Azmir CVE Feed · dbcve.org + NVD

CVE-2026-120345 - A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965

Mon, 02 Nov 2026 00:00:00 +0000

A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure. Severity: 10 | CRITICAL (CVSS dbcve.org) CISA KEV: Not listed

CVE-2026-120344 - A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965

Mon, 02 Nov 2026 00:00:00 +0000

A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. Severity: 10 | CRITICAL (CVSS dbcve.org) CISA KEV: Not listed

CVE-2026-120281 - A vulnerability was found in WAVLINK WN536AX6-A V260507

Mon, 02 Nov 2026 00:00:00 +0000

A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure. Severity: 10 | CRITICAL (CVSS dbcve.org) CISA KEV: Not listed

CVE-2026-120283 - A vulnerability was identified in Linksys E8450 1

Mon, 02 Nov 2026 00:00:00 +0000

A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 10 | CRITICAL (CVSS dbcve.org) CISA KEV: Not listed

CVE-2026-120279 - A flaw has been found in WAVLINK WN536AX6-A V260507

Mon, 02 Nov 2026 00:00:00 +0000

A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure. Severity: 10 | CRITICAL (CVSS dbcve.org) CISA KEV: Not listed

CVE-2026-120280 - A vulnerability has been found in WAVLINK WN536AX6-A V260507

Mon, 02 Nov 2026 00:00:00 +0000

A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. Severity: 10 | CRITICAL (CVSS dbcve.org) CISA KEV: Not listed

CVE-2026-120277 - A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2

Mon, 02 Nov 2026 00:00:00 +0000

A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure. Severity: 10 | CRITICAL (CVSS dbcve.org) CISA KEV: Not listed

CVE-2026-120276 - A weakness has been identified in WAVLINK WN536AX6-A V260507_2

Mon, 02 Nov 2026 00:00:00 +0000

A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure. Severity: 10 | CRITICAL (CVSS dbcve.org) CISA KEV: Not listed

CVE-2026-120338 - Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess

Sun, 01 Nov 2026 00:00:00 +0000

Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538). Severity: 10 | CRITICAL (CVSS dbcve.org) CISA KEV: Not listed

CVE-2026-120198 - A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117

Sun, 01 Nov 2026 00:00:00 +0000

A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. Severity: 10 | CRITICAL (CVSS dbcve.org) CISA KEV: Not listed

CVE-2026-122054 - BIG-HKSCS decoding hang on crafted input

Wed, 04 Nov 2026 17:17:38 +0000

CVE ID :CVE-2026-122054
Published : Nov. 4, 2026, 5:17 p.m. | 35 minutes ago
Description :Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-76506 - Cisco Unified Computing System Central Remote Code Execution Vulnerability

Wed, 04 Nov 2026 17:17:37 +0000

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input in an HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected endpoint on an affected device. A successful exploit could allow the attacker to execute arbitrary commands, write arbitrary files to the filesystem, and obtain sensitive information. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. Cisco has released software updates that address this vulnerability There are no workarounds that address this vulnerability. Severity: 7.6 | HIGH (CVSS 3.1)

CVE-2026-76419 - Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

Wed, 04 Nov 2026 17:17:36 +0000

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Severity: 6.1 | MEDIUM (CVSS 3.1)

CVE-2026-121926 - yezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authentication

Wed, 04 Nov 2026 17:17:35 +0000

A vulnerability was detected in yezhihao jt808-server up to a07f68c466b560b97ef41edb8a4966469abdf83e. Affected is the function WebMvcConfig.addInterceptors of the component Web Management API. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 7.5 | (CVSS 2.0)

CVE-2026-20241 - Cisco Identity Services Engine Authorization Bypass Vulnerability

Wed, 04 Nov 2026 17:17:35 +0000

A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to obtain an endpoint identity certificate. This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to bypass authorization to obtain an endpoint certificate. Severity: 5.3 | MEDIUM (CVSS 3.1)

