CVE-2026-12655

1732E ArmorBlock® - Multiple Vulnerabilities

A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-111220

Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Netgate

Products

Pfsense

CVE-2026-111168

LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter

LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Libredesk

Products

Libredesk

CVE-2026-111163

WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmi

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mindwerks

Products

Wildmidi

CVE-2026-111153

Game Music Emu (libgme) through 0.6.5 Out-of-Bounds Read via Classic_Emu::mute_voices_

Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chip_flags 0x3F, opened through gme_open_data or gme_open_file, to read past the static array during loading and cause denial of service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Game-music-emu Project

Products

Game-music-emu

CVE-2026-111146

ytnef through 2.1.2 Heap Out-of-Bounds Read via MAPIPrint in lib/ytnef.c

ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and leaking adjacent heap bytes.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ytnef Project

Products

Ytnef

CVE-2026-111143

Ansilove libansilove through 1.4.2 Out-of-Bounds Read via ansilove_xbin RLE Decoding

Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer, crashing applications that render untrusted XBIN art.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ansilove

Products

Libansilove

CVE-2026-111141

zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZIP64 Parsing

zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Gdraheim

Products

Zziplib

CVE-2026-111138

NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read in RLE8 and RLE4 Decoders

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Netsurf-browser

Products

Libnsbmp

CVE-2026-111128

Assimp through 6.0.5 NULL Pointer Dereference via Ogre Importer Bone Assignment

Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById() to return null and crash the host process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Assimp

Products

Assimp

CVE-2026-111126

catdoc through 0.95 Out-of-Bounds Read in xls2csv MULRK Record Handler

catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2csv to disclose adjacent process memory as CSV cells or crash the process.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Fossies

Products

Catdoc

CVE-2026-111123

FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updated_gen_bit, causing memory corruption and crashes.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Fluidsynth

Products

Fluidsynth

CVE-2026-110877

AdPlug through 2.4 Heap Out-of-Bounds Read via CdmoLoader::load

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via CAdPlug::factory, to read bytes beyond packed_module and potentially crash the application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Adplug Project

Products

Adplug

CVE-2026-110715

MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort

MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Artifex

Products

Mujs

CVE-2026-110378

WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-109897

WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-109776

Race condition in the XPCOM component

Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-109753

Incorrect boundary conditions in the Layout component

Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-109733

JIT miscompilation in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-109730

Integer overflow in the Graphics component

Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird