CVE-2026-95107

Module object allocation size overflow corrupts the manager object pool

A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a `ULONG` wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx

CVE-2026-86471

Apache CouchDB: Admin credentials leading to code execution as operating system user

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Couchdb

CVE-2026-90797

Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Couchdb

CVE-2026-90798

Apache CouchDB: Replicator follows redirects indefinitely

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

CVSS 4.0 · 0.6 Low EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Couchdb

CVE-2026-90799

Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Couchdb

CVE-2026-113594

Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload limits, or toggle plugin loading to deny service to other members.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sharkord

Products

Sharkord

CVE-2026-113607

Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jleyva

Products

Moodle-block Configurablereports

CVE-2026-90800

Apache CouchDB: Auth bypass in prefixed _users and _replicator databases

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

CVSS 4.0 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Couchdb

CVE-2026-107755

Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs

Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Couchdb

CVE-2026-113651

ApostropheCMS: Path traversal in uploadfs

ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Apostrophecms

Products

Apostrophecms Uploadfs

CVE-2026-113666

ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Apostrophecms

Products

Apostrophecms Db-connect

CVE-2026-113671

ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local relative storage with no trusted global base URL. The server resolves the fixed uploads path against a request-controlled Host-derived origin, enabling bounded server-side requests to an attacker-selected host, port, and HTTP origin, but not arbitrary-path retrieval or the stored-provider and absolute-storage configurations. This issue is fixed in AI helper 1.0.0-beta.13.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apostrophecms

Products

Ai-helper Apostrophecms

CVE-2026-94131

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Acymailing Acymailing.com

Products

Acymailing Acymailing.com Acymailing Extension For Joomla

CVE-2026-94132

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PHP file into the web root.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed

Vendors

Acymailing Acymailing.com

Products

Acymailing Acymailing.com Acymailing Extension For Joomla

CVE-2026-97160

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVSS 4.0 · 9.4 Critical EPSS 1.3% KEV · Not listed

Vendors

Lomart Lomart.fr

Products

Up Up Plugin For Joomla

CVE-2026-97161

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Lomart Lomart.fr

Products

Up Up Plugin For Joomla

CVE-2026-96656

Plex Media Server arbitrary file write

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

CVSS 4.0 · 8.6 High EPSS 19.8% KEV · Listed

Vendors

Plex

Products

Media Server

CVE-2026-96655

Plex Media Server arbitrary-host SSRF

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

CVSS 4.0 · 5.3 Medium EPSS 10.7% KEV · Listed

Vendors

Plex

Products

Media Server

CVE-2026-96654

Plex Media Server URL injection

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

CVSS 4.0 · 6.9 Medium EPSS 12.7% KEV · Listed

Vendors

Plex

Products

Media Server

CVE-2026-96652

Plex Media Server SSRF

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

CVSS 4.0 · 5.3 Medium EPSS 11.9% KEV · Listed

Vendors

Plex

Products

Media Server