CVE-2026-119747 - GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API

Wed, 04 Nov 2026 17:17:34 +0000

The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin's manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users' invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API. Severity: 7.1 | HIGH (CVSS 4.0)

CVE-2026-119748 - GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice

Wed, 04 Nov 2026 17:17:34 +0000

The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold. Severity: 6.9 | MEDIUM (CVSS 4.0)

CVE-2026-119749 - GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass

Wed, 04 Nov 2026 17:17:34 +0000

The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge. Severity: 8.7 | HIGH (CVSS 4.0)

CVE-2026-92704 - SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution

Wed, 04 Nov 2026 16:17:55 +0000

SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux. In version 0.0.3-release.3 and earlier, the repository-provided debugger frontend tooling is vulnerable while running. This tooling is not included in the release archives. The frontend exposes an HTTP API on 127.0.0.1:8765 without authentication or CSRF token. Its do_POST handler in tools/SharpEmu.DebuggerFrontend/debugger_frontend.py does not validate the Origin, Referer, Sec-Fetch-Site, or Host headers. The _read_json_body() function also accepts JSON sent with browser-simple content types instead of requiring application/json . A malicious page that can reach the loopback listener can send cross-origin requests to /api/launch , /api/command , and /api/connect . Chromium may require Local Network Access permission for pages served from public origins. Local-origin pages and other delivery paths are not consistently subject to this restriction. The /api/launch endpoint accepts an attacker-selected emulatorPath if it points to an existing file on the victim’s host. On POSIX systems, that file must also be executable. The endpoint additionally requires an existing ebootPath . The /api/command endpoint exposes debugger operations, including write-memory , set-register , and continue . The /api/connect endpoint can initiate outbound TCP connections. These operations can let an attacker execute an existing binary with the victim’s privileges, control the attached emulated process, or reach network services accessible from the host. DNS rebinding can additionally let the attacker read API responses interactively. This issue is fixed in version 0.0.3-release.3-patch.1 Severity: 8.3 | HIGH (CVSS 3.1)

CVE-2026-91163 - Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller

Wed, 04 Nov 2026 16:17:54 +0000

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/client_certs.rs to accept certificates at the TLS layer and defer validation to warpgate-protocol-kubernetes/src/server/auth.rs, where authentication and lookup failures are rendered verbatim in an HTTP 500 response body. The Kubernetes application in warpgate-protocol-kubernetes/src/server/mod.rs lacks the outer request-logging wrapper used by the HTTP protocol, and failures in warpgate-protocol-kubernetes/src/server/handlers.rs can short-circuit before its inner log point. An unauthenticated network client can therefore induce failures and receive ASN.1/DER parser diagnostics or sea_orm database errors without the attempt being recorded in the gateway log. The disclosed information is limited to internal diagnostics, and no user-data, integrity, or availability impact is established. This issue is fixed in version 0.29.0. Severity: 3.7 | LOW (CVSS 3.1)

CVE-2026-91168 - Warpgate: Kubernetes authorization correlation can be reused by a recreated same-name account

Wed, 04 Nov 2026 16:17:54 +0000

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. From 0.21.0 until 0.29.0, the Kubernetes request correlator in warpgate-protocol-kubernetes/src/correlator.rs keys an authorized AdmittedTarget by username, target_name, and client IP rather than by the immutable user UUID, while KubernetesSessionHandle::close does not evict the entry. If an account is deleted and a different low-privilege account is created with the same username, the replacement account can successfully authenticate as that recreated username and reuse the predecessor's still-live correlation entry when requesting the same target from the same client IP before kubernetes.session_max_age expires. Current-request authentication still occurs, but the reused entry bypasses a fresh target authorization check and can cause Warpgate to proxy requests with Kubernetes target credentials that the replacement account is not authorized to use, exposing cluster resources or permitting unauthorized mutations. This issue is fixed in version 0.29.0. Severity: 6.8 | MEDIUM (CVSS 3.1)

