CVE-2026-14177

User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure

Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ikas Technology

Products

E-commerce Infrastructure

CVE-2026-15219

IDOR in SFM Software's Costifier

Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Sfm Software Technologies

Products

Costifier

CVE-2026-15575

Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier

Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sfm Software Technologies

Products

Costifier

CVE-2026-105664

Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy

The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication or authorization - to distinguish valid ID values from the full 10-digit numeric search space. Combined with the absence of meaningful rate limiting on this endpoint, this discrepancy constitutes an enumeration oracle, enabling an attacker to discover registered devices at scale.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Guangzhou Juan Iot Technology

Products

Eseecloud App Eseecloud Firmware

CVE-2026-105273

J4Care dcm4che Loop with Unreachable Exit Condition

MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

J4care

Products

Dcm4chee-arc-light

CVE-2026-101021

J4Care dcm4che Inefficient Algorithmic Complexity

MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

J4care

Products

Dcm4chee-arc-light

CVE-2026-105279

J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

J4care

Products

Dcm4chee-arc-light

CVE-2026-105667

J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

J4care

Products

Dcm4chee-arc-light

CVE-2026-111728

Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags via the transcodeHwAccelCustomSettings field, which are appended verbatim to the ffmpeg argument vector. Attackers can trigger execution via the mediastream request and HLS playlist endpoints to achieve arbitrary file write and file truncation on the host as the user running seanime, with the injected input options also enabling potential arbitrary local file read and outbound data exfiltration through ffmpeg's protocol handlers.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

5rahim

Products

Seanime

CVE-2026-96424

Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Ubports

Products

Lomiri-download-manager

CVE-2026-96425

Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ubports

Products

Lomiri-download-manager

CVE-2026-111612

netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Qaiu

Products

Netdisk-fast-download

CVE-2026-111616

Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API

Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oqtane

Products

Oqtane Framework

CVE-2026-111617

WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mgdaaslab

Products

Wharttest

CVE-2026-111626

Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers

Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Webreaper

Products

Damselfly

CVE-2026-111661

waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wayn111

Products

Waynboot-mall

CVE-2026-111676

Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Faveosuite Ladybirdweb

Products

Faveo-helpdesk Faveo Helpdesk

CVE-2026-111681

EFAK through 5.1.0 Privilege Escalation via /api/users REST API

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Smartloli

Products

Efak

CVE-2026-111682

EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Smartloli

Products

Efak

CVE-2026-111691

WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Wimoor-erp

Products

Wimoor