CVE-2026-116769

Authentication bypass in Secure Access Servers

CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-89292

Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures

In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Eclipse Mnestix

CVE-2026-89295

Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter

In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Eclipse Mnestix

CVE-2026-121581

ArcReel Provider Test-Connection Endpoint test server-side request forgery

A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arcreel

Products

Arcreel

CVE-2026-122047

Campcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted upload

A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function move_uploaded_file of the file /loan/application/banner.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Complete Advance Loan Management System

CVE-2026-123268

libyal libvmdk Extent Data File libvmdk_extent_table.c libvmdk_extent_table_get_extent_data_file_path memory corruption

A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function libvmdk_extent_table_get_extent_data_file_path of the file libvmdk/libvmdk_extent_table.c of the component Extent Data File Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 175d3fc0a0b961f362f16e7560a6169d7213e16b. Applying a patch is the recommended action to fix this issue.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Libyal

Products

Libvmdk

CVE-2026-123785

Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry

Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Fluxbox-team

Products

Fluxbox

CVE-2025-1837

Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Watsonx Orchestrate Cartridge For Cloud Pak For Data

CVE-2026-124591

Bahleel CsvExporter.php fputcsv csv injection

A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Bahleel

Products

Bahleel

CVE-2026-124623

PipraPay ZIP Archive system-settings-import unrestricted upload

A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Piprapay

Products

Piprapay

CVE-2026-76970

Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform

Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could cause the affected processes to crash and restart. By repeatedly sending such requests, the attacker could cause a sustained denial of service, leading to a high impact on availability. Confidentiality and integrity remain unaffected.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

Sap Netweaver And Abap Platform Sap Netweaver And Abap Platform

CVE-2026-87056

operator-sdk-builder: operator-sdk-builder: No automated dependency-update configuration for submodules or Containerfile

A flaw was found in operator-sdk-builder. The repository lacks automated dependency-update configurations for its git submodules, Containerfile base image, and Tekton bundle references. This absence prevents the automatic flagging of stale or vulnerable dependencies. Consequently, this could lead to the inclusion of known vulnerable components in the build process, increasing the risk of security exposures.

CVSS 3.1 · 2.6 Low EPSS n/a KEV · Not listed

Vendors

Operator-sdk-builder

Products

Operator-sdk-builder

CVE-2026-87053

operator-sdk-builder: operator-sdk-builder: Final container image runs as root (USER root never reverted)

A flaw was found in operator-sdk-builder. Due to an oversight in the Containerfile configuration, the final built container image runs with root privileges by default. This increases the attack surface of the container, as any process executed within it will have elevated permissions. If a malicious actor compromises the container, they could leverage these root privileges to perform unauthorized actions, potentially leading to a broader system compromise.

CVSS 3.1 · 4.2 Medium EPSS n/a KEV · Not listed

Vendors

Operator-sdk-builder

Products

Operator-sdk-builder

CVE-2026-87060

olm-operator-konflux-sample: olm-operator-konflux-sample: Renovate automerge enabled with base-image update exclusions

A flaw was found in olm-operator-konflux-sample. The system's automated merging of updates, known as Renovate automerge, is configured too broadly, allowing a wide range of updates without sufficient scrutiny. Additionally, the critical base image for the catalog, ose-operator-registry, is entirely excluded from this update tracking. This combination creates an inconsistent and potentially insecure update process, increasing the risk of unpatched vulnerabilities being introduced into the system.

CVSS 3.1 · 2.6 Low EPSS n/a KEV · Not listed

Vendors

Olm-operator-konflux-sample

Products

Olm-operator-konflux-sample

CVE-2026-93519

X.Org Server XFixes Pointer Barrier Event List Buffer Overflow

A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

X.org X.orgg

Products

X Server Xorg-x11-server Xwayland

CVE-2026-93521

X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

X.org

Products

X Server Xorg-x11-server Xwayland

CVE-2026-103112

Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path

A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more

CVE-2026-120013

Path Traversal in Agent Memory Module of SAP Cloud SDK for Python

The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences (for example, attacker-corp/../victim-corp) could cause the resolved path to escape the intended directory and access another tenant's secrets under:Plain Text/etc/secrets/appfnd/hana-agent-memory/<tenant>/Successful exploitation could allow unauthorized access to another tenant's mounted credentials, including OAuth client IDs and client secrets. This vulnerability could enable cross-tenant access to sensitive credentials.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120012

Information Disclosure vulnerability in SAP Cloud SDK for AI(JavaScript)

SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these credentials, but only after waiting for a suitable failure event triggered by a higher-privileged user and within the limited lifetime of the token, making exploitation complex. Successful exploitation could allow the attacker to reuse the disclosed credentials against the associated SAP service, resulting in a high impact on confidentiality, integrity and availability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-65059

Furl versions before 3.16 for Perl allow memory exhaustion via unbounded decompression of HTTP responses

Furl versions before 3.16 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Tokuhirom

Products

Furl