CVE-2026-111162

WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmp

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing applications or exposing heap bytes through WildMidi_GetInfo().

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mindwerks

Products

Wildmidi

CVE-2026-111152

Game Music Emu (libgme) through 0.6.5 Heap Out-of-Bounds Read via AY Loader

Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via gme_track_info or gme_start_track, crashing libgme consumers.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Game-music-emu Project

Products

Game-music-emu

CVE-2026-111142

Zziplib through 0.13.80 Out-of-Bounds Read via zzip_disk_findfirst

Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Gdraheim

Products

Zziplib

CVE-2026-111132

GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element

GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome

Products

Libgxps

CVE-2026-111127

catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string

catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose adjacent memory through xls2csv output or crash the process.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Fossies

Products

Catdoc

CVE-2026-110888

WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-110863

Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers

Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Better-auth

Products

Better-auth\/sso

CVE-2026-110853

n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON

n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-110848

n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named __proto__ through the API and invoke the connect-nodes operation to pollute the global object prototype, disrupting the instance until restart.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-110843

n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-110838

FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-110833

FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy

FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-110775

Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access

Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nexent

Products

Nexent

CVE-2026-110628

Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Kan

Products

Kan

CVE-2026-110623

Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Papermerge

Products

Papermerge

CVE-2026-109893

WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-109448

psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters

Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Psqlodbc

CVE-2026-109160

PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect

A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Publiccms

Products

Publiccms

CVE-2026-109153

MosaicML Composer Checkpoint Extraction checkpoint.py tarball.extractall path traversal

A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mosaicml

Products

Composer

CVE-2026-109143

calcom cal.com/cal.diy Credentials delete credentials.delete privileges management

A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Calcom

Products

Cal.com Cal.diy