CVE-2026-111377

FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-111369

ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Classroomio

Products

Classroomio

CVE-2026-111350

Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API

Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group links, or rewrite group document permissions across teams.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Papermark

Products

Papermark

CVE-2026-111345

Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history plus participants' usernames, full names and email addresses.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Trudesk Project

Products

Trudesk

CVE-2026-111272

LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Libraw

Products

Libraw

CVE-2026-111210

bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgery

A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Bitcoinj

Products

Bitcoinj

CVE-2026-111167

GNU LibreDWG through 0.14.8612 Out-of-Bounds Read in acds_private AcDs Decoder

GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property type value to crash dwgread, dwg2dxf, or any application using LibreDWG.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu

Products

Libredwg

CVE-2026-111162

WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmp

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing applications or exposing heap bytes through WildMidi_GetInfo().

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mindwerks

Products

Wildmidi

CVE-2026-111152

Game Music Emu (libgme) through 0.6.5 Heap Out-of-Bounds Read via AY Loader

Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via gme_track_info or gme_start_track, crashing libgme consumers.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Game-music-emu Project

Products

Game-music-emu

CVE-2026-111142

Zziplib through 0.13.80 Out-of-Bounds Read via zzip_disk_findfirst

Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Gdraheim

Products

Zziplib

CVE-2026-111132

GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element

GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome

Products

Libgxps

CVE-2026-111127

catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string

catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose adjacent memory through xls2csv output or crash the process.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Fossies

Products

Catdoc

CVE-2026-110888

WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-110863

Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers

Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Better-auth

Products

Better-auth\/sso

CVE-2026-110853

n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON

n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-110848

n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named __proto__ through the API and invoke the connect-nodes operation to pollute the global object prototype, disrupting the instance until restart.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-110843

n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the record key. Unauthenticated attackers can send identifiers differing only in their query string to create unlimited first-party client records that bypass the registration cap, growing the database until the disk fills.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-110838

FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-110833

FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy

FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and exhausting proxy memory.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-110775

Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access

Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nexent

Products

Nexent