CVE-2026-111716

Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nduckmink

Products

Arkon

CVE-2026-111717

Arkon through 0.9.2 Missing Authorization via Skills Versions API

Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nduckmink

Products

Arkon

CVE-2026-111718

AipexBase through commit 690adb9 SQL Injection via /api/data/invoke

AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Kuafuai

Products

Aipexbase

CVE-2026-96542

EA Javelin Anticheat Installer Local Privilege Escalation

Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Electronic Arts

Products

Ea Javelin Anticheat (ea Javelin Anticheat Installer)

CVE-2026-109369

WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves and arbitrary other users edit access to every booking form on the site by overwriting the user_permission meta that governs the plugin's own access-control list. Exploitation requires the attacker to have already been delegated edit rights on at least one booking form, as this delegation both downgrades the submenu capability to 'read' (making the edit page accessible) and allows them to harvest a valid wpbs_edit_form nonce that will pass validation against any other form_id.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Murgroland Wordpress-extensions

Products

Wp Booking System – Booking Calendar Wp Booking System

CVE-2026-107692

War Thunder Account Impersonation

The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and decompress this packet to reveal the plaintext JSON payload. This vulnerability allows for temporary authenticated impersonation, enabling an attacker to access game services and certain user data (such as email address and displayed phone number) as the affected user. While this allows for unauthorized access to gameplay, it does not facilitate full account takeover, as it cannot be used to modify account security settings, change passwords, bypass two-factor authentication for account management, or access financial information.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Gaijin Entertainment

Products

War Thunder

CVE-2026-42025

HTTP Stack‑Based Buffer Overflow in Totolink X2000R DHCP DNS Setup Exposes Arbitrary Code Execution

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

X2000r

CVE-2026-113876

SmileCDR HAPI FHIR unauthorized read

SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Smilecdr

Products

Hapi Fhir

CVE-2026-79844

Authentication Bypass Leading to Remote Code Execution in AOS-10

Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79847

Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10

Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79848

Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79849

Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79850

Authentication Bypass Leading to Remote Code Execution in AOS-8

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79851

Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10

Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete system compromise.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79852

Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface

A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79855

Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise

An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compromise of the AOS-8 host.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79888

Unauthenticated Buffer Overflow allows Remote Code Execution in web interface

A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-110236

KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.

CVSS 4.0 · 7.1 High EPSS 1.0% KEV · Not listed

Vendors

Kde

Products

Dolphin

CVE-2026-110231

muCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP

muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized_keys that, when extracted to FTP or SFTP folders, create or overwrite files writable by the user's remote account.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Mucommander

Products

Mucommander

CVE-2026-110225

Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route

Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata addresses and trigger ThumbnailsController::ajaxUpdate or saving to send blind GET requests, with open_shaarli exposing this to any visitor.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Shaarli Project

Products

Shaarli