CVE-2026-102618

IBM i is Affected by a Protection Mechanism Failure

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-115718

Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt

Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and effectively turning the site into a free LLM proxy.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Builder

CVE-2026-124425

Parse Server 9.10.6-alpha.1 before 9.10.7-alpha.2 Information Disclosure via Save Response

Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect these markers to infer whether protected fields are set.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Parse Community Parseplatform

Products

Parse Server Parse-server

CVE-2024-41786

IBM Engineering Requirements Management DOORS Next for J2EE File Disclosure Rule

IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requested file due to improper input validation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Engineering Requirements Management Doors Next

CVE-2026-124492

SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Jihong88

Products

Suneditor

CVE-2026-124474

MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.php

MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of view_entry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete bookings, or perform administrative actions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Meeting-room-booking-system

Products

Mrbs-code

CVE-2026-73570

Zimbra Collaboration Remote Command Execution via SNMP Notification

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

CVSS 3.1 · 8.9 High EPSS 76.6% KEV · Listed

Vendors

Synacor Zimbra

Products

Zimbra Collaboration Suite Collaboration

CVE-2026-19598

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, enabling complete site takeover, or perform another administrator action.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed

Vendors

Sc0ttkclark Wordpress

Products

Pods – Custom Content Types And Fields Wordpress

CVE-2026-124426

Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Cms Craft Cms

CVE-2026-124427

Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles, slugs, and custom-field content from withheld sections.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Cms Craft Cms

CVE-2026-124437

Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion

Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-124438

Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access

Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Scriban

Products

Scriban

CVE-2026-72743

SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Dataease

Products

Sqlbot

CVE-2026-71968

OP-TEE OS 4.10.0 Use-After-Free via Trusted Application Loader TA_FLAG_CONCURRENT

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TA_FLAG_CONCURRENT flag in a user TA signed header. Attackers can cause two concurrent sessions to operate on the same shared context without locking, corrupting the uctx->vm_info.regions list during memref parameter mapping and unmapping to free vm_region nodes still in use, resulting in a use-after-free in S-EL1 secure-world kernel memory.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Op-tee

Products

Op-tee Os

CVE-2026-71959

Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Bitwarden

Products

Server

CVE-2026-57957

Papermark 0.22.0 - CORS Misconfiguration in Viewer Upload Endpoint

Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability that allows unauthenticated remote attackers to perform credentialed cross-origin requests by exploiting the TUS-based viewer upload endpoint reflecting arbitrary request Origins with Access-Control-Allow-Credentials set to true. Attackers can lure authenticated victims to malicious pages that silently issue credentialed cross-origin requests to upload arbitrary files into victim datarooms and read credentialed responses.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Papermark

Products

Papermark

CVE-2026-57945

PhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{uid} Endpoint

PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PUT users API endpoint to overwrite another user's profile details without authorization.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Photoprism

Products

Photoprism

CVE-2026-56696

OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands

OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/pr_comments.md files, which are subsequently injected into runtime system prompts, persistently influencing local agent behavior.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hkuds

Products

Openharness

CVE-2026-53985

Ground Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IO

Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restart_service command. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the service_control event to terminate all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers, with repeated triggering possible in Docker deployments to create a persistent denial-of-service condition.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Efstratios Goudelis

Products

Ground Station

CVE-2026-49948

Mem0 0.2.8 Missing Authorization via POST /configure Endpoint

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and embedder traffic to an attacker-controlled server, with the malicious configuration persisted to PostgreSQL and surviving server restarts to affect all users and API keys on the instance.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mem0ai

Products

Mem0