CVE-2026-13322

Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service

A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Kubevirt Redhat

Products

Kubevirt Container Native Virtualization Openshift Virtualization

CVE-2026-48930

nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Nodejs

Products

Node.js Nodejs

CVE-2026-48928

Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Nodejs

Products

Node.js Nodejs

CVE-2026-48936

nodejs: Node.js: Local server can be started without network permission via Permission API flaw

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Nodejs

Products

Node.js Nodejs

CVE-2026-48615

nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Nodejs

Products

Node.js Nodejs

CVE-2026-40702

EVoke Systems EVoke CSMS Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Evoke

Products

Evoke Csms

CVE-2026-7531

Use-after-free in PQC hybrid key-share handling

Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 (released in 5.9.1): a malicious TLS 1.3 server sending a truncated PQC hybrid KeyShare can still trigger the error cleanup path to operate on freed memory.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Wolfssl

Products

Wolfssl

CVE-2026-6731

X.509 name constraint bypass via Subject CN treated as a DNS name

X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Wolfssl

Products

Wolfssl

CVE-2026-6681

PKCS#7 decode ignores caller output buffer size, writing past buffer bounds

The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of the provided buffer. This affects wolfSSL 5.9.0 and earlier and was fixed in the 5.9.1 release.

CVSS 4.0 · 1 Low EPSS < 1% KEV · Not listed

Vendors

Wolfssl

Products

Wolfssl

CVE-2026-6679

DTLS 1.3 ACK serialization heap buffer overflow via integer truncation

A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This affects builds using DTLS 1.3 and wolfSSL version 5.9.0 and earlier. A fix was added to the 5.9.1 release.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wolfssl

Products

Wolfssl

CVE-2026-6678

Integer underflow in wc_PKCS7_DecryptOri handling crafted Other Recipient Info

Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption.

CVSS 4.0 · 1 Low EPSS < 1% KEV · Not listed

Vendors

Wolfssl

Products

Wolfssl

CVE-2026-6450

CRL critical extension bypass in ParseCRL_Extensions

A CRL critical extension bypass exists in ParseCRL_Extensions where critical extensions are not properly enforced, allowing a crafted CRL with an unhandled critical extension to be accepted. This only affects builds with CRL support enabled and where a crafted CRL had a trusted signature when parsed.

CVSS 4.0 · 1 Low EPSS < 1% KEV · Not listed

Vendors

Wolfssl

Products

Wolfssl

CVE-2026-6412

Continued acceptance of SHA-1/MD5 digests in certificate processing

Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Wolfssl

Products

Wolfssl

CVE-2026-12473

OHIF Viewers DICOM Server-Side request forgery

Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Open Health Imaging Foundation

Products

Dicom Web Viewer Framework

CVE-2026-56445

pydicom pynetdicom Library Path Traversal

The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file writes to arbitrary paths.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Pydicom

Products

Pynetdicom Library

CVE-2026-44622

EVoke Systems EVoke CSMS Insufficiently Protected Credentials

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Evoke

Products

Evoke Csms

CVE-2026-11800

Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak Data Grid and 4 more

CVE-2026-1869

User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirm_payment() function in all versions up to, and including, 5.2.0. This makes it possible for unauthenticated attackers to bypass payment processing and activate paid memberships.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpeverest

Products

Wordpress User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

CVE-2025-71327

Flowise - Authentication Bypass via Unprotected Registration Endpoint

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Flowiseai

Products

Flowise

CVE-2026-40084

Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format_file Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage (stored injection), lib/html_reports.php at line 283 stores $save['format_file'] = $post['format_file'] directly into the database without any validation. In the second stage (file read), lib/reports.php at line 667 concatenates CACTI_PATH_FORMATS . '/' . $format_file, and line 670 then calls file($format_file), reading arbitrary files from the filesystem. This issue has been fixed in version 1.2.31.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cacti

Products

Cacti