CVE-2026-121554

cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects

cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Silkimen

Products

Cordova-plugin-advanced-http

CVE-2026-121550

nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling

nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular file, causing victim-writable files to be overwritten or leaking the victim's browsed paths.

CVSS 4.0 · 1 Low EPSS < 1% KEV · Not listed

Vendors

Jarun

Products

Nnn

CVE-2026-121546

ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following

ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create directories and move torrent data to locations writable by the web server or rtorrent.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Novik

Products

Rutorrent

CVE-2026-121455

DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save

DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe internal database hosts, or to /connections/save to overwrite stored connections.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dbgate

Products

Dbgate

CVE-2026-121451

AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Amir1376

Products

Ab-download-manager

CVE-2026-121443

svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag

svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Darylldoyle Drupal

Products

Svg-sanitizer Svg Sanitizer

CVE-2026-121439

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set unvalidated content-length headers. Malicious wasip3 guests can splice an existing body into a new response with an incorrect content-length to perform response splitting or injection attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Bytecodealliance

Products

Wasmtime

CVE-2026-121435

Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API

Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Froxlor

Products

Froxlor

CVE-2026-121431

AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instance_url, api, or webhookurl to internal addresses and trigger the webhook test endpoint to reach loopback, private-network, or cloud-metadata services.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Azuracast

Products

Azuracast

CVE-2026-121427

AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config

AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Azuracast

Products

Azuracast

CVE-2026-121423

SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Surrealdb

Products

Surrealdb

CVE-2026-121419

SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision

SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Surrealdb

Products

Surrealdb

CVE-2026-121415

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Parse Community Parseplatform

Products

Parse Server Parse-server

CVE-2026-121411

FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry

FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked UINT16 cast or freerdp_image_scale stride assertion failures that terminate the client.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-121407

FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal Stream_Seek assertion, aborting the server and dropping sessions.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-121403

FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP

FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-121399

FreeRDP before 3.32.2 Memory Exhaustion via RD Gateway Packet Length

FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7FFFFFFF to trigger pre-authentication memory exhaustion and denial of service.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-121395

FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX Decoder

FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit range to abort the client process.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-121391

FreeRDP before 3.32.2 File Descriptor Exhaustion via Parallel CREATE

FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close previous descriptors on repeated IRP_MJ_CREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE requests to exhaust the client descriptor table and crash the process.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-121387

FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder

FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 message shorter than a 33- or 32-byte WAV49 frame to crash the client.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp