CVE-2026-108071

Improper Multi-Factor Authentication Validation Allows Authentication Bypass

Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tsplus

Products

Tsplus Remote Access

CVE-2026-109728

Use-after-free in the DOM: Animation component

Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-85425

MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process user.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-85427

MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE

MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSION_FILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run entries that pAntler parses and executes via execvp() without authentication validation.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Themoos

Products

Essential-moos

CVE-2026-85428

MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write

MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables including actuator and override commands without authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Themoos

Products

Core-moos

CVE-2026-109605

SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization

A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Simple Cafe Billing System

CVE-2026-106327

chromium-browser: Incorrect authorization in Core

Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-102402

Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode

The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-70259

Microsoft Office SharePoint Information Disclosure Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server

CVE-2026-102988

Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)

Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpaceEndpoint in apps/api/plane/space/views/issue.py, pass the user-controlled order_by parameter through order_issue_queryset in apps/api/plane/utils/order_queryset.py to Django's order_by without allowlist validation. An attacker can use double-underscore relationship traversal to reference arbitrary related model fields, revealing database schema details through errors and potentially disclosing field values through differential ordering. This issue is fixed in version 1.4.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Makeplane

Products

Plane

CVE-2026-85429

MOOS-IvP through 24.8.1 uFldNodeComms Node Message Source Spoofing

MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without validation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mit Moos-ivp

Products

Moos-ivp Moos-ivp

CVE-2026-85430

MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing

MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local MOOS community under spoofed identities, or send malformed datagrams to crash the pShare process.

CVSS 4.0 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Themoos

Products

Essential-moos

CVE-2026-85431

MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injection

MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen. Attackers can send crafted UDP packets to the configured port to inject arbitrary variables into the local MOOS community with spoofed source and community identifiers.

CVSS 4.0 · 8.7 High EPSS 3.4% KEV · Not listed

Vendors

Themoos

Products

Essential-moos

CVE-2026-87676

Stack Buffer Overflow in Brocade Fabric OS Certificate Parser Causes DoS

A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. When parsing uploaded X.509 PEM certificates for management display, the system improperly validates the length of the Authority Key Identifier (AKI) extension before copying string tokens into an internal memory buffer. An authenticated user with administrative privileges to import custom certificates can supply a certificate containing an intentionally oversized AKI extension. When the system processes or renders the certificate attributes, this can trigger a stack memory corruption leading to a denial-of-service (DoS) condition by crashing the management daemon.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Brocade

Products

Fabric Operating System Fabric Os

CVE-2026-87678

Input Validation Flaw in Brocade Fabric OS Web Management Allows Injection of Web Server Directives Leading to Denial of Service

An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated administrator—or an attacker capable of supplying crafted FA configuration files during an import routine—can inject arbitrary web server directives. This can lead to service denial by preventing the web management daemon from starting, or potentially alter web server security controls.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Brocade

Products

Fabric Operating System Fabric Os

CVE-2026-87684

Stack-Based Buffer Overflow in Brocade Fabric OS SNMP Daemon

A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of the string. A remote, unauthenticated attacker (under default configuration) can exploit this vulnerability by sending a specially crafted SNMPv3 packet, leading to memory corruption, daemon crash (Denial of Service), or potential arbitrary code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Broadcom Brocade

Products

Fabric Operating System Fabric Os

CVE-2026-103904

Stored XSS Vulnerability in JTL-Shop

The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticated remote attacker can thereby inject script code that is executed in the browser session of an administrator viewing the consent statistics page, allowing actions to be performed with the administrator's privileges.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-103905

Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which deactivates all installed plugins and their functionality, such as payment and shipping integrations, resulting in a shop-wide denial of service. The attack requires a single request and can be automated against many installations.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-108070

Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access

A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tsplus

Products

Tsplus Remote Access

CVE-2026-85432

MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Themoos

Products

Core-moos