CVE-2026-17354

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-17340

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-17335

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-16699

Vulnerability exists in IBM Netezza Appliance

IBM Netezza Appliance 11.3.0.2 Interim Fix 002 through 11.3.1.3 Interim Fix 006 could allow a remote authenticated attacker to change the passwords of other users due to improper authorization.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Netezza Appliance

CVE-2026-124566

fushengqian fuint Alipay Callback ClientPayController.java aliPayCallback behavioral workflow

A vulnerability was detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This vulnerability affects the function aliPayCallback of the file ClientPayController.java of the component Alipay Callback Handler. Performing a manipulation results in enforcement of behavioral workflow. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Fushengqian

Products

Fuint

CVE-2026-124562

D-Link DIR-878 HNAP SetWanSettings buffer overflow

A vulnerability was identified in D-Link DIR-878 1.20B05. Affected is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument ConfigDNS/Primary/ConfigDNS/Secondary leads to buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-878 Dir-878

CVE-2026-124557

OtterMind Chat2DB Class Generator DbMybatisGenerateServiceImpl.java DbMybatisGenerateServiceImpl.generateClass path traversal

A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argument tableName results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ottermind

Products

Chat2db

CVE-2026-124553

BabelDOC from 0.3.61 before 0.7.0 Denial of Service via ToUnicode CMap Parsing

BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU and memory by supplying unbounded bfrange and cidrange spans. Attackers can submit a crafted PDF whose embedded ToUnicode CMap declares a huge range, driving billions of loop iterations and stalling the translation worker.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Funstory-ai

Products

Babeldoc

CVE-2026-124509

floci-io Floci S3 Destination Configuration DeliveryStreamDescription.java S3Destination.bucketName path traversal

A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulation of the argument BucketARN leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. The name of the patch is b986b95074ef524019be7af51e1df172e48faa4b. You should upgrade the affected component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Floci-io

Products

Floci

CVE-2026-124505

Dianping CAT Login/Logout Handler.java Handler.redirect

A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dianping

Products

Cat

CVE-2026-124500

Fengoffice Feng Office File FilesController.class.php upload_document_image server-side request forgery

A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_document_image of the file application/controllers/FilesController.class.php of the component File Handler. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Fengoffice

Products

Feng Office

CVE-2026-124491

SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jihong88

Products

Suneditor

CVE-2026-124487

OpenEMR before 8.4.0 Improper Authorization in FHIR DocumentReference $docref

OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route that allows low-privileged users to generate any patient's CCDA. Attackers with only demographics and documents permissions can supply a victim patient parameter, then download the full-chart CCDA from Patient Documents to exfiltrate clinical data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124483

OpenEMR before 8.4.0 Improper Authorization via Prescription REST API

OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Authenticated staff users can reuse the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions tenant-wide.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124479

OpenEMR before 8.4.0 Arbitrary File Read via REST Document Download

OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path instead of returning them as content. Authenticated users with document upload and download access can upload a document containing an absolute pathname, such as the sqlconf.php location, then download it to read server files and recover database credentials.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124475

OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting_patient

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients' settings by supplying an arbitrary setting_patient value. Attackers can insert or overwrite patient_settings rows for victims to suppress notifications, tamper with consent flags, or alter portal preferences.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124470

OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Lists

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal_custom_report.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue_ parameter names to retrieve other patients' problem titles, clinical notes, ICD diagnosis codes, and IPPF contraceptive records.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124466

OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uri

OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwks_uri. Attackers can trigger the fetch via the token introspection endpoint with an unsigned client_assertion to probe internal services and reach cloud metadata endpoints.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124461

OpenEMR before 8.3.0 IDOR via DICOM library/ajax/upload.php Endpoint

OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary doc_id. Low-privilege users can enumerate doc_id values with the fetch and save actions to disclose patient health information and tamper with medical records across all patients.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124457

OpenEMR before 8.3.0 Path Traversal via sl_eob_process.php eraname

OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl_eob_process.php that allows authenticated users to write and read files by supplying unsanitized eraname values. Attackers without billing privileges can inject ../ sequences to create ERA report .html files anywhere the web user can write and parse arbitrary .edi files echoed into the report.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr