server can resend CACHEBRUSH to the same slot then send PATBLT, causing clients to read freed heap memory,...

CVE-2026-41214: n/a Intel(R) Neural Compressor software: Improper input validation for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User…

Improper input validation for some IntelR Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may...

CVE-2026-110516: Unknown All in One Addons For WPBakery Page Builder (formerly Visual Composer): The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not…

The All in One Addons For WPBakery Page Builder formerly Visual Composer WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute...

CVE-2026-14542: Axis Communications AB AXIS OS: The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation

The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation. This flaw can only be exploited after authenticating with an admin-privileged service account...

CVE-2026-120286: nerves-hub nerves_hub_web: Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an…

Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerveshubweb allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete...

CVE-2026-109808: SAP_SE SAP Solution Tools Plug-In (ST-PI): Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an…

Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must ha...

CVE-2026-124871: Mozilla Firefox: Use-after-free in the DOM: HTML Parser component

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160...

CVE-2026-115646: Hitachi: Partial String Comparison Vulnerability in HiRDB

Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50-/F through 09-66/V; HiRDB Server Version 932: from 09-50-06...

CVE-2026-112125: Hitachi HA Monitor: Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor

Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor. This issue affects HA Monitor: from 01-00 before 01-83-01...

CVE-2026-93427: armember: The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for…

The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field Profile Cover in all versions up to, and including, 7.8.1 due to insufficient input sanitization...

CVE-2026-91764: Hitachi Hitachi Dynamic Link Manager for Linux: Improper Link Resolution Before File Access Vulnerability in Hitachi Dynamic Link Manager for Linux

Improper Link Resolution Before File Access Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 6.1.1.-00 before 9.0.5-00...

CVE-2026-125403: ettercap: Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in…

Ettercap through 0.8.4.1 contains an out-of-bounds read and sizet underflow vulnerability in sslwremovests in src/ecsslwrap.c, caused by a stale length and an unchecked memmem result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap'...

CVE-2026-91758: Hitachi Hitachi Dynamic Link Manager for Linux: Out-of-bounds Read and Write Vulnerability in Hitachi Dynamic Link Manager for Linux

Out-of-bounds Read and Write Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00...

CVE-2026-91760: Hitachi Hitachi Dynamic Link Manager for Linux: Heap-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for Linux

Heap-based Buffer Overflow Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00...

CVE-2026-89125: SAP_SE SAP Web Dispatcher and Internet Communication Manager: Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker…

Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative privileges could obtain sensitive information from stored data. This may allow correlation of credentials across users and deployments, potentially leading to...

CVE-2026-125397: nocobase: NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee()…

NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run...

CVE-2026-89119: SAP_SE SAP Web Dispatcher and Internet Communication Manager: SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient…

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP Internet Communication Manager do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on...

CVE-2026-124941: Mozilla Firefox: Information disclosure in the Security: RLBox component

Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-109796: SAP_SE SAP NetWeaver and ABAP Platform: SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal…

SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on...

CVE-2026-114359: Eclipse Foundation Eclipse Kura: Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives

Eclipse Kura downloads deployment packages DPs from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTPS server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large or endless response. Kura writes the response ...

CVE-2026-124902: Mozilla Firefox: Same-origin policy bypass due to race condition in the Audio/Video component

Same-origin policy bypass due to race condition in the Audio/Video component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7...

CVE-2026-14918: Axis Communications AB: The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the…

The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains...

CVE-2026-125372: getrebuild rebuild: REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and…

REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-details and comments-list endpoints to...

CVE-2026-125703: Red Hat: A flaw was found in the GStreamer gst-plugins-bad MXF plugin

A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing...