CVE-2026-128046

OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options

OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-128047

OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key

OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit confirmation key via the unrate-limited confirmAction endpoint to log in as pending customers, or predict administrator reset tokens after recovering generator state.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-128048

OpenMage magento-lts before 20.18.2 Information Disclosure via Email Template getConfig

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and parent paths. Administrators with Transactional Emails access can preview a crafted template to expose PayPal, payment gateway, and carrier credentials.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-128049

OpenMage Magento LTS before 20.18.2 CSRF via OAuth Authorization Confirm

OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can lure a logged-in administrator or customer to a crafted confirm URL that authorizes the attacker's request token, then exchange it at /oauth/token for a persistent REST API access token bound to the victim.

CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-128051

OpenMage magento-lts before 20.18.2 Stored XSS via Product Name in MSRP Popup

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages.

CVSS 4.0 · 4.8 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-128052

OpenMage magento-lts before 20.19.0 Block Whitelist Bypass via {{layout}} Directive

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's {{layout}} directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed {{layout}} with arbitrary handles to render disallowed blocks and disclose limited information.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-128053

OpenMage magento-lts before 20.18.2 Reflected XSS via Error Pages SCRIPT_NAME

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT_NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT_NAME from the request path, executing script in the storefront origin within victims' browsers.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-128237

Scapy before 2.8.0 Denial of Service via Quadratic BER OID Decoding

Scapy before 2.8.0 contains a denial of service vulnerability in BER_num_dec() and BERcodec_OID.do_dec() that allows remote attackers to exhaust CPU by supplying oversized OID arcs. Attackers can send ASN.1/BER data with many base-128 continuation bytes to cause quadratic CPU consumption or an uncaught ValueError crash on Python 3.11+.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Scapy

Products

Scapy

CVE-2026-128238

Scapy before 2.8.0 Uncontrolled Recursion DoS via BER SEQUENCE Decoder

Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Scapy

Products

Scapy

CVE-2026-128239

GPAC through 26.07.0 NULL Pointer Dereference via MPEG-4 Form Handlers

GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a non-existent group, crashing tools like MP4Box during chapter import for denial of service.

CVSS 4.0 · 6.8 Medium EPSS n/a KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2026-128240

GPAC through 26.07.0 Use-After-Free in gf_sg_proto_del During Scene Teardown

GPAC through 26.07.0 contains a use-after-free vulnerability in gf_sg_proto_del() in src/scenegraph/vrml_proto.c because gf_sg_reset() frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, to trigger freed memory access and crash the process.

CVSS 4.0 · 6.8 Medium EPSS n/a KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2026-128241

libexpat xmlwf through 2.10.0 Symlink Following via -d Output Directory

The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files with fopen("wb"), which follows symbolic links. Local attackers with write access to the output directory can plant a symlink at the expected output name to truncate or overwrite files writable by the xmlwf user.

CVSS 4.0 · 4.1 Medium EPSS n/a KEV · Not listed

Vendors

Libexpat Project

Products

Libexpat

CVE-2026-128242

actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Actix

Products

Actix-http Actix-web

CVE-2026-128328

Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoDirectories repoPath

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-128329

Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoFile

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to read arbitrary files by supplying ../ sequences in the filePath of patch.readRepoFile. Attackers with service read permission can read /etc/shadow, SSH private keys, and secret environment files on the Dokploy host or managed remote servers.

CVSS 4.0 · 8.3 High EPSS n/a KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-128330

Miniflux before 2.3.5 Insufficient Session Expiration After Password Change

Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading integration credentials, creating API keys, or registering passkeys.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed

Vendors

Miniflux Project

Products

Miniflux

CVE-2026-128331

Miniflux before 2.3.5 Password Change Without Current Password via Settings Form

Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account.

CVSS 4.0 · 6 Medium EPSS n/a KEV · Not listed

Vendors

Miniflux Project

Products

Miniflux

CVE-2026-128332

listmonk 6.0.0 before 7.0.0-beta.2 TOTP Brute-Force via /admin/login/twofa

Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, each allowing 15 more guesses, gaining sessions for 2FA-protected accounts including Super Admin.

CVSS 4.0 · 9.1 Critical EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-128333

listmonk 6.0.0 before 7.0.0-beta.2 2FA Bypass via Password Reset Flow

listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a password reset. Attackers who can complete a reset, such as by reading the victim's reset email, obtain fully authenticated sessions including Super Admin without the TOTP code.

CVSS 4.0 · 9.1 Critical EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-128334

listmonk 6.2.0 before 7.0.0-beta.2 Missing Authentication via Azure Bounce Webhook

listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/service/azure to blocklist, unsubscribe, or delete arbitrary subscribers.

CVSS 4.0 · 6.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—