CVE-2026-101996

Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configured

A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG/ICCP allows an adjacent attacker to cause a denial of service via an inconsistent ICCP peer message.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Junos Os Evolved

CVE-2026-101936

Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is enabled

A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os

CVE-2026-101938

Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used

An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Junos Os Evolved

CVE-2026-101939

Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon denial of service when source-based forwarding is used

A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a configured peer sending a BGP UPDATE to cause a denial of service when an import policy with `then source-based-forwarding next-hop next-table <X>` is configured to reference a routing table that does not exist.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Junos Os Evolved

CVE-2026-101969

Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial of service when IPv6 PIM is enabled

An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Junos Os Evolved

CVE-2026-101970

Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used

A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Juniper Networks

Products

Junos Os Junos Os Evolved

CVE-2026-75872

HTML Injection in MailerUp double opt-in verification email

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first_name field of the subscription request, which is interpolated unescaped into the double opt-in verification email.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Maalfer

Products

Mailerup

CVE-2026-75859

CodeWhale before 0.8.64 Arbitrary File Read via instructions

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hmbown

Products

Codewhale

CVE-2026-74902

SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

B3log Siyuan

Products

Siyuan Siyuan

CVE-2026-75850

ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers

ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use per-type or per-group ACLs, a user with database access but only limited per-type permissions can read from and write to types they are not authorized to access by submitting requests to the batch/time-series endpoints. Deployments that rely solely on database-level access control are not affected.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Arcadedata

Products

Arcadedb

CVE-2026-75086

itsourcecode Hospital Management System viewroom.php sql injection

A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewroom.php. Such manipulation of the argument delid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Hospital Management System

CVE-2026-75914

CodeWhale before 0.8.64 Path Traversal via image_analyze symlink

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hmbown

Products

Codewhale

CVE-2026-75852

ArcadeDB MongoDB wire protocol authentication bypass cross-database

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Arcadedata

Products

Arcadedb

CVE-2026-75843

ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Arcadedata

Products

Arcadedb

CVE-2026-75838

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cure53

Products

Dompurify

CVE-2026-75829

grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection payloads that are evaluated at render time.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav

CVE-2026-75778

code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_with_multiple_condition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Task Management System

CVE-2026-75773

karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. Upgrading to version 0.33.0 is sufficient to fix this issue. The patch is identified as f7d042971d0d2bcc7119654830cf1eb93eabbf24. It is advisable to upgrade the affected component.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Karakeep-app

Products

Karakeep

CVE-2026-75130

Context7 2.1.2 Prompt Injection via Custom AI Instructions

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instructions to exfiltrate credentials from environment files to an attacker-controlled service and perform destructive file deletion on the victim's machine when the agent makes a routine library documentation request.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Uptash

Products

Context7

CVE-2026-75082

Webkul Bagisto Customer-Registration Notification Email register cross site scripting

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument first_name/last_name causes basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Webkul

Products

Bagisto