CVE-2026-89205

Authenticated Privilege Escalation to Schedule Unauthorized Operations in RUGGEDCOM CROSSBOW

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated attacker with minimal privileges to schedule unauthorized operations on devices.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Siemens

Products

Ruggedcom Crossbow

CVE-2026-96266

IBM Power Systems Firmware Buffer Overflow

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Powervm Hypervisor

CVE-2026-96265

IBM Power Systems Firmware Improper Memory Buffer Restriction

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Powervm Hypervisor

CVE-2026-96264

IBM Power Systems Firmware Buffer Overflow

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Powervm Hypervisor

CVE-2026-96263

IBM Power Systems Firmware Buffer Overflow

IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Powervm Hypervisor

CVE-2026-96262

IBM Power Systems Firmware Buffer Overflow

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Powervm Hypervisor

CVE-2026-96012

IBM Db2 Mirror for i Privilege Escalation

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Mirror For I

CVE-2026-89269

WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-78404

IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2026-12780

AOMEI Backupper Kernel Driver amwrtdrv.sys access control

A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in the library amwrtdrv.sys of the component Kernel Driver. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Aomei

Products

Backupper

CVE-2026-108609

JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech input, voice settings, timestamps, and generated audio file names and paths stored in Redis.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg-boot Jeecg Boot

CVE-2026-108604

Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification

Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, or PostgreSQL query_to_xml with embedded DELETE to modify data without approval prompts.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Tabularisdb

Products

Tabularis

CVE-2026-108598

Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Floci-io

Products

Floci

CVE-2026-108593

9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and newlines to add hooks_auto_accept and a hooks.post_llm_call shell command, which Hermes Agent executes without approval after an LLM call.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Decolua

Products

9router

CVE-2026-108555

PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header

PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Schlagmichdoch

Products

Pairdrop

CVE-2026-108549

cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Chenhg5

Products

Cc-connect

CVE-2026-108268

enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session

Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Privasys

Products

Enclave-os-virtual

CVE-2026-108265

enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session

Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Privasys

Products

Enclave-os-mini

CVE-2026-108261

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tina

Products

App Tinacms

CVE-2026-108162

Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Smp46

Products

Pingvin-share-x