CVE-2026-18774

NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nousresearch

Products

Hermes-agent

CVE-2026-11421

ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The handler runs the value through sanitize_text_field, which preserves single quotes, and the downstream erp_crm_contact_advance_filter() function interpolates it directly into a single-quoted SQL WHERE clause before execution via $wpdb->get_results(). This makes it possible for authenticated attackers, with the plugin-supplied CRM Agent role (or higher CRM Manager / WordPress admin) and the erp_crm_list_contact capability, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress

Products

Erp: Complete Hr, Accounting & Crm Suite Built For Woocommerce Wordpress

CVE-2026-55996

Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent

A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured, dynamiclistener automatically appended to each serving certificate any hostname presented via Server Name Indication (SNI) in incoming TLS requests. An unauthenticated attacker with network access within the affected cluster could send a large number of TLS requests with distinct hostnames, causing the serving certificate to accumulate an unbounded number of Subject Alternative Names (SANs). Eventually, the certificate grows large enough that TLS handshakes fail with an excessive message size error, causing a denial of service on the affected listeners.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Rancher

CVE-2026-67293

FreeRDP before 3.29.0 Improper Certificate Hostname Validation

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such as *.example.com as matching any hostname ending in .example.com, so it incorrectly accepts a wildcard certificate for multi-label subdomains like a.b.example.com (which OpenSSL's X509_check_host() rejects). This weakens TLS server authentication under wildcard-certificate conditions.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-45705

OpenSIPS: OOB Read in Multipart Body Boundary Parsing

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes (typically 20-70) starting from a position at or past the logical end of the body buffer, reading past the body boundary. The bug triggers when a SIP message has Content-Type: multipart/mixed with a boundary parameter and its body contains -- within two to three bytes of the body's end without being followed by the actual boundary delimiter. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Opensips

Products

Opensips

CVE-2026-18853

ZomboDroid Meme Generator App com.zombodroid.MemeGenerator t5.l.c path traversal

A security vulnerability has been detected in ZomboDroid Meme Generator App 4.6830 on Android. This issue affects the function t5.l.c of the component com.zombodroid.MemeGenerator. Such manipulation leads to path traversal. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Zombodroid

Products

Meme Generator App

CVE-2026-67289

FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-68580

FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-66312

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Edge Chromium

CVE-2026-68979

Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing authorization, an authenticated user authorized to modify a Parameter Context, but not authorized on referencing components, could alter Parameter values affecting those components. In deployments where a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation, without starting the referencing component. The impact was limited to stopped components by existing verification checks, and the issue applies only to deployments that use component-level authorization policies. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which aligns the Parameter Context update method authorization with other methods, adding authorization checking on affected components.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Nifi

CVE-2026-40717

Elevated Privileges via Improper Link Resolution in Dell Monitor Driver

Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Aw2526hl Aw2725dm Aw2726dl and 46 more

CVE-2026-66310

Microsoft Edge for Android Information Disclosure Vulnerability

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Edge

CVE-2026-66344

Uncontrolled Search Path Element Allows Authenticated System‑Level Code Execution in NetKids iMark

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability (CWE-427). An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Integrated Systems Technologies, Inc.

Products

Netkids Imark

CVE-2026-58075

Unauthenticated File Disclosure with Potential Privilege Escalation in Veeam ONE

A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Veeam

Products

One

CVE-2026-18902

H3C NX15 esps repeaterproc command injection

A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 8.6 High EPSS 3.8% KEV · Not listed

Vendors

H3c

Products

Nx15

CVE-2026-5062

PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' (search) parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `search_links_table()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Supercleanse Wordpress

Products

Prettylinks – Affiliate Link Management, Url Shortener, Link Cloaking, Tracking & Branded Short Links Wordpress

CVE-2026-11454

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/<id> REST endpoint. The endpoint's permission callback checks only the role-level view_contacts capability and read_single() returns the full contact record by sequential integer ID without the object-level view_contact ownership check applied elsewhere in the codebase. This makes it possible for authenticated attackers holding view_contacts but not view_others_contacts — notably Groundhogg's built-in Sales Rep role, designed to see only its own contacts — to read any contact record on the site, including PII, contact meta, owner IDs, the admin edit URL, and (for contacts linked to a WordPress user) that user's full capability set.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Trainingbusinesspros Wordpress

Products

Groundhogg — Crm, Newsletters, And Marketing Automation Wordpress

CVE-2026-60009

Unrestricted File Write via POST /file-upload in Eclipse Theia

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without rejecting tokenless HTTP requests. Because `multipart/form-data` is a CORS-safelisted request type, a cross-origin web page can trigger the write with no preflight and no credentials, resulting in an unauthenticated arbitrary file write outside the workspace to any absolute path the backend process can write. This can escalate to remote code execution, for example by overwriting a startup-executed file such as `~/.bashrc`. Electron mode uses a separate `ElectronSecurityToken` and is not affected via this path.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Theia

CVE-2026-18881

TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the `filter_data[comment_count]` parameter of the public `tableon_get_table_data` AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query — the value is split on `:` and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()`. This makes it possible for unauthenticated attackers to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database (researcher demonstrated extraction of database(), wp_users.user_login, and wp_users.user_pass).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Realmag777 Wordpress

Products

Tableon – Wordpress Posts Table Filterable Wordpress

CVE-2026-6079

Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amd_ajax_target_task_manager() function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all scheduled tasks (potentially exposing PII), execute arbitrary tasks, and delete any task via the public_amd_ajax_handler AJAX action.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Ho3einie Wordpress

Products

Material Dashboard Wordpress