CVE-2026-123427: Rejected reason: This CVE ID has been rejected as a duplicate.

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-123426: Rejected reason: This CVE ID has been rejected as a duplicate.

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-104676: Unknown Zion Builder: The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before…

The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author role or above to upload a crafted SVG...

CVE-2026-125077: SourceCodester Smart Attendance System with QR Code Scanner: A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0

A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been public...

CVE-2026-63288: Axis Communications AB: A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint

A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer...

CVE-2026-107243: Versa VOS: The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the…

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS...

CVE-2026-120730: nerves-hub nerves_hub_web: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device…

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerveshubweb allows an authenticated user who manages devices in any organization to write into other...

CVE-2026-125364: frab: frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant…

frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conferenceusersattributes. Attackers can abuse UsersControllerupdate or create, which skip filterconferenceusers, to gain orga on any...

CVE-2026-125373: ietf-tools datatracker: IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to…

IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse viewfeedbacknominee, viewfeedbacktopic, viewfeedbackunrelated and editnominee to view...

CVE-2026-125379: movim: Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated…

Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by supplying server, node and nodeid values. Attackers who know item identifiers can retrieve cached community or contact-only posts from the pod-wide...

CVE-2026-125382: RamonSilva20 mapos: Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows…

Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to...

CVE-2026-125390: Intermesh Group-Office: Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in…

Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or...

CVE-2026-125395: ampache: Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to…

Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics and showlyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute co...

CVE-2026-125399: FluxionNetwork fluxion: Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes…

Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the...

CVE-2026-125387: faveosuite faveo-helpdesk: Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows…

Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints t...

CVE-2026-125398: CoreBunch Instatic: Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated…

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow instead of loadRowForAccess. Attackers holding content.edit.any but lacking data.system.tables.read can send...

CVE-2026-60036: MB connect line, Helmholz: A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code…

A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can result in a total loss of confidentiality, integrity and availability...

CVE-2026-60041: MB connect line, Helmholz: An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of…

An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability...

CVE-2026-109803: SAP_SE SAP NetWeaver Knowledge Management (XML Forms): SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations…

SAP NetWeaver Knowledge Management XML Forms does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be...

CVE-2026-87756: Apache Software Foundation Apache TomEE: The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check…

The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only...

CVE-2026-87755: Apache Software Foundation Apache TomEE: Stateful session bean identifiers are not generated from a cryptographically secure random source

Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other...

CVE-2026-111263: Apache Software Foundation Apache TomEE: Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the…

Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its...

CVE-2026-124946: Mozilla Firefox: Invalid pointer in the JavaScript Engine: JIT component

Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160...

CVE-2026-124911: Mozilla Firefox: Clickjacking issue in the Autofill component in Firefox for Android

Clickjacking issue in the Autofill component in Firefox for Android. This vulnerability was fixed in Firefox 160...

CVE-2026-125706: Red Hat, GStreamer: A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin

A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an...

CVE-2026-124932: Mozilla Firefox: Use-after-free in the Graphics component

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-125756: postalsys postal-mime: postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain…

postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own subdomain while PostalMime.parse report...

CVE-2026-124951: Mozilla Firefox: Privilege escalation in the Nimbus Desktop Client component

Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-11315: mackron dr_libs: A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3)

A out-of-bounds read vulnerability exists in the drmp3 drmp3initinternal functionality of drlibs versions: 0.7.3. A specially crafted .mp3 file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-125751: meteroid-oss Meteroid: Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC…

Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash an...

CVE-2026-124940: Mozilla Firefox: Mitigation bypass in the File Handling component

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-124944: Mozilla Firefox: Information disclosure in the Marionette component

Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160...

CVE-2026-124949: Mozilla Firefox: Other issue in the SVG component

Other issue in the SVG component. This vulnerability was fixed in Firefox 160...

CVE-2026-124952: Mozilla Firefox: Use-after-free in the Audio/Video component

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45...

CVE-2026-125759: NangoHQ nango: Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary…

Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify interpolates int...

CVE-2026-97881: Apache Software Foundation Apache TomEE: The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories

The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted...

CVE-2026-97874: Apache Software Foundation Apache TomEE: When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian…

When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to...

CVE-2026-124926: Mozilla Firefox: Incorrect boundary conditions in the WebRTC component

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-124930: Mozilla Firefox: Information disclosure in the Address Bar component

Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-124931: Mozilla Firefox: Same-origin policy bypass in the DOM: Core & HTML component

Same-origin policy bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-124938: Mozilla Firefox: Mitigation bypass in the Add-ons Manager component

Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-124936: Mozilla Firefox: Spoofing issue in the Address Bar component

Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160...

CVE-2026-124939: Mozilla Firefox: JIT miscompilation in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...

CVE-2026-113422: Eclipse Foundation Eclipse Kura: In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire…

In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 available since 5.1.0, org.eclipse.kura.rest.wire.provider, determine whether a configuration update targets a Wire Component, Driver or Asset from the factory...

CVE-2026-105425: Ivanti: OS command injection in Ivanti Sentry before versions 10.7.4, 10.8.3, and 11.0.0 as well as in Ivanti EPMM before…

OS command injection in Ivanti Sentry before versions 10.7.4, 10.8.3, and 11.0.0 as well as in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2026-111241: Apache Software Foundation Apache TomEE: When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to…

When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that...

CVE-2026-66333: AMI AptioV: AMI APTIOV contains vulnerabilities in BIOS where privileged users may cause the “Out-of-Bounds Read” by local access

AMI APTIOV contains vulnerabilities in BIOS where privileged users may cause the “Out-of-Bounds Read” by local access. Successful exploitation of this vulnerability may lead to a denial of service during firmware update processing, such as a crash or failed update if the out-of-bounds read hits...

CVE-2026-111260: Apache Software Foundation Apache TomEE: The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a…

The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's...

CVE-2026-111261: Apache Software Foundation Apache TomEE: The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows…

The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade...

CVE-2026-120350: vaadin: The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into…

The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying t...