CVE-2026-123178: NETGEAR: An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated…

An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionality, potentially compromising the integrity of the affected...

CVE-2026-12963: Axis Communications AB: A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on…

A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server...

CVE-2026-101275: pretix pretix-adyen: Our payment integration with Adyen did not properly validate payment status responses

Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-119273: Unknown BulletProof Security: The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent…

The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all common web-server configurations, allowing unauthenticated...

CVE-2026-13387: Axis Communications AB AXIS Camera Station Pro: A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected…

A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected to unintended external content under specific conditions...

CVE-2026-50177: n/a Intel(R) Neural Compressor software: Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User…

Deserialization of untrusted data for some IntelR Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This resul...

CVE-2026-8372: Axis Communications AB AXIS Camera Station Pro: A vulnerability that could allow an attacker to gain unauthorized access.

A vulnerability that could allow an attacker to gain unauthorized access...

CVE-2026-125388: Intermesh Group-Office: Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows…

Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every...

CVE-2026-89114: SAP_SE SAP NetWeaver AS Java EDM Application: SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests

SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on...

CVE-2026-109795: SAP_SE S4CRM: SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain…

SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected syste...

CVE-2026-88707: ASUS Router firmware: An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request…

An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request containing parameters that exceed the buffer length, potentially overwriting other memory regions or causing the system to crash. Refer to the ' Security Update for ASUS Router...

CVE-2026-109809: SAP_SE SAP NetWeaver Application Server Java (NWDI Cockpit): SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain…

SAP NetWeaver Application Server Java NWDI Cockpit does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on...

CVE-2026-109804: SAP_SE SAP NetWeaver (SAP Message Server): SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated…

SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There...

CVE-2026-125404: ettercap: Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the…

Ettercap through 0.8.4.1 contains an integer underflow in ccmpdecrypt in src/ecencryptionccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to overflow a stack buffer in the Ettercap...

CVE-2026-125079: D-Link DCS-6501LH: A vulnerability was determined in D-Link DCS-6501LH 3.03.02

A vulnerability was determined in D-Link DCS-6501LH 3.03.02. This impacts the function pfgetonvifuserpwd/mydlinkdefaultsysinfo of the file /mnt/conf/SystemConfig.ini of the component Media Service. This manipulation of the argument pincode causes hard-coded credentials. It is possible to initiate...

CVE-2026-125368: YeQing17-2026 OmniAgent: OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that…

OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent.issafebashcommand that treats any command starting with find as safe without inspecting -execdir arguments. Prompt-injected agents can run find with -execdir to invoke binaries like dd, nc, perl or openss...

CVE-2026-125753: abpframework abp: ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in…

ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging...

CVE-2026-86579: Hitachi Hitachi Dynamic Link Manager for Windows: Binary Planting Vulnerability in Hitachi Dynamic Link Manager for Windows

Binary Planting Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: from 5.9.5-00 before 9.0.4-01...

CVE-2026-57884: n/a Intel(R) Graphics Software: Uncontrolled search path for some Intel(R) Graphics Software before version 26.14.2303.1 within Ring 3: User…

Uncontrolled search path for some IntelR Graphics Software before version 26.14.2303.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This...

CVE-2026-125086: D-Link M60: A vulnerability has been found in D-Link M60 1.12.B01

A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the publ...

CVE-2026-63653: Intermesh groupoffice: Group-Office is an enterprise customer relationship management and groupware tool

Group-Office is an enterprise customer relationship management and groupware tool. Prior to version 26.0.37, go/modules/community/bookmarks/controller/Bookmark.php's description action takes a fully attacker-controlled url parameter and passes it, unvalidated, to \GO\Base\Util\HttpClient::request...

CVE-2026-123429: Rejected reason: This CVE ID has been rejected as a duplicate.

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-120012: SAP_SE SAP Cloud SDK for AI(JavaScript): SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages…

SAP Cloud SDK for AI Node.js could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these...

