CVE-2024-44004

WordPress WPCargo Track & Trace plugin <= 8.0.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection. This issue affects WPCargo Track & Trace: before 8.0.4.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Wptaskforce

Products

Track \& Trace Wpcargo Track \& Trace

CVE-2024-14045

OpenBoxes Product Supplier Edit Controller RoleInterceptor.groovy improper authorization

A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.3 is able to resolve this issue. This patch is called f767ac1a5987d4865d9f158c6a967680f8e45468. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openboxes

Products

Openboxes

CVE-2026-19957

graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fetch server-side request forgery

A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpoint. Such manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Graphlit

Products

Graphlit-mcp-server

CVE-2026-54735

prebid-server's request forgery vulnerability allows for possible host environment data extraction

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Prebid

Products

Prebid-server Prebid Server

CVE-2026-74787

Scriban before 7.0.0 Uncontrolled Recursion via object.to_json

Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the hosting .NET process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-73062

Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication

Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-73057

stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Stoatchat

Products

Stoatchat

CVE-2026-19932

DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection

A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project confirms, that "it’s being processed".

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Defaultfuction

Products

Notice-system-managent

CVE-2026-75774

karakeep-app karakeep OAuth Sign-In auth.ts improper authentication

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Karakeep-app

Products

Karakeep

CVE-2026-60112

AIT-GUI < 2.5.1 Missing Authentication via Sessions.create()

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Nasa Nasa-ammos

Products

Ait Gui Ait-gui

CVE-2026-60113

AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes

AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Nasa Nasa-ammos

Products

Ait Dsn Ait-dsn

CVE-2026-11383

Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Aix I Tivoli System Automation Application Manager and 4 more

CVE-2026-11707

Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Aix I Tivoli System Automation Application Manager and 4 more

CVE-2026-61899

Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Tapestry

CVE-2026-50523

Microsoft PowerShell Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Powershell

CVE-2026-75104

Hugging Face Transformers Path Traversal via Checkpoint Index

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Huggingface

Products

Transformers

CVE-2026-75012

TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference

A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Password Configuration Handler. The manipulation leads to null pointer dereference. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

Ex1200l

CVE-2026-65822

ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-35219

Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. This issue is fixed in version 3.41.3.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Budibase

Products

Budibase

CVE-2026-73633

Apache Struts: Unbounded read of a JSON request body

Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use it, or use it without enabling JSON request-body handling, are not affected. This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1. Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Struts