CVE-2026-57831

Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2

Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2 - The Joomla extension DP Calendar is vulnerable to an unauthenticated SQL injection.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Digital-peak

Products

Dp Calendar For Joomla

CVE-2026-56339

Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error messages (NO_ORG vs NO_RIGHTS) when called with only a publishable API key, enabling attackers to discover valid organization IDs and increase the attack surface for targeted phishing or social engineering campaigns.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cap-go

Products

Cap-go

CVE-2026-45793

Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Getcomposer

Products

Composer

CVE-2026-40952

Privilge misconfiguration in Secure Access installers

CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local access to the client or server can use it to elevate privileges to Administrator when Secure Access is installed in a non-default location.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Absolute Microsoft

Products

Secure Access Windows

CVE-2026-40953

Heap overflow in Secure Access clients

CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers with local access and administrator permissions can create a denial of service attack against the client over which they have control.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-40954

Integer underflow in Secure Access clients prior to 14.55

CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-40955

Integer underflow vulnerability in Secure Access clients

CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-40956

Memory disclosure in Secure Access Clients

CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a small amount of random memory to leak.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-40957

Frameable content vulnerability in the Secure Access server login page

o   CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-40958

Input validation error in Secure Access clients prior to 14.55

CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-50144

ncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter id

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::load_param() when Net::load_param() loads a malicious .param model file because the parsed parameter id is checked only against id >= NCNN_MAX_PARAM_COUNT, allowing a negative id to index before the params[NCNN_MAX_PARAM_COUNT] array. This vulnerability is fixed by commit 5a0288f255daa6c3294f77109f67718e434ec020.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tencent

Products

Ncnn

CVE-2026-33443

Memory management error in Secure Access servers prior to 14.55

CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-33444

Memory management vulnerability in Secure Access servers

CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against the server.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-33445

Memory management vulnerability in Secure Access servers

CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-55398

Memory management vulnerability in Secure Access clients

CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against the server.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-55399

Resource exhaustion vulnerability in the Secure Access publisher

CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with valid credentials to the Secure Access tunnel can create a non-persistent DoS against the publisher.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-62361

listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET /api/subscribers, allowing an authenticated user with subscribers:sql_query and subscribers:get_all to read arbitrary database tables such as users and settings and execute data-modifying PostgreSQL CTEs. This issue is fixed in version 6.2.0.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nadh

Products

Listmonk

CVE-2026-6424

Use-after-free vulnerability in ESET security products for Linux

Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Eset

Products

Endpoint Antivirus Server Security

CVE-2026-14254

Improper Restriction of Excessive Authentication Attempts in Delphix Continuous Data

A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were updated, defeating brute-force protections and enabling continued password guessing against a targeted account.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Perforce

Products

Delphix Continuous Data

CVE-2026-53597

Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts used gray-matter without overriding executable js and javascript frontmatter engines, allowing an attacker-controlled .prompty file with ---js frontmatter to execute arbitrary JavaScript during prompt loading. This issue is fixed in version 2.0.0-beta.3.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Prompty