CVE-2026-121350

Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. A low-privileged attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Connect

CVE-2026-108338

Apache Roller: Stored cross-site scripting through AtomPub entry tags

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Roller

CVE-2026-118409

Apache Roller: Commenter email addresses recoverable through public search

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover the email addresses of people who left approved comments. The search index stored commenter email addresses, and the public weblog search accepted queries on that field, including wildcard queries that confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later and rebuild the search index.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Roller

CVE-2026-120974

Security Advisory 0219

On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator's expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-120975

Security Advisory 0205

On affected platforms running Arista EOS with automatic certificate management configured and automatic Certificate Authority (CA) certificate retrieval enabled, a malicious packet may cause the AutoCertMgmt process to be terminated unexpectedly. Managed X.509 certificates will not be renewed automatically and may eventually expire, potentially disrupting TLS-dependent services.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-118412

Apache Roller: Disabled accounts can sign in through OpenID

Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID authentication mode are affected; later major versions do not include OpenID 2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Roller

CVE-2026-118413

Apache Roller: Stored cross-site scripting through imported blogroll links

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme printed them without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which accepts only web links on import and escapes them on output.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Roller

CVE-2026-102589

Cross-instance user impersonation through image renderer JWTs

When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Grafana Enterprise

CVE-2026-124256

WordPress Delivery & Pickup Date Time for WooCommerce plugin <= 1.3.90 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRockz Delivery &amp; Pickup Date Time for WooCommerce woo-delivery allows Stored XSS.This issue affects Delivery &amp; Pickup Date Time for WooCommerce: from n/a through 1.3.90.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120977

Security Advisory 0217

On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adjacent attacker can send a crafted DHCP packet to force the device to record a spoofed device profile. This may potentially allow the authenticated supplicant to acquire unauthorized access to a network segment with elevated privileges.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-120811

Use-After-Free in MongoDB Server Classic Query Engine Plan Cache Leads to Information Disclosure and Denial of Service

A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference to data from an earlier command can be retained in cached plan statistics. After the originating memory is freed, a subsequent diagnostic command serializing those statistics can read freed heap memory, potentially returning sensitive server process memory contents to the authenticated client. Under certain heap reuse conditions, this may also cause the server to crash.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120812

Full server crash via unbounded per-operand recursion in time-series query vectorization

An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service. Uncontrolled recursion in an internal query compilation component can lead to stack exhaustion and server process termination when processing certain queries against time-series collections.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120813

Plaintext storage of encrypted fields via duplicate keys in client-side encryption schema parsing

An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silently dropped during schema parsing under certain conditions. A party who can deliver a specially crafted schema to a user's CSFLE client may cause sensitive data intended for encryption to be stored in plaintext, bypassing confidentiality protections. Exploitation requires the ability to deliver the malicious schema to the user's client, such as through a man-in-the-middle position or an untrusted server.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120814

MultiUpdateCoordinator state replay lets a shard administrator create a persistent cluster root user

An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with elevated internal authority. Because that state is trusted rather than re-validated, operations may be carried out beyond the user's authorized scope, including changes to cluster-wide security configuration. Successful triggering this issue requires an authenticated session directly against a cluster member and can result in unauthorized access to and modification of data across the cluster.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120815

Incorrect Authorization Check in MongoDB Server Localhost Exception Leads to Unauthorized Administrative Access

An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data and credentials, unintended modification of data, and loss of availability of the server.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120816

System collection contents readable through a database change stream with showSystemEvents

A user with basic read-tier database privileges can use an option on a server-side data-change notification feature to receive the contents of certain restricted internal collections that the same user is refused on a direct read. The privilege check for the notification feature is derived only from the target namespace and does not account for the option, so no additional permission is required. This may result in unintended access to data stored in those internal collections.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120817

Post-authentication race condition in MongoDB Server geospatial schema validation

A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection validator that uses geospatial query operators. The condition can be caused by an authenticated user with write privileges, and may result in the server terminating unexpectedly.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120818

Use-After-Free in MongoDB Server JavaScript Support for Aggregation Leads to Information Disclosure

A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger this condition over the normal network protocol by submitting a single crafted aggregation request, with no additional privileges or non-default configuration. Successful triggering this issue may result in adjacent process memory contents being returned, including data that undermines memory-layout randomization, and may in some cases affect server availability.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120820

Uncontrolled Resource Consumption in MongoDB Server Per-Namespace Encrypted-Field Statistics Table Leads to Denial of Service

MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are created for any namespace supplied in a request, with no limit on the number of entries and no way to remove entries that never corresponded to a real collection. A user with basic read privileges who repeatedly issues ordinary read commands referencing arbitrary namespace names may cause the server process to retain steadily increasing amounts of memory and to slow down on the affected code path; the memory is reclaimed only by restarting the process.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120821

Post-authentication use-after-free in MongoDB Server aggregation sub-pipelines

A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipeline. The condition can be caused by an authenticated user with read privileges, and may result in the server terminating unexpectedly.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server