CVE-2026-57239

Foxit PDF Editor/Reader Local Privilege Escalation

The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate their privileges to NT AUTHORITY\SYSTEM.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware Microsoft

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 2 more

CVE-2025-67888

Unauthenticated Command Injection in Control Web Panel via Unsanitized 'key' Parameter

An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php (when the "api" parameter is set) is not properly sanitized before being used to execute OS commands. This can be exploited by unauthenticated attackers to inject and execute arbitrary OS commands with the privileges of root on the web server. Softaculous or SitePad must be present.

CVSS 3.1 · 7.3 High EPSS 3.6% KEV · Not listed

Vendors

Centos-webpanel

Products

Centos Web Panel

CVE-2026-11869

WP DSGVO Tools (GDPR) < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request

The WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 does not perform an authorization check on the immediate-processing path of its data subject access request feature, allowing unauthenticated attackers to generate and download the full personal-data export (including name, postal address, phone number, email, and comment content) of any user, customer, or commenter by supplying their email address.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-14261

CVE-2026-14261

A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling attackers to reinstall the service to a remote database they control.

CVSS 3.1 · 9.1 Critical EPSS 1.0% KEV · Not listed

Vendors

Xerte

Products

Xerte Online Tools

CVE-2026-21039

Improper Settings Access Enables Theft Protection Bypass

Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung

Products

Mobile Devices

CVE-2026-21041

Improper Access Control in SamsungSEAgentService Allows Local Sensitive Information Disclosure

Improper access control in SamsungSEAgentService prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung Mobile

Products

Samsung Mobile Devices

CVE-2026-52475

Cross‑Site Scripting via File Upload in Aiflowy

Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-51218

Heap Buffer Overflow in snap7 TS7Worker Causing DoS

A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 allows attackers to cause a Denial of Service (DoS) via a crafted packet.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Davenardella

Products

Snap7

CVE-2026-51219

Heap Buffer Overflow in lib60870 Leading to Denial of Service

A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 allows attackers to cause a Denial of Service (DoS) via a crafted payload.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mz-automation

Products

Lib60870

CVE-2026-11405

Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface

The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8. - The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key). - After normal authentication fails, it calls GetValue("sys.rzadmin.password") to read a backdoor password from the device configuration. - It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password. A successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-41857

BOSH CLI Shell Injection

A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh logs -f) with default flags. Affected versions: BOSH CLI versions prior to 7.10.5.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Bosh Cli

CVE-2026-59269

Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries

A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group. Affected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Vmware

Products

Pinniped

CVE-2026-36214

Stored XSS via Bootstrap Tooltip in osTicket

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Osticket

Products

Osticket

CVE-2026-21048

Out-of-Bounds Memory Write in Samsung DNG Parser

Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Samsung Mobile

Products

Samsung Mobile Devices

CVE-2026-21055

Improper Component Export Enables Privileged Code Execution in Samsung Bixby

Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Samsung Mobile

Products

Bixby

CVE-2026-15086

Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077

vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Raw Formatter [meta Tag Formatter]

CVE-2026-11963

User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDOR

The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user, allowing any authenticated user such as a subscriber to change another user's WordPress role and membership tier.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-11964

User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation

The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them, allowing unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-8590

Spotfire OAuth2 PKCE Bypass for public clients

Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire on Kubernetes (Spotfire Server modules). This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire Enterprise with External Consumers: through 14.0.12, through 14.5.0, through 14.6.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire on Kubernetes: through 4.2.0, 5.0.X, 6.0.X.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Spotfire

Products

Spotfire Enterprise Spotfire Enterprise With External Consumers Spotfire On Kubernetes

CVE-2026-47984

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Adobe Commerce B2b Adobe Commerce Webhooks Plugin and 5 more