CVE-2026-100962: NVIDIA Nemo Deploy: NVIDIA NeMo Export-Deploy for all platforms contains a vulnerability in multimodal deployment where an attacker could…

NVIDIA NeMo Export-Deploy for all platforms contains a vulnerability in multimodal deployment where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might cause information disclosure...

CVE-2026-111243: Apache Software Foundation Apache TomEE: A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and…

A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or...

CVE-2026-87758: Apache Software Foundation Apache TomEE: The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS…

The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation...

CVE-2026-111242: Apache Software Foundation Apache TomEE: When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state…

When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated...

CVE-2026-107404: Ivanti Endpoint Manager Mobile: Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated…

Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk...

CVE-2026-123181: Ivanti Sentry: A path traversal vulnerability in Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a remote authenticated…

A path traversal vulnerability in Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges...

CVE-2026-125754: dolibarr: Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in…

Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in apiexpensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights ca...

CVE-2026-125378: PowerDNS-Admin: PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for…

PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the applyrecords handler for /admin/template/...

CVE-2026-125750: Firekylin: Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read…

Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js...

CVE-2026-111259: Apache Software Foundation Apache TomEE: The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default

The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for...

CVE-2026-86811: Apache Software Foundation Apache TomEE: The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without…

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are...

CVE-2026-121653: ivanti Endpoint Manager: SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker…

SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution...

CVE-2026-117477: GMO Prime Strategy Co., Ltd.: KUSANAGI provided by GMO Prime Strategy Co., Ltd

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL...

CVE-2026-91757: Hitachi Hitachi Dynamic Link Manager for VMware: OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware

OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 7.3.0-00 before 9.0.4-01...

CVE-2026-109801: SAP_SE SAP NetWeaver Application Server Java (NWDI Cockpit): SAP NetWeaver Application Server Java (NWDI Cockpit)� does not perform sufficient authorization checks for certain…

SAP NetWeaver Application Server Java NWDI Cockpit� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system...

CVE-2026-125385: go2ismail Asp.Net-Core-Inventory-Order-Management-System: INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read…

INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without...

CVE-2026-91761: Hitachi Hitachi Dynamic Link Manager for Linux: UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux

UNIX Symbolic Link Symlink Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.6.2.-00 before 9.0.5-00...

CVE-2026-60045: MB connect line, Helmholz: A high privileged remote attacker can upload arbitrary files to a guessable location

A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained with other vulnerabilities...

CVE-2026-88709: ASUS Router firmware: Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with…

Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB device containing a specially crafted directory name, potentially executing arbitrary commands with root privileges. Refer to the ' Security Update...

CVE-2026-89126: SAP_SE SAP Web Dispatcher: SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component

SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the...

CVE-2026-125757: mailcow mailcow: dockerized: mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain…

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered b...

CVE-2026-125709: Red Hat: A flaw was found in libstdc++

A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially...

CVE-2026-58114: Siemens: A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All…

A vulnerability has been identified in SIMATIC BATCH V9.1 All versions, SIMATIC Information Server 2020 All versions, SIMATIC Information Server 2022 All versions, SIMATIC PCS 7 V9.1 All versions, SIMATIC Process Historian 2020 All versions, SIMATIC Process Historian 2022 All versions, SIMATIC...

CVE-2026-16478: TÜBİTAK BİLGEM Software Technologies Research Institute pardus-nvidia-installer: Permissive list of allowed inputs vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute…

Permissive list of allowed inputs vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-nvidia-installer allows Privilege Escalation. This issue affects pardus-nvidia-installer: before 2.0.1...

CVE-2026-61547: alanxz rabbitmq-c: rabbitmq-c is a C-language AMQP client library for RabbitMQ

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqpsendframe API is used to serialize an oversized AMQPFRAMEBODY. The issue occurs because amqpframetobytes copies frame.payload.bodyfragment.len byte...

CVE-2026-57907: WatchGuard Endpoint Security: A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the…

A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process...

CVE-2026-111256: Apache Software Foundation Apache TomEE: When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured…

When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without...