CVE-2026-13222

Insufficient validation of payment status in pretix-oppwa

Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix-oppwa

CVE-2026-57536

Insufficient validation of payment status in pretix-mollie

Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix-mollie

CVE-2026-57534

Stored XSS in pretix-pages

Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix-pages

CVE-2026-49319

Alps Electric Co., Ltd. R53R0 Remote Keyless Entry System (RKES) Replay Attack

Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication.  An attacker within RF range who records two consecutive lock or unlock transmissions from a legitimate key fob can later replay the same pair of transmissions repeatedly. During testing, replaying the first captured transmission caused the RKES to enter a state in which replaying the second captured transmission resulted in a successful lock or unlock operation of the vehicle. Tested and confirmed on a 2024 Suzuki Swift (SWIFT ISG GLS AC 1.2 5P 4x2 TM).

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Alps Electric

Products

Remote Keyless Entry System (rkes) R53r0

CVE-2026-57236

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid memory, which can cause a segfault or leak freed bytes into a Ruby String. Affects the CRuby (libxml2) implementation only; JRuby is not affected. This vulnerability is fixed in 1.19.4.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed

Vendors

Nokogiri Sparklemotion

Products

Nokogiri Nokogiri

CVE-2026-57234

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE attacks. This vulnerability is fixed in 1.19.4.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed

Vendors

Nokogiri Sparklemotion

Products

Nokogiri Nokogiri

CVE-2026-57235

Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias #slice) checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large negative index could pass the check and then be used at full width, reading outside the node set's storage. On CRuby this is an out-of-bounds read that typically crashes the process; on JRuby it is not memory-unsafe but returns an incorrect node. This vulnerability is fixed in 1.19.4.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nokogiri Sparklemotion

Products

Nokogiri Nokogiri

CVE-2026-57434

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed

Vendors

Nokogiri Sparklemotion

Products

Nokogiri Nokogiri

CVE-2026-57435

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed

Vendors

Nokogiri Sparklemotion

Products

Nokogiri Nokogiri

CVE-2026-57436

Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed

Vendors

Nokogiri Sparklemotion

Products

Nokogiri Nokogiri

CVE-2026-57437

Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application code constructs an XPathContext directly and lets the document become unreachable while continuing to use the context. The normal Document#xpath, #css, and related search methods are not affected, and it is not triggerable by malicious document input. This vulnerability is fixed in 1.19.4.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed

Vendors

Nokogiri Sparklemotion

Products

Nokogiri Nokogiri

CVE-2026-57438

Nokogiri: Possible Use-After-Free in XInclude Processing

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#do_xinclude replaced each <xi:include> in place, freeing the include node along with its children (such as <xi:fallback> and its descendants) and any namespaces declared on them. If an application had already exposed one of those nodes or namespaces to Ruby, the corresponding Ruby object was left pointing at freed memory. Using the object could result in invalid reads or writes to memory. This vulnerability is fixed in 1.19.4.

CVSS 4.0 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Nokogiri Sparklemotion

Products

Nokogiri Nokogiri

CVE-2026-9650

Unauthorized access via exposed firmware credentials in Schneider Electric remote terminals

CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated attacker accesses credentials stored within firmware or system files. With this credential an attacker could subsequently compromise the device if they have physical access to the device.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Schneider-electric Schneider Electric

Products

Easylogic T150 Easylogic T150 Firmware Saitel Dp and 3 more

CVE-2026-9651

Permission Assignment Flaw Exposes Password Hashes in Schneider Electric Remote Terminals

CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account compromise when an attacker with privileged local access reads improperly protected system files.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Schneider-electric Schneider Electric

Products

Easylogic T150 Easylogic T150 Firmware Saitel Dp and 3 more

CVE-2026-9716

NULL Pointer