CVE-2026-121966 - Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak

Wed, 04 Nov 2026 16:17:50 +0000

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user. Severity: 8.7 | HIGH (CVSS 3.1)

CVE-2026-121967 - Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal

Wed, 04 Nov 2026 16:17:50 +0000

Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key. Severity: 4.9 | MEDIUM (CVSS 3.1)

CVE-2026-122032 - SPIP before 4.4.29 Authenticated SQL Injection via where Parameter

Wed, 04 Nov 2026 16:17:50 +0000

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing spip_sanitize_from_request() sanitization. Attackers can exploit this request parameter mismatch to extract database contents, including protected articles and bcrypt password hashes of users. Severity: 7.1 | HIGH (CVSS 4.0)

CVE-2026-121961 - FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race

Wed, 04 Nov 2026 16:17:49 +0000

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to free a borrowed context and crash the proxy process. Severity: 8.2 | HIGH (CVSS 4.0)

CVE-2026-121962 - FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read

Wed, 04 Nov 2026 16:17:49 +0000

FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User Authorization reads during PROTOCOL_HYBRID_EX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance the stream pointer beyond the 16 KiB allocation, causing an out-of-bounds write and client denial of service. Severity: 8.1 | HIGH (CVSS 3.1)

CVE-2026-121963 - FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close

Wed, 04 Nov 2026 16:17:49 +0000

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsnd_virtual_channel_write, crashing the client. Severity: 8.2 | HIGH (CVSS 4.0)

CVE-2026-121964 - FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragment

Wed, 04 Nov 2026 16:17:49 +0000

FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capacity from the current stream position. A malicious or compromised RD Gateway can send crafted RPC fragments with manipulated alloc_hint and frag_length values to overwrite client heap memory with attacker-controlled data, causing a crash or potentially arbitrary code execution. Severity: 8.7 | HIGH (CVSS 4.0)

CVE-2026-121965 - Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key

Wed, 04 Nov 2026 16:17:49 +0000

Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building objects for Cloud Code triggers and LiveQuery, where a dot notation key whose intermediate segment resolves through an inherited member writes onto a process-wide built-in. Clients with write access to an object in a class with a trigger or LiveQuery can corrupt a built-in function, making unrelated requests fail until restart and denying service to all clients and hosted applications. Severity: 6 | MEDIUM (CVSS 4.0)

CVE-2026-121955 - FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext

Wed, 04 Nov 2026 16:17:48 +0000

FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation. Severity: 8.7 | HIGH (CVSS 4.0)

CVE-2026-121956 - FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt

Wed, 04 Nov 2026 16:17:48 +0000

FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process. Severity: 8.7 | HIGH (CVSS 4.0)

CVE-2026-121957 - FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race

Wed, 04 Nov 2026 16:17:48 +0000

FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers. Severity: 8.7 | HIGH (CVSS 4.0)

CVE-2026-121958 - FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys

Wed, 04 Nov 2026 16:17:48 +0000

FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS. Severity: 8.8 | HIGH (CVSS 3.1)

CVE-2026-121959 - FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame

Wed, 04 Nov 2026 16:17:48 +0000

FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a client thread to spin and consume CPU until killed. Severity: 7.1 | HIGH (CVSS 4.0)

CVE-2026-121960 - FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest

Wed, 04 Nov 2026 16:17:48 +0000

FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPR_ASSERT and abort the server process. Severity: 8.7 | HIGH (CVSS 4.0)

CVE-2026-121950 - FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap

Wed, 04 Nov 2026 16:17:47 +0000

FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX CREATE_SURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A malicious RDP server can send a CREATE_SURFACE PDU with width and height 32766 to a connecting client to corrupt heap memory or cause a denial of service. Severity: 7.1 | HIGH (CVSS 4.0)

