CVE-2026-90726

Path Traversal Vulnerability in Dell PowerProtect Data Domain Leading to Denial of Service

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Powerprotect Data Domain

CVE-2026-70277

Windows Fast FAT File System Driver Information Disclosure Vulnerability

Out-of-bounds read in Windows Fast FAT Driver allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-58255

Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output `uid`/`gid` injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Jhuckaby

Products

Cronicle

CVE-2026-57202

Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Asterisk

Products

Asterisk Certified Asterisk

CVE-2026-57190

Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel_pgsql` and `cel_tds` may permit arbitrary SQL execution when untrusted data is set in the CEL `eventtype` column by the `CELGenUserEvent` dialplan application. The `cel_pgsql` or `cel_tds` backend must be loaded and configured, and the administrator must call `CELGenUserEvent` in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Asterisk

Products

Asterisk Certified Asterisk

CVE-2026-57189

Asterisk: Possible RED T.140 Generation Accumulation OOB Write

Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during `generation accumulation` using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Asterisk

Products

Asterisk Certified Asterisk

CVE-2026-57186

Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser

Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an `OOH323 request` can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Asterisk

Products

Asterisk Certified Asterisk

CVE-2026-48380

Substance3D - Painter | Out-of-bounds Read (CWE-125)

Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Substance 3d Painter

CVE-2026-118376

WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Tencent

Products

Weknora

CVE-2026-118372

LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Libressl

CVE-2026-118275

a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as c76e17272e52c12c6dcf68905b1df978c39e9aa5. It is advisable to implement a patch to correct this issue.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

A2ui-project

Products

A2ui

CVE-2026-118272

a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible to initiate the attack remotely. The exploit is now public and may be used. The patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. It is suggested to install a patch to address this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

A2ui-project

Products

A2ui

CVE-2026-118128

a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

A2aproject

Products

A2a-js

CVE-2026-117609

rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder

rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rtl 433 Project

Products

Rtl 433

CVE-2026-117605

nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nopcommerce

Products

Nopcommerce

CVE-2026-117601

Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions

Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Electrum

Products

Electrum

CVE-2026-117556

zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zchunk

Products

Zchunk

CVE-2026-117515

oretnom23 php-travel-agency-system traceapplication.php sql injection

A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Php-travel-agency-system

CVE-2026-117512

oretnom23 php-travel-agency-system employee_insert.php unrestricted upload

A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Php-travel-agency-system

CVE-2026-117509

crownpku Rasa_NLU_Chi Model Persistor persistor.py Persistor._decompress path traversal

A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Crownpku

Products

Rasa Nlu Chi