CVE-2026-120513: wpeverest: The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is…

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...

CVE-2026-123178: NETGEAR: An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated…

An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionality, potentially compromising the integrity of the affected...

CVE-2026-12963: Axis Communications AB: A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on…

A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server...

CVE-2026-13312: Axis Communications AB: A vulnerability that could allow an attacker to compromise a system.

A vulnerability that could allow an attacker to compromise a system...

CVE-2026-101275: pretix pretix-adyen: Our payment integration with Adyen did not properly validate payment status responses

Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-119273: Unknown BulletProof Security: The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent…

The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all common web-server configurations, allowing unauthenticated...

CVE-2026-84938: themefusion Avada (Fusion) Builder: The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification…

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data actionhook → Media Upload Chain ID3 Metadata / htmlattributes in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This...

CVE-2026-13387: Axis Communications AB AXIS Camera Station Pro: A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected…

A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected to unintended external content under specific conditions...

CVE-2026-50177: n/a Intel(R) Neural Compressor software: Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User…

Deserialization of untrusted data for some IntelR Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This resul...

CVE-2026-8372: Axis Communications AB AXIS Camera Station Pro: A vulnerability that could allow an attacker to gain unauthorized access.

A vulnerability that could allow an attacker to gain unauthorized access...

CVE-2026-125388: Intermesh Group-Office: Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows…

Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every...

CVE-2026-89114: SAP_SE SAP NetWeaver AS Java EDM Application: SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests

SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on...

CVE-2026-109795: SAP_SE S4CRM: SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain…

SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected syste...

CVE-2026-88707: ASUS Router firmware: An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request…

An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request containing parameters that exceed the buffer length, potentially overwriting other memory regions or causing the system to crash. Refer to the ' Security Update for ASUS Router...

CVE-2026-107240: Versa VOS: The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the…

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to childprocess.exec...

CVE-2026-109809: SAP_SE SAP NetWeaver Application Server Java (NWDI Cockpit): SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain…

SAP NetWeaver Application Server Java NWDI Cockpit does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on...

CVE-2026-109804: SAP_SE SAP NetWeaver (SAP Message Server): SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated…

SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There...

CVE-2026-125404: ettercap: Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the…

Ettercap through 0.8.4.1 contains an integer underflow in ccmpdecrypt in src/ecencryptionccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to overflow a stack buffer in the Ettercap...

CVE-2026-125079: D-Link DCS-6501LH: A vulnerability was determined in D-Link DCS-6501LH 3.03.02

A vulnerability was determined in D-Link DCS-6501LH 3.03.02. This impacts the function pfgetonvifuserpwd/mydlinkdefaultsysinfo of the file /mnt/conf/SystemConfig.ini of the component Media Service. This manipulation of the argument pincode causes hard-coded credentials. It is possible to initiate...

CVE-2026-125368: YeQing17-2026 OmniAgent: OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that…

OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent.issafebashcommand that treats any command starting with find as safe without inspecting -execdir arguments. Prompt-injected agents can run find with -execdir to invoke binaries like dd, nc, perl or openss...

CVE-2026-125753: abpframework abp: ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in…

ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging...

CVE-2026-86579: Hitachi Hitachi Dynamic Link Manager for Windows: Binary Planting Vulnerability in Hitachi Dynamic Link Manager for Windows

Binary Planting Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: from 5.9.5-00 before 9.0.4-01...

CVE-2026-40693: n/a Intel(R) TDX Workload Attestation software: Improper input validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may…

Improper input validation for some IntelR TDX Workload Attestation software within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially...

CVE-2026-57884: n/a Intel(R) Graphics Software: Uncontrolled search path for some Intel(R) Graphics Software before version 26.14.2303.1 within Ring 3: User…

Uncontrolled search path for some IntelR Graphics Software before version 26.14.2303.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This...

CVE-2026-11316: mackron dr_libs: A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs…

A out-of-bounds write vulnerability exists in the drwav drwavreadcuetometadataobj functionality of drlibs versions: 0.14.5. A specially crafted .wav file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-125086: D-Link M60: A vulnerability has been found in D-Link M60 1.12.B01

A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the publ...

CVE-2026-63653: Intermesh groupoffice: Group-Office is an enterprise customer relationship management and groupware tool

Group-Office is an enterprise customer relationship management and groupware tool. Prior to version 26.0.37, go/modules/community/bookmarks/controller/Bookmark.php's description action takes a fully attacker-controlled url parameter and passes it, unvalidated, to \GO\Base\Util\HttpClient::request...

CVE-2026-123429: Rejected reason: This CVE ID has been rejected as a duplicate.

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-120012: SAP_SE SAP Cloud SDK for AI(JavaScript): SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages…

SAP Cloud SDK for AI Node.js could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these...

CVE-2026-100962: NVIDIA Nemo Deploy: NVIDIA NeMo Export-Deploy for all platforms contains a vulnerability in multimodal deployment where an attacker could…

NVIDIA NeMo Export-Deploy for all platforms contains a vulnerability in multimodal deployment where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might cause information disclosure...

CVE-2026-111243: Apache Software Foundation Apache TomEE: A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and…

A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or...

CVE-2026-87758: Apache Software Foundation Apache TomEE: The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS…

The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation...

CVE-2026-111242: Apache Software Foundation Apache TomEE: When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state…

When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...

CVE-2026-107404: Ivanti Endpoint Manager Mobile: Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated…

Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk...

CVE-2026-123181: Ivanti Sentry: A path traversal vulnerability in Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a remote authenticated…

A path traversal vulnerability in Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges...

CVE-2026-125754: dolibarr: Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in…

Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in apiexpensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights ca...

CVE-2026-125378: PowerDNS-Admin: PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for…

PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the applyrecords handler for /admin/template/...

CVE-2026-83528: Ivanti Endpoint Manager Mobile: Exposure of PII in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker…

Exposure of PII in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information...

CVE-2026-125750: Firekylin: Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read…

Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js...

CVE-2026-111259: Apache Software Foundation Apache TomEE: The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default

The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for...

CVE-2026-86811: Apache Software Foundation Apache TomEE: The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without…

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are...

CVE-2026-121653: ivanti Endpoint Manager: SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker…

SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution...

CVE-2026-89131: SAP_SE SAP NetWeaver Enterprise Portal: SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request…

SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, triggers an unintended action on the server. Successful exploitation...

CVE-2026-125366: asciimoo omnom: Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server…

Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /addfeed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch witho...

CVE-2026-117477: GMO Prime Strategy Co., Ltd.: KUSANAGI provided by GMO Prime Strategy Co., Ltd

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL...

CVE-2026-91757: Hitachi Hitachi Dynamic Link Manager for VMware: OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware

OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 7.3.0-00 before 9.0.4-01...

CVE-2026-109801: SAP_SE SAP NetWeaver Application Server Java (NWDI Cockpit): SAP NetWeaver Application Server Java (NWDI Cockpit)� does not perform sufficient authorization checks for certain…

SAP NetWeaver Application Server Java NWDI Cockpit� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system...

CVE-2026-125385: go2ismail Asp.Net-Core-Inventory-Order-Management-System: INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read…

INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without...

CVE-2026-91761: Hitachi Hitachi Dynamic Link Manager for Linux: UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux

UNIX Symbolic Link Symlink Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.6.2.-00 before 9.0.5-00...

CVE-2026-60045: MB connect line, Helmholz: A high privileged remote attacker can upload arbitrary files to a guessable location

A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained with other vulnerabilities...