CVE-2026-57154

OPNsense: Configuration line injection via multiple GUI text fields

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to contain additional attacker-controlled directives or policy lines. The confirmed Dnsmasq path includes dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, and dhcp_options.value, which are rendered into /usr/local/etc/dnsmasq.conf; access through page-services-dnsforwarder covers api/dnsmasq/*. Related affected fields span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Applying or restarting the affected service can alter behavior beyond the delegated setting, create service-side files, cross RBAC boundaries, or cause denial of service. Line injection through Monit mail password and adjacent Monit text fields into /usr/local/etc/monitrc demonstrated root command execution. Arbitrary shell command execution was not confirmed for the Dnsmasq path. This issue is fixed in versions 26.1.11 and 26.4.1p1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Opnsense

Products

Core

CVE-2026-46487

GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field

GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-44267

Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Enspirit

Products

Elo

CVE-2026-121734

ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView

ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Zane-ops

Products

Zane-ops

CVE-2026-121730

emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint

emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

0xdps

Products

Emailflare

CVE-2026-121626

GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Willamowius

Products

Gnugk

CVE-2026-121604

wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wlroots

Products

Wlroots

CVE-2026-121599

TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow

A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

A950rg A950rg Firmware

CVE-2026-121587

Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints

Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Coollabs

Products

Coolify

CVE-2026-121585

InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization

A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Infiniflow

Products

Ragflow

CVE-2026-121561

Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads

Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COCO with images to read responses, and spoof Host to capture the organization owner's API token.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Humansignal

Products

Label Studio

CVE-2026-121557

WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot

WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Wppconnect

Products

Wppconnect-server

CVE-2026-121553

Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())

Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti Cotonti Siena

CVE-2026-121549

nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.

CVSS 4.0 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Jarun

Products

Nnn

CVE-2026-121545

Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Robiningelbrecht

Products

Dreeve

CVE-2026-121539

miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control

A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Miroslavpejic85

Products

Mirotalk P2p

CVE-2026-121517

IrfanView TIFF Wang Annotation heap-based overflow

A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: "[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low".

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Irfanview

Products

Irfanview

CVE-2026-121501

mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation

A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function session_regenerate_id of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mathurvishal

Products

Cloudclassroom-php-project

CVE-2026-121450

CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID

CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Paicni

Products

Cfnext

CVE-2026-121446

svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes

svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Svg Sanitizer