CVE-2026-17542

Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector

The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Filemanagerpro Wordpress

Products

File Manager Wordpress

CVE-2026-19053

ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter

The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Prosolution Wordpress

Products

Prosolution Wp Client Wordpress

CVE-2026-57279

Cross‑Site Scripting Allowing Arbitrary Script Execution in Cybozu Garoon

Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Cybozu

Products

Cybozu Garoon

CVE-2026-72577

NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Vendors

Nasa

Products

Fprime

CVE-2026-59686

Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.

CVSS 3.1 · 8.4 High EPSS 1.7% KEV · Not listed

Vendors

Progress

Products

Connection Manager For Objectscale Ecs Connection Manager Loadmaster and 3 more

CVE-2026-59687

Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.

CVSS 3.1 · 8.4 High EPSS 1.7% KEV · Not listed

Vendors

Progress

Products

Connection Manager For Objectscale Ecs Connection Manager Loadmaster and 3 more

CVE-2026-59688

Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.

CVSS 3.1 · 8.4 High EPSS 1.7% KEV · Not listed

Vendors

Progress

Products

Connection Manager For Objectscale Ecs Connection Manager Loadmaster and 3 more

CVE-2026-59689

Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root

An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Connection Manager For Objectscale Ecs Connection Manager Loadmaster and 3 more

CVE-2026-72748

AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php

AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution.

CVSS 4.0 · 6.9 Medium EPSS 1.2% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-59690

Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Process Software Progress

Products

Multi Tenant Connection Manager For Objectscale Ecs Connection Manager and 5 more

CVE-2026-2299

Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint

The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Google Drive Mattermost Google Drive Plugin

CVE-2026-72781

Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape

Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component), an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget to execute arbitrary code, even when the Twig sandbox is enabled via enableTwigSandbox().

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Craft Cms

CVE-2026-18478

Stored XSS in Magnolia CMS

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Magnolia-cms

Products

Magnolia Cms

CVE-2026-15059

systemd-oomd: unprivileged users can terminate arbitrary processes

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Systemd

Products

Systemd

CVE-2026-16742

systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Systemd

Products

Systemd

CVE-2026-56620

HCL BigFix Mobile is vulnerable to information disclosure

HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Mobile

CVE-2026-56619

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS)

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Mobile

CVE-2026-72914

Mastodon: Exhausting data by an unauthenticated request to the admin retention API

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Joinmastodon

Products

Mastodon

CVE-2026-57850

RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection

RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) can send control messages and login options reserved for a full Remote session. An authenticated remote peer can exploit this missing scope check to act outside its granted scope, injecting out-of-scope control messages to observe and control the host beyond the permissions it was given.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Rustdesk

Products

Rustdesk

CVE-2026-18972

Velociraptor authenticated identity-spoofing vulnerability

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Rapid7

Products

Velociraptor