CVE-2026-56122

Winstone Servlet Engine 0.9.10 Path Traversal via HTTP Request Paths

Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences that are not sanitized when serving static files from the configured webroot. Attackers can traverse outside the webroot directory using traversal-prefixed paths in a single HTTP request to read any file accessible to the servlet engine process, including sensitive system files when the service runs with elevated privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Rickknowles

Products

Winstone Servlet Container

CVE-2026-47145

Color Control hue/saturation assertion abort in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47146

Color Control color-temperature assertion abort in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47147

OTA server raw parser missing per-field bounds validation in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has already joined the network. Only devices supporting the OTA Server cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47148

Groups GetGroupMembership count/list-length mismatch in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Groups cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47149

Door Lock GetUserType invalid table index in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Door Lock cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47150

IAS Zone enroll invalid table index and write in EmberZNet 9.0.2

In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only devices supporting the IAS Zone cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47151

Door Lock ClearWeekdaySchedule invalid table index and write in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the network. Only devices supporting the Door Lock cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47152

Level Control Move divide-by-zero in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47153

Level Control Step With On/Off divide-by-zero in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47154

Simple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Simple Metering cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-13314

Stored XSS in pretix-digital

Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix-digital

CVE-2026-13223

Insufficient validation of payment status in pretix-computop

Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix-computop

CVE-2026-13222

Insufficient validation of payment status in pretix-oppwa

Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix-oppwa

CVE-2026-57536

Insufficient validation of payment status in pretix-mollie

Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix-mollie

CVE-2026-57534

Stored XSS in pretix-pages

Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix-pages

CVE-2026-49319

Alps Electric Co., Ltd. R53R0 Remote Keyless Entry System (RKES) Replay Attack

Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication.  An attacker within RF range who records two consecutive lock or unlock transmissions from a legitimate key fob can later replay the same pair of transmissions repeatedly. During testing, replaying the first captured transmission caused the RKES to enter a state in which replaying the second captured transmission resulted in a successful lock or unlock operation of the vehicle. Tested and confirmed on a 2024 Suzuki Swift (SWIFT ISG GLS AC 1.2 5P 4x2 TM).

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Alps Electric

Products

Remote Keyless Entry System (rkes) R53r0

CVE-2026-57236

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid memory, which can cause a segfault or leak freed bytes into a Ruby String. Affects the CRuby (libxml2) implementation only; JRuby is not affected. This vulnerability is fixed in 1.19.4.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed

Vendors

Nokogiri Sparklemotion

Products

Nokogiri Nokogiri

CVE-2026-57234

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed

Vendors

Nokogiri Sparklemotion

Products

Nokogiri Nokogiri

CVE-2026-57235

Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias #slice) checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large negative index could pass the check and then be used at full width, reading outside the node set's storage. On CRuby this is an out-of-bounds read that typically crashes the process; on JRuby it is not memory-unsafe but returns an incorrect node. This vulnerability is fixed in 1.19.4.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nokogiri Sparklemotion

Products

Nokogiri Nokogiri