CVE-2026-103054

AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP

AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the add_tenants_to_portfolio endpoint to claim unclaimed tenants and read their security alerts, incidents, and posture metrics without consent.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Beenuar

Products

Aisoc

CVE-2026-103056

AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges.

CVSS 4.0 · 9.4 Critical EPSS 1.8% KEV · Not listed

Vendors

Beenuar

Products

Aisoc

CVE-2026-103057

AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or send unauthorized notifications to registered devices.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Beenuar

Products

Aisoc

CVE-2026-103087

Uncontrolled Recursion in Gosub Browser Engine Leads to Denial of Service

Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service (stack exhaustion and application crash) via an SVG document containing an excessive number of deeply nested elements. Because the engine does not limit the nesting depth of processed SVG nodes, rendering such a document overflows the thread stack and terminates the application. The malicious SVG can be embedded through the SRC attribute of an IMG element, and thus exploitation only requires the victim to visit an attacker-controlled web page.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gosub-io

Products

Gosub-engine

CVE-2026-78229

OS Command Injection in PFU Image Scanner Driver for Linux

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Pfu Limited

Products

Image Scanner Driver For Linux (fi Series) Image Scanner Driver For Linux (sp Series)

CVE-2026-81310

Link Following Vulnerability Allowing Arbitrary File Overwrite in PFU Image Scanner Driver for Linux

Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Pfu Limited

Products

Image Scanner Driver For Linux (fi Series) Image Scanner Driver For Linux (sp Series)

CVE-2026-86556

An information disclosure vulnerability in ZTE U30 Air product

There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zte

Products

U30 Air

CVE-2026-97150

Arbitrary PHP Code Execution via Config.php Inclusion during Addon Migration

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Basercms Users Community

Products

Bcaddonmigrator

CVE-2026-92867

pgpool-II: Pgpool-II: arbitrary code execution via out-of-bounds write

An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Pgpool Global Development Group

Products

Pgpool-ii

CVE-2026-92868

pgpool-II: pgpool-II: Authentication bypass via improper certificate validation

An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Pgpool Global Development Group

Products

Pgpool-ii

CVE-2026-92869

pgpool-II: pgpool-II: Denial of Service via out-of-bounds write

An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Pgpool Global Development Group

Products

Pgpool-ii

CVE-2026-92870

pgpool-II: pgpool-II: Denial of Service via stack-based buffer overflow

A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Pgpool Global Development Group

Products

Pgpool-ii

CVE-2026-92871

Unauthenticated NULL Pointer Dereference in Pgpool-II Watchdog Process Causes Denial of Service

A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Pgpool Global Development Group

Products

Pgpool-ii

CVE-2026-92872

pgpool-II: pgpool-II: Information disclosure via log files

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pgpool Global Development Group

Products

Pgpool-ii

CVE-2026-92873

Unauthenticated Promotion of Watchdog Nodes to Leader in Pgpool‑II

Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Pgpool Global Development Group

Products

Pgpool-ii

CVE-2026-92712

ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter

The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the permalink parameter is only passed through sanitize_url(), which does not prevent fetching attacker-controlled remote URLs whose response body — including script tags and event-handler attributes — is written verbatim to disk via file_put_contents().

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Rockiger Wordpress-extensions

Products

Reactpress Reactpress

CVE-2026-10764

Information disclosure in BVMS 4.5 up to 12.3

Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Iqsight

Products

Bvms

CVE-2026-94053

Apache MINA SSHD: LDAP injection in sshd-ldap

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure it to be used for password of public key authentication. Other Apache MINA SSHD servers are not affected. Lack of escaping LDAP filter metacharacters enabled successful authentication with username "*" and password "*". Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue by properly escaping filter parameters according to RFC 4515.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Mina Sshd

CVE-2026-96342

WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Amauri Wordpress-extensions

Products

Wpmobile.app Wpmobile.app

CVE-2026-103012

claude-code: claude-code: Security policy bypass via improper credential prioritization

Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated with the Enterprise or Team account. When the settings endpoint rejected that stored key, the session started without the organization's server-managed policy (such as permission deny rules, model restrictions and managed-only locks) or, if a previously cached copy existed on the machine, kept applying that stale copy without receiving later policy changes — while continuing to operate as the organization's account. Triggering this required local access to a device with such a stored API key; the no-policy case additionally required that no managed settings had previously been cached. Endpoint-managed (MDM or file-based) settings were not affected. Claude for Enterprise organizations were affected from version 2.0.68; Claude for Work (Team) organizations from version 2.1.38, when server-managed settings became available to them. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.1.260 or later. Thank you to Tamas Voros / NVIDIA AI Red Team for reporting this issue.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Anthropic

Products

Claude Code