CVE-2026-72581

duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpoint

A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling internal network scanning and access to internal services.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Duhow

Products

Xiaoai-patch

CVE-2026-72582

fastschema - Unauthenticated NULL Pointer Dereference DoS in Account Recovery Endpoint

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating it is non-nil, causing a fatal panic that terminates the entire server when a recovery request is sent to the /api/auth/local/recover endpoint.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Fastschema

Products

Fastschema

CVE-2026-72583

fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload

A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Fastschema

Products

Fastschema

CVE-2026-72584

fastschema - TOCTOU Race Condition Bypasses OTP Attempt Limit in Account Recovery

A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Fastschema

Products

Fastschema

CVE-2026-72587

Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Corebunch

Products

Instatic

CVE-2026-72589

alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Alseambusher

Products

Crontab-ui

CVE-2026-72590

alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed

Vendors

Alseambusher

Products

Crontab-ui

CVE-2026-72591

Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter

A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted image_url value in the PATCH /apis/web/v1/album/{id}/image endpoint.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Gabehf

Products

Koito

CVE-2026-72688

OpenSignLabs opensignserver - Missing Authentication for Critical Function

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens for any caller-supplied URL without performing any session check, defeating the only access control protecting stored contract files.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Opensignlabs

Products

Opensignserver

CVE-2026-72689

OpenSignLabs opensignserver - Broken Object Level Authorization

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and returns full records including sender and signer PII and a pre-signed document download URL whenever the document's IsEnableOTP flag is unset, which is the default configuration.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Opensignlabs

Products

Opensignserver

CVE-2025-30238

Privilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet Devices

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Eb210 Pro(eu1) 1.0 Eb210 Pro(us1) 1.0 Eb810v(eu1) V1.0 and 56 more

CVE-2026-72690

Attendize Attendize - Cross-Tenant Authorization Bypass

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question cannot be removed by the victim because the victim's account-scoped delete path cannot resolve a question owned by another tenant.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Attendize

Products

Attendize

CVE-2026-72691

OpenSignLabs opensignserver - Authentication Bypass

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed by supplying an arbitrary string as docId.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Opensignlabs

Products

Opensignserver

CVE-2026-72692

OpenSignLabs opensignserver - Missing Authorization

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Opensignlabs

Products

Opensignserver

CVE-2026-6374

Hardcoded Credentials in Zyxel WAH7601 Router

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Zyxel Networks

Products

Wah7601

CVE-2026-6373

Sensitive Data Exposure in Zyxel WAH7601 Router

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Zyxel Networks

Products

Wah7601

CVE-2026-13206

Multiple Vulnerabilities in Zyxel's WAH7601 - OS Command Injection

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed

Vendors

Zyxel Networks

Products

Wah7601

CVE-2026-12984

Exposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Zyxel Networks

Products

Wah7601

CVE-2026-18370

Heap-based buffer overflow in entr

entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy(), which returns the total length of the source string rather than the number of bytes written. When the buffer is exactly filled, the remaining size underflows as an unsigned size_t, causing subsequent copies to write out of bounds. This can be triggered by supplying command-line arguments whose combined length fills the buffer, or via the /_ substitution feature which expands a short token into a longer pathname at runtime. The local attacker can cause memory corruption, process abort, and denial of service.  This issue was fixed in commit 2467fe0

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Eradman

Products

Entr

CVE-2026-12051

NULL pointer dereference in USB DFU device_next download handler (handle_download)

The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download() (subsys/usb/device_next/class/usbd_dfu.c). The handler computes MIN(setup->wLength, buf->len) and passes buf->data to the image write callback without checking that the buf net_buf pointer is non-NULL. The handler is reached over the USB control endpoint, driven by the USB host. For a DFU_DNLOAD (download) request with no Data OUT stage — notably the zero-length terminating download that the DFU protocol uses to end a firmware transfer — the USB core invokes the class handler with a NULL buffer. After the device has been advanced to the DFU_DNLOAD_IDLE state (by sending one valid download block and a GET_STATUS), a zero-length DFU_DNLOAD reaches handle_download() with buf == NULL, dereferencing it. The result is a NULL+offset read that triggers a fatal CPU fault, i.e. a denial of service (device crash/reset). The attacker is whatever controls the USB host the device is attached to; DFU download support must be enabled with a registered image. There is no memory corruption or information disclosure — impact is limited to availability. The fix adds an explicit if (buf != NULL) guard so the callback receives a zero-length, NULL-data transfer instead of crashing.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr