CVE-2026-70622

tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Composefs

Products

Tar-rs

CVE-2026-48159

use-reducer-async was vulnerable to malicious code execution via compromised commits

use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code on developer machines during `npm install`. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and `npm install` against an affected checkout will still execute the code today. The package was not published to npm. `src/install.js` was added and wired into the `postinstall` script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user's permissions. Those who ran `npm install` against an affected checkout on a developer machine on or after 2026-05-18 16:29:52 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity since 2026-05-18 16:29:52, and clean local clones.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Dai-shi

Products

Use-reducer-async

CVE-2026-18348

Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Rapid7

Products

Velociraptor

CVE-2026-8158

Signed Video Framework Buffer Overflow Causes Crash

The Signed Video Framework contained a  buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Axis Communications Ab

Products

Axis File Player Signed Media Verifier Signed Video Framework

CVE-2026-6181

Authentication Bypass in Axis Device Configuration Framework

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Axis Communications Ab

Products

Axis Os

CVE-2026-5303

Time-of-Check to Time-of-Use Race Condition in ACAP Framework Enables Privilege Escalation on Axis OS

The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Axis Communications Ab

Products

Axis Os

CVE-2026-67591

Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Qpid Proton-j Qpid Protonj2

CVE-2026-67592

Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Qpid Proton-j Qpid Protonj2

CVE-2026-0673

Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bdthemes Wordpress

Products

Element Pack Addons For Elementor Wordpress

CVE-2026-18473

WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdirectorykit

Products

Wordpress Wp Directory Kit

CVE-2026-19350

Dolibarr ERP TakePOS invoice.php fail authorization

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dolibarr

Products

Erp Erp Crm

CVE-2026-19379

EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS 2.0% KEV · Not listed

Vendors

Efm Iptime

Products

Iptime Ax8004m Ax8004m

CVE-2026-17541

Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Filemanagerpro Wordpress

Products

File Manager Wordpress

CVE-2026-17542

Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector

The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Filemanagerpro Wordpress

Products

File Manager Wordpress

CVE-2026-19053

ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter

The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Prosolution Wordpress

Products

Prosolution Wp Client Wordpress

CVE-2026-57279

Cross‑Site Scripting Allowing Arbitrary Script Execution in Cybozu Garoon

Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Cybozu

Products

Cybozu Garoon

CVE-2026-72577

NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Vendors

Nasa

Products

Fprime

CVE-2026-59686

Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.

CVSS 3.1 · 8.4 High EPSS 1.7% KEV · Not listed

Vendors

Progress

Products

Connection Manager For Objectscale Ecs Connection Manager Loadmaster and 3 more

CVE-2026-59687

Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.

CVSS 3.1 · 8.4 High EPSS 1.7% KEV · Not listed

Vendors

Progress

Products

Connection Manager For Objectscale Ecs Connection Manager Loadmaster and 3 more

CVE-2026-59688

Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.

CVSS 3.1 · 8.4 High EPSS 1.7% KEV · Not listed

Vendors

Progress

Products

Connection Manager For Objectscale Ecs Connection Manager Loadmaster and 3 more