CVE-2026-111560

OS Command Injection in Barracuda Appliances

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

CVSS 4.0 · 8.6 High EPSS 9.1% KEV · Listed

Vendors

Barracuda Barracuda Networks

Products

Email Security Gateway 300 Email Security Gateway 300 Firmware Email Security Gateway 400 and 57 more

CVE-2026-126995

tjake Jlama SafeTensorIndex.java SafeTensorIndex.loadWeights path traversal

A vulnerability was found in tjake Jlama up to 0.8.4/0.9.0-beta. Affected by this vulnerability is the function SafeTensorIndex.loadWeights of the file jlama-core/src/main/java/com/github/tjake/jlama/safetensors/SafeTensorIndex.java. Performing a manipulation of the argument weight_map results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tjake

Products

Jlama

CVE-2026-123481

WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123480

WordPress Display Eventbrite Events plugin <= 6.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fullworks Plugins Display Eventbrite Events widget-for-eventbrite-api allows Stored XSS.This issue affects Display Eventbrite Events: from n/a through 6.9.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-100290

Double free after allocation failure in regcomp and regexec

The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path. An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

The Gnu C Library

Products

Glibc

CVE-2026-92083

Pardus Image Writer Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's pardus-image-writer

Missing Authorization vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü pardus-image-writer allows Privilege Escalation. This issue affects pardus-image-writer: before 0.9.0.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-124018

Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission

Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-106152

External Control of Configuration Setting in Telerik Report Server

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Telerik Report Server Telerik Report Server

CVE-2026-0330

PAN-OS: Authenticated Remote Code Execution (RCE) in Panorama

A remote code execution (RCE) vulnerability in Palo Alto Networks PAN-OS® software on Panorama enables an authenticated administrator with network access to execute arbitrary code with root privileges. The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Cloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Palo Alto Networks Paloaltonetworks

Products

Cloud Ngfw Pan-os Prisma Access and 3 more

CVE-2026-0329

PAN-OS: Buffer Overflow Vulnerability

A buffer overflow vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Cloud NGFW and Panorama are not affected by this vulnerability.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Palo Alto Networks Paloaltonetworks

Products

Cloud Ngfw Pan-os Prisma Access and 3 more

CVE-2026-0328

PAN-OS: User Impersonation through GlobalProtect Portal

Authentication bypass vulnerabilities in the GlobalProtect™ portal and gateway of Palo Alto Networks PAN-OS® software enables an unauthenticated user to bypass security restrictions and establish an unauthorized VPN connection. Panorama, Cloud NGFW, and Prisma® Access are not affected by this vulnerability.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Palo Alto Networks Paloaltonetworks

Products

Cloud Ngfw Pan-os Prisma Access and 3 more

CVE-2026-0326

PAN-OS: Buffer Overflow Vulnerability in Protocol and Service Processing

A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption. Panorama and Prisma® Access are not affected by this vulnerability.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed

Vendors

Palo Alto Networks Paloaltonetworks

Products

Cloud Ngfw Pan-os Prisma Access and 3 more

CVE-2026-0325

PAN-OS: GlobalProtect Authorization Bypass Vulnerability

An authorization bypass vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated attacker with valid GlobalProtect credentials to bypass IP address restrictions and circumvent network access controls that rely on source IP filtering. Cloud NGFW is not affected by this vulnerability.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed

Vendors

Palo Alto Networks Paloaltonetworks

Products

Cloud Ngfw Pan-os Prisma Access and 3 more

CVE-2026-114559

OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30431.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Originlab

Products

Origin Viewer

CVE-2026-114558

OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30738.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Originlab

Products

Origin Viewer

CVE-2026-114556

MailEnable Save Directory Traversal Arbitrary File Creation Vulnerability

MailEnable Save Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the Save method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-29161.

CVSS 3.0 · 7.4 High EPSS 1.5% KEV · Not listed

Vendors

Mailenable

Products

Mailenable

CVE-2026-110072

Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attribute

The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Photo Gallery By 10web

CVE-2026-106140

Deserialization of Untrusted Data in Telerik Reporting Report Designers

In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Telerik Reporting Telerik Reporting

CVE-2026-111760

git: Git: Arbitrary code execution via unsafe submodule metadata during recursive clones

A flaw was found in Git. Unsafe handling of submodule-related repository metadata during recursive clone operations can lead to arbitrary code execution. A remote attacker could exploit this vulnerability by supplying a crafted repository that triggers unauthorized command execution on the host system when cloned recursively.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

Git

Products

Git

CVE-2026-114466

Insufficient Granularity of Access Control in Git

Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Git

Products

Git