CVE-2026-109363

Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction

ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Zcashfoundation Zfnd

Products

Zebra Zebra

CVE-2026-109359

Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery

Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Edgelesssys

Products

Contrast

CVE-2026-109358

Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation

Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Edgelesssys

Products

Contrast

CVE-2026-109354

LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traversed channel value to view traffic and NetFlow graphs of devices outside their authorized scope.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Librenms

Products

Librenms

CVE-2026-109353

LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notifications_attribs and readable through the interface.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Librenms

Products

Librenms

CVE-2026-109349

gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gitoxidelabs

Products

Gix-date

CVE-2026-109348

Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gitoxidelabs

Products

Gix-date

CVE-2026-109344

DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks

DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cure53

Products

Dompurify

CVE-2026-109343

SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows in tables whose PERMISSIONS allow it, such as PERMISSIONS FULL.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Surrealdb

Products

Surrealdb

CVE-2026-109339

SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing the server and denying service to all namespaces and databases.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Surrealdb

Products

Surrealdb Surrealism-runtime

CVE-2026-109338

SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Surrealdb

Products

Surrealdb

CVE-2026-109334

SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Surrealdb

Products

Surrealdb

CVE-2026-109333

SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH

SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known record id in a RETURN … FETCH query to read another tenant's data when table PERMISSIONS allow reads.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Surrealdb

Products

Surrealdb

CVE-2026-109329

Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php

Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Admidio

Products

Admidio

CVE-2026-109328

Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name

Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRST_NAME registration value into an unencoded data-message attribute. Attackers can register with a double-quoted event handler that executes JavaScript in an administrator's session when they hover the entry on the Manage registrations page.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Admidio

Products

Admidio

CVE-2026-109324

Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms

Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav

CVE-2026-109319

Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation

Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav-plugin-guestbook

CVE-2026-109314

Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page

Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav-plugin-login

CVE-2026-109309

SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

B3log Siyuan

Products

Siyuan Siyuan

CVE-2026-109304

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, can use create('DOMDocument').loadHTMLFile() with textContent to expose local file contents to non-admin users who can view entries.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Cms Craft Cms