CVE-2026-118208

Microsoft Exchange Server Spoofing Vulnerability

Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Se

CVE-2026-127211

MultiVendorX WordPress Plugin < 5.0.22 Broken Access Control via stores REST Route

MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the store_owner role possessing the edit_stores capability and missing per-store ownership checks. Attackers can exploit the insecure direct object reference in the visitorMap handler and other flag handlers to retrieve other stores' contact emails, pending withdrawal amounts, onboarding and registration data, deactivation reasons, and visitor analytics, resulting in a cross-tenant confidentiality breach.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-112809

Windows Composite Image File System Information Disclosure Vulnerability

Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 26h1 Windows 11 26h1

CVE-2026-91873

Improper Certificate Validation in Dell OpenManage Ansible Modules

Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACRedfishAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125438

WordPress RepairBuddy plugin <= 4.1235 - Broken Access Control vulnerability

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Webful Creations Wordpress-extensions

Products

Repairbuddy Repairbuddy

CVE-2026-124752

WordPress Element Pack Elementor Addons plugin <= 10.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bdthemes Wordpress-extensions

Products

Element Pack Elementor Addons Element Pack Elementor Addons

CVE-2026-125437

WordPress Simply Schedule Appointments plugin <= 1.6.13.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.13.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nsquared Wordpress-extensions

Products

Simply Schedule Appointments Simply Schedule Appointments

CVE-2026-124416

WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ahmad Wordpress-extensions

Products

Wp Job Portal Wp Job Portal

CVE-2026-95953

Windows Graphics Kernel Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Office Office 365 Office Macos 2021 and 14 more

CVE-2026-114369

Security Issue CVE-2026-114369 - Resource exhaustion (denial of service) vulnerability in the WebSocket handshake handling of QWebSocket and QWebSocketServer impacts Qt Framework

Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt Qt Framework Qtwebsockets

CVE-2026-113574

CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

C2patool Content Credentials Rust Sdk

CVE-2026-123267

CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

C2patool Content Credentials Rust Sdk

CVE-2026-123261

CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

C2patool Content Credentials Rust Sdk

CVE-2026-123262

CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

C2patool Content Credentials Rust Sdk

CVE-2026-122098

CAI Content Credentials | Improper Certificate Validation (CWE-295)

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

C2patool Content Credentials Rust Sdk

CVE-2026-113572

CAI Content Credentials | Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

CAI Content Credentials is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

C2patool Content Credentials Rust Sdk

CVE-2026-122097

CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Adobe

Products

C2patool Content Credentials Rust Sdk

CVE-2026-113573

CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

C2patool Content Credentials Rust Sdk

CVE-2026-118484

CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Adobe

Products

C2patool Content Credentials Rust Sdk

CVE-2026-127209

Xiaomi Mi Browser < 14.66.0 Path Traversal via ThirdDocViewerActivity

Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExternalFile.copyFromUri() copies content provider streams using an unsanitized filename from the _display_name column without basename reduction or canonical-path checks. A zero-permission co-resident malicious application can supply a crafted content provider with a _display_name containing .. sequences to make the browser write attacker-controlled bytes to an arbitrary path within its external storage directory, escaping the intended cache_docs staging location without requiring user interaction.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—