CVE-2026-121951 - FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event

Wed, 04 Nov 2026 16:17:47 +0000

FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active session can send a truncated unknown input event to abort assertion-enabled server processes, causing denial of service. Severity: 8.7 | HIGH (CVSS 4.0)

CVE-2026-121952 - FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability

Wed, 04 Nov 2026 16:17:47 +0000

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a crash. Severity: 9.8 | CRITICAL (CVSS 3.1)

CVE-2026-121953 - FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close

Wed, 04 Nov 2026 16:17:47 +0000

FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code. Severity: 9.8 | CRITICAL (CVSS 3.1)

CVE-2026-121954 - FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec

Wed, 04 Nov 2026 16:17:47 +0000

FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR command, to corrupt client heap memory and crash the client. Severity: 7.1 | HIGH (CVSS 4.0)

CVE-2026-119746 - ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies

Wed, 04 Nov 2026 16:17:45 +0000

ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158. Severity: 8.2 | HIGH (CVSS 4.0)

CVE-2026-109518 - APT RCE via hard link reuse

Wed, 04 Nov 2026 16:17:33 +0000

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration Severity: 7.7 | HIGH (CVSS 4.0)

CVE-2026-106554 - jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)

Wed, 04 Nov 2026 16:17:32 +0000

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven). PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo. Quadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList). CBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags. PoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit. Impact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool. Fix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).

CVE-2026-66736 - CVE-2026-66736

Wed, 04 Nov 2026 15:17:47 +0000

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-39430 - CVE-2026-39430

Wed, 04 Nov 2026 15:17:44 +0000

On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management and access controls are not enforced device-side. Thus, an unauthenticated user can change administrator-level settings (without logging in) via a modified client that bypasses the login step or via a custom client to make the underlying administrator API calls. This allows unauthenticated users to perform administrative actions too such as exporting configuration files that include the internal device credentials for the administrator user and other network systems.

CVE-2026-39431 - CVE-2026-39431

Wed, 04 Nov 2026 15:17:44 +0000

On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers (without administrator-level access) to execute arbitrary commands on the device as root. This is due to insufficient input validation that allows an attacker to control part of the CSR certificate generation process. This provides full root access that permits full control over device operations, unauthorized access to data, and the ability to place a persistent backdoor on the device (which could operate via the Ethernet port).

CVE-2026-122007 - Oqtane Framework before 10.3.0 Broken Access Control via SettingController

Wed, 04 Nov 2026 15:17:43 +0000

Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type settings, since IsAuthorized and FilterPrivate fail to verify the requested site matches the current alias SiteId. Attackers can exploit the /api/setting endpoints to disclose private values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and to alter another site's OIDC/OAuth2 authentication configuration without requiring host privileges. Severity: 7.4 | HIGH (CVSS 4.0)

CVE-2026-122008 - Oqtane Framework before 10.3.0 SSRF via File Upload From URL

Wed, 04 Nov 2026 15:17:43 +0000

Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync without validating the scheme, host, or IP address. Attackers can request internal resources such as cloud instance metadata services or localhost-bound management interfaces, save the fetched response as a file in their own user folder, and retrieve it via the download endpoint to exfiltrate sensitive internal data or enumerate internal network hosts and ports. Severity: 5.3 | MEDIUM (CVSS 4.0)

CVE-2026-121009 - SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func

Wed, 04 Nov 2026 15:17:42 +0000

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func. injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked. An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.

CVE-2026-121632 - Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping

Wed, 04 Nov 2026 15:17:42 +0000

Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping. process_attrs writes each attribute value into the markup as is. The select, radio group and checkbox group renderers pass each option to it, so an option's value becomes an unescaped attribute. Option and option group labels are also unescaped, the group label inside a label attribute and the others in element content. Any application whose option list is built from data rather than literals, using an options_ method, a build_options method or a DBIC model, allows attacker-influenced text in an option value or label that can embed JavaScript in rendered pages. Attribute values built from data, such as through element_attr, are affected the same way.