CVE-2026-14979

IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack

IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Engineering Lifecycle Management

CVE-2026-66301

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365

CVE-2026-39833

Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Ssh

CVE-2026-73281

openssh: OpenSSH: ssh-agent allows remote execution of local operations

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-65769

Microsoft Teams iOS Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Teams

CVE-2026-19075

All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Plugins360 Wordpress

Products

All-in-one Video Gallery Wordpress

CVE-2026-18030

Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms

The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account. Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Bricksforge Wordpress

Products

Bricksforge Wordpress

CVE-2026-17435

File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files

File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, then the rotate method assumes that the file is absent (since the existence check is against the target), and does not rotate it. But it touches the file, which creates the target. An attacker that has the ability to create the symlink can use this to create an arbitrary file with permissions of the process rotating the files (which may be different from the process that normally writes to the log file that is being rotated). Note that the touch option is disabled by default.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Rrwo

Products

File::rotate::simple

CVE-2026-15238

Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Motopress Hotel Booking Wordpress

Products

Motopress Hotel Booking Wordpress

CVE-2026-12971

LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Learnpress Wordpress

Products

Learnpress Wordpress

CVE-2026-12001

Hardcoded Credential Vulnerability in Multiple TP-Link Router Models

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5).  Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Archer C20 V6 Archer Mr200 V5 Tl-wr845n V4 and 1 more

CVE-2026-62829

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2019

CVE-2026-19142

chromium-browser: Google Chrome: Remote code execution via use after free in Views

Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-19144

chromium-browser: Google Chrome: Arbitrary code execution via crafted HTML page

Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-19147

chromium-browser: Google Chrome: Sandbox escape via use-after-free vulnerability in Aura

Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Google Linux

Products

Chrome Linux Kernel

CVE-2026-69306

Visual Studio Code Security Feature Bypass Vulnerability

Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-65811

Power BI Remote Code Execution Vulnerability

Improper input validation in Power BI allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Power Bi Report Server

CVE-2026-18860

Velociraptor incorrect Org deletion permissions check

Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org. This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Rapid7

Products

Velociraptor

CVE-2026-16955

AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Ai Engine Project Wordpress

Products

Ai Engine Wordpress

CVE-2026-16953

AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie

The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ai Engine Project Wordpress

Products

Ai Engine Wordpress