CVE-2026-43849

Heap Memory Read Allows Sensitive Data Exfiltration in Advantech ADAM-3600

A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Adam-3600

CVE-2026-43847

Brute-Force Administrator Password Vulnerability in Advantech ADAM‑3600 Proprietary Protocol

A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Adam-3600

CVE-2026-43846

Stack‑Based Buffer Overflow Vulnerability in Advantech ADAM‑3600

A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Adam-3600

CVE-2026-113703

SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Giuseppe99barchetta

Products

Suggestarr

CVE-2026-113676

Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Froxlor

Products

Froxlor

CVE-2026-113612

SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Codewithcj

Products

Sparkyfitness

CVE-2026-113609

Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Bandisoft

Products

Bandizip

CVE-2026-113599

Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Modoboa

Products

Modoboa

CVE-2026-113597

Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Blinko Blinkospace

Products

Blinko Blinko

CVE-2026-113396

DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection

A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Draytek

Products

Vigor2960 Vigor2960 Firmware

CVE-2026-113388

opensource-socialnetwork Cache Settings dynamic.php input code injection

A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Opensource-socialnetwork

Products

Opensource-socialnetwork

CVE-2026-113382

arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argument plugin_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.1 can resolve this issue. The name of the patch is 04573681420295f7b327c9da3b101aed2f3cf432. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arizu-id

Products

Fast-tunnel

CVE-2026-112785

OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Opencats

Products

Opencats

CVE-2026-112782

Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav

CVE-2026-112777

Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Cms Craft Cms

CVE-2026-112772

Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Cms Craft Cms

CVE-2026-112372

H3C Magic NX15 upload importprofile path traversal

A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

H3c

Products

Magic Nx15 Magic Nx15 Firmware

CVE-2026-112360

Netis EAP930 CGI Endpoint debug return200 backdoor

A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Netis

Products

Eap930

CVE-2026-112300

DiffSK configobj __init__.py _sectionmarker redos

A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Diffsk

Products

Configobj

CVE-2026-112247

Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting

A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation of the argument NewFile can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wuxi Wubang Security Software

Products

Five-in-one Safety Production Management Information System