CVE-2026-57446

libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMS_FILE_UPLOAD_STATE_NOT_USED. If a later ObtainFile request reuses that task and destination creation fails, MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mz-automation

Products

Libiec61850

CVE-2026-57169

Dockhand: Unauthenticated container exec via WebSocket upgrade

Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Finsys

Products

Dockhand

CVE-2026-55543

TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Helge17

Products

Tuxguitar

CVE-2026-114662

Obot before 0.26.0 API Key Theft via CLI Login Token Request

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Obot-platform

Products

Obot

CVE-2026-114658

Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the invited address for full site control.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav-plugin-login

CVE-2026-114641

Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Traefik

Products

Traefik

CVE-2026-114637

Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Traefik

Products

Traefik

CVE-2026-114633

WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-114575

TOTOLINK A950RG product.so UploadCustomModule command injection

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

CVSS 4.0 · 10 Critical EPSS 2.2% KEV · Not listed

Vendors

Totolink

Products

A950rg A950rg Firmware

CVE-2026-114509

Laravel TokenGuard authentication bypass through non-string API credentials

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

CVSS 4.0 · 9.2 Critical EPSS 1.8% KEV · Not listed

Vendors

Laravel

Products

Framework

CVE-2026-114440

oretnom23 php-travel-agency-system delete.php sql injection

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/ticket_id/payment_id/id/document_id/salary_id/emp_id/user_id leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Php-travel-agency-system

CVE-2026-114383

TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow

A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

Ex200 Ex200 Firmware

CVE-2026-114380

itsourcecode Online Cake Ordering System inserttrans.php sql injection

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Performing a manipulation of the argument prcd results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Online Cake Ordering System

CVE-2026-114377

leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.9.2 can resolve this issue. The identifier of the patch is 224ef2a11facddef6b3a3c1f0a69156d1e574a33. It is advisable to upgrade the affected component.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Leomoon-studios

Products

Wiki-go

CVE-2026-114374

leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery

A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Leomoon-studios

Products

Wiki-go

CVE-2026-114268

Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow

A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Tenda

Products

Be3l Pro

CVE-2026-114142

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key's guard. The assign() path then descends through an unowned Date value without applying the owned-container check and can reach the prototype chain. Objects created elsewhere in the process can inherit the injected property. This issue is fixed in version 5.0.1.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Binarymuse

Products

Toml-node

CVE-2026-114138

Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer in that file repeatedly invokes _MediaType parsing from rest_framework/utils/mediatypes.py for each attacker-controlled token, every renderer, and forced 406 renegotiation. A remote unauthenticated client can send many distinct media types containing large quoted parameter values with numerous semicolons, causing Django's parameter parser and DRF's repeated parsing structure to consume disproportionate CPU. Requests to any reachable endpoint can pin synchronous workers for prolonged periods, and concurrent requests can make the service unavailable until the requests stop. This issue is fixed in version 3.18.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Encode

Products

Django Rest Framework

CVE-2026-102923

SparkyFitness: SSRF via unvalidated custom_url in AI service settings

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL and invokes an affected AI flow. The user can save a custom AI service URL and trigger an outbound request. Successful exploitation can send server-side POST requests with a controlled bearer value, probe internal services, and disclose the AI system prompt. This issue is fixed in version 1.6.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Codewithcj

Products

Sparkyfitness

CVE-2020-37284

Sickbeard build-507 Reflected XSS via testNaming pattern Parameter

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming handler returns unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Midgetspy

Products

Sickbeard