CVE-2026-86531: Apache Software Foundation Apache TomEE: The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does…

The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deploymen...

CVE-2026-111251: Apache Software Foundation Apache TomEE: The admin service of the standalone OpenEJB server accepts stop requests without any authentication

The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the...

CVE-2026-120015: SAP_SE SAP Host Agent: SAP Host Agent does not sufficiently validate certain inputs

SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successful exploitation could lead to persiste...

CVE-2026-13409: Axis Communications AB AXIS OS: The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality

The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account...

CVE-2026-107405: Ivanti Endpoint Manager Mobile: An exposed dangerous function in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a local…

An exposed dangerous function in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a local authenticated attacker to trigger a denial of service...

CVE-2026-121885: Red Hat: A flaw was found in Podman

A flaw was found in Podman. An attacker can trigger a Denial of Service DoS by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container...

CVE-2026-97402: Eclipse Foundation Eclipse Kura: In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the…

In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of an over-the-air BLE advertising payload. Any unauthenticated attacker within BLE radio range can broadcast a two-byte advertising payload that drives the Kura...

CVE-2026-105813: Ivanti User Workspace Manager: Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to…

Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token...

CVE-2026-124915: Mozilla Firefox: Incorrect boundary conditions in the Graphics: WebGPU component

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-124882: Mozilla Firefox: Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7...

CVE-2026-124901: Mozilla Firefox: Other issue in the Networking: JAR component

Other issue in the Networking: JAR component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7...

CVE-2026-124866: Mozilla Firefox: Use-after-free in the Layout component

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-124873: Mozilla Firefox: Invalid pointer in the DOM: Editor component

Invalid pointer in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-121267: TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote: Incorrect default permissions vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote…

Incorrect default permissions vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects eta-remote: from 0.0.2 before 0.0.3...

CVE-2026-63282: Axis Communications AB AXIS OS: Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which…

Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation...

CVE-2026-124867: Mozilla Firefox: Use-after-free in the DOM: Editor component

Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160...

CVE-2026-111239: Apache Software Foundation Apache TomEE: The optional SSH administration service grants full access to the administration shell to every user that authenticates…

The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged...

CVE-2026-63011: Intermesh groupoffice: Group-Office is an enterprise customer relationship management and groupware tool

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string tpl parameter that is passed without restriction to...

CVE-2026-92684: Neo4j @neo4j/graphql: Missing Authentication for Critical Function in aggregation queries in Neo4j @neo4j/graphql 5.0.0 before 5.12.17 and…

Missing Authentication for Critical Function in aggregation queries in Neo4j @neo4j/graphql 5.0.0 before 5.12.17 and 7.0.0 before 7.6.8 allows remote attackers to read protected data via GraphQL aggregation queries. Field-level @authentication is not enforced on string aggregates, which can retur...

CVE-2026-97880: Apache Software Foundation Apache TomEE: The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication…

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

CVE-2026-124604: GeoVision Inc. GV-Cloud: The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application…

The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to...

CVE-2026-125405: ettercap: Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c…

Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in ParseNTLMAuth in src/dissectors/echttp.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the proce...

CVE-2026-111258: Apache Software Foundation Apache TomEE: The optional request routing feature forwards requests to their configured destination without applying the security…

The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories. If a route copies client-controlled parts of the request path into its destination, ...

CVE-2026-124862: Mozilla Firefox: Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-86532: Apache Software Foundation Apache TomEE: The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner

The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or...

CVE-2026-93427: armember: The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for…

The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field Profile Cover in all versions up to, and including, 7.8.1 due to insufficient input sanitization...

CVE-2026-125745: madalinungureanu Custom Post Types and Custom Fields creator – WCK: Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that…

Custom Post Types and Custom Fields creator WCK before 2.4.1 contains a missing authorization vulnerability that allows authenticated attackers with access to any WCK meta box to read custom-field values on posts they cannot edit by exploiting the wckshowupdateform AJAX handler, which lacks the...

WordPress Plugin: everest-forms: CVE-2026-120513: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...

CVE-2026-125121: tmatens compose-lint: compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before...

CVE-2026-125394: FreeRDP: FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and…

FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in updategdipatblt, updategdipolygoncb and updategdimem3blt that retain stale brush cache pointers. A malicious RDP server can resend CACHEBRUSH to the same slot then send PATBLT, causing clients to read freed heap memory,...

CVE-2026-41214: n/a Intel(R) Neural Compressor software: Improper input validation for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User…

Improper input validation for some IntelR Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may...

CVE-2026-14918: Axis Communications AB: The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the…

The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains...

CVE-2026-89119: SAP_SE SAP Web Dispatcher and Internet Communication Manager: SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient…

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP Internet Communication Manager do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on...

CVE-2026-109811: SAP_SE SAP NetWeaver and ABAP Platform (Application Server ABAP): An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability due…

An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform Application Server ABAP has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a malicious server which allows the attacker to access sensitiv...

CVE-2026-12389: Axis Communications AB AXIS Camera Station Pro: A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack.

A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack...

CVE-2026-100386: themefic Ultra Addons for Contact Form 7: The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to,…

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7wpcf7mailcomponents function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which c...

CVE-2026-107244: Versa VOS: The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the…

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and...

CVE-2026-107245: Versa VOS: Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF

Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. Buffer Overflow Vulnerability Description When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of...

CVE-2026-107246: WebPros Plesk extension "Site Import": The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing…

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root...

CVE-2026-96769: Codup Extend B2B - Companies and Users Management for WooCommerce: The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive…

The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the registercompanyapi. This makes it possible for unauthenticated attackers to extract sensitive company data...

CVE-2026-91759: Hitachi Hitachi Dynamic Link Manager for Linux: Out-of-Bounds Write Vulnerability in Hitachi Dynamic Link Manager for Linux

Out-of-Bounds Write Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00...

CVE-2026-91756: Hitachi Hitachi Dynamic Link Manager for VMware: OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware

OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01...

CVE-2026-91755: Hitachi Hitachi Dynamic Link Manager for VMware: Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware

Integer Overflow Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01...

CVE-2026-91763: Hitachi Hitachi Dynamic Link Manager for Linux: UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux

UNIX Symbolic Link Symlink Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.6.2.-00 before 9.0.5-00...

CVE-2026-109797: SAP_SE SAP/astonish: In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers…

In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenan...

CVE-2026-109802: SAP_SE SAP NetWeaver Application Server for ABAP: SAP NetWeaver Application Server for ABAP does not properly validate certain input values

SAP NetWeaver Application Server for ABAP does not properly validate certain input values. An authenticated user could send specially crafted requests to trigger an error in internal processing. This could crash the affected work process and make the system unavailable. This results in a high...

CVE-2026-124600: GeoVision Inc. GV-Face: GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections

GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic...

CVE-2026-124599: GeoVision Inc. GV-Face: The RSA cryptographic key material, including a private key and public key, is embedded within the application package

The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover...

CVE-2026-124603: GeoVision Inc. GV-Cloud: An API key is hardcoded and retrievable from the GV-Cloud application package

An API key is hardcoded and retrievable from the GV-Cloud application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-120014: SAP_SE SAP Web Dispatcher and Internet Communication Manager: SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality

SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause...