CVE-2026-18129

Cleartext Transmission of Credentials in Ivanti Endpoint Manager Prior to 2024 SU7

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.

CVSS 3.1 · 8.1 High EPSS 1.5% KEV · Not listed

Vendors

Ivanti

Products

Endpoint Manager

CVE-2026-17535

Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes

Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However, in some applications (e.g.  dead disk forensics https://docs.velociraptor.app/docs/forensic/deaddisk/ ) Velociraptor may be used on untrusted NTFS image files.  If an attacker is able to inject maliciously corrupted NTFS Volumes they can cause a crash and a Denial of Service.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Rapid7

Products

Velociraptor

CVE-2026-18640

Velociraptor directory traversal via the NewNotebook API

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files (such as ACL records, hunts etc). This can corrupt these files and cause data corruption.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rapid7

Products

Velociraptor

CVE-2026-9171

Vulnerabilities in IBM WebSphere Application affects IBM PowerVM Novalink.

IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Powervm Novalink

CVE-2026-13473

IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow

IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm Microsoft

Products

Storage Protect Storage Protect Client Windows

CVE-2026-69127

Kirby: System path exposure from error messages in the REST API

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Getkirby

Products

Kirby

CVE-2026-54635

pytonapi has a Webhook Custom Path Authentication Bypass

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup() stores bearer tokens only under the default suffix paths and never adds the custom path to the token map, so self._tokens.get(path) returns None and the authentication guard is skipped. An unauthenticated remote attacker can POST forged payloads to the custom webhook endpoint and trigger victim-defined handlers. This issue is fixed in version 2.2.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Nessshon

Products

Tonapi

CVE-2026-14501

Use of Potentially Dangerous Functionthat in IBM Db2 Genius Hub

IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Agentics Db2 Genius Hub

CVE-2026-14971

This PowerVM Novalink update is being released to address

IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misconfiguration may increase attack surface and enable unintended or unauthorized operations under non-default conditions.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Powervm Novalink

CVE-2026-14979

IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack

IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Engineering Lifecycle Management

CVE-2026-66301

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Dynamics 365

CVE-2026-39833

Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Ssh

CVE-2026-73281

openssh: OpenSSH: ssh-agent allows remote execution of local operations

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-65769

Microsoft Teams iOS Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Teams

CVE-2026-19075

All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Plugins360 Wordpress

Products

All-in-one Video Gallery Wordpress

CVE-2026-18030

Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms

The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account. Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Bricksforge Wordpress

Products

Bricksforge Wordpress

CVE-2026-17435

File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files

File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, then the rotate method assumes that the file is absent (since the existence check is against the target), and does not rotate it. But it touches the file, which creates the target. An attacker that has the ability to create the symlink can use this to create an arbitrary file with permissions of the process rotating the files (which may be different from the process that normally writes to the log file that is being rotated). Note that the touch option is disabled by default.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Rrwo

Products

File::rotate::simple

CVE-2026-15238

Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Motopress Hotel Booking Wordpress

Products

Motopress Hotel Booking Wordpress

CVE-2026-12971

LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Learnpress Wordpress

Products

Learnpress Wordpress

CVE-2026-12001

Hardcoded Credential Vulnerability in Multiple TP-Link Router Models

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5).  Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Archer C20 V6 Archer Mr200 V5 Tl-wr845n V4 and 1 more