CVE-2026-110204

Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution

Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Roocode

Products

Roo-code Roo Code

CVE-2026-12613

Insecure Deserialization Leading to Remote Code Execution in Ministry of Justice's UYAP Document Editor

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection. This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ministry Of Justice

Products

Uyap Document Editor

CVE-2026-18390

Command Injection in Ministry of Justice's UYAP Document Editor

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection. This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Ministry Of Justice

Products

Uyap Document Editor

CVE-2026-109667

Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-109662

Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that executes in the browser sessions of staff who review the stored record.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-109657

Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name

Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-109652

Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-109647

Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the ERPNext database.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-109642

Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned role permits.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-109637

Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification

Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-109632

Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-109627

Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role permits.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-109622

Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond their permitted role, compromising data integrity.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-109609

Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the ERPNext database.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-108940

EricLBuehler Mistral.rs handlers.rs calibration_apply path traversal

A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument save_cimatrix results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.9.4 is sufficient to fix this issue. The patch is named 8c81056712709b4845ec6d9531e4d35bab4a367c. It is suggested to upgrade the affected component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ericlbuehler

Products

Mistral.rs

CVE-2026-108936

Edimax BR-6208AC QoS Page formQoS cross site scripting

A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formQoS of the component QoS Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Edimax

Products

Br-6208ac Br-6208ac Firmware

CVE-2025-71432

Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2022-2509

gnutls: Double free during gnutls_pkcs7_verify

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed

Vendors

Debian Fedoraproject Gnu and 1 more

Products

Debian Linux Fedora Gnutls and 1 more

CVE-2022-2503

Linux Kernel LoadPin bypass via dm-verity table reload

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2022-2327

Use-after-free in io_uring ad work_flags in Linux Kernel

io_uring use work_flags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing IORING_OP. Some operations are missing some types, which can lead to incorrect reference counts which can then lead to a double free. We recommend upgrading the kernel past commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel H300s H300s Firmware and 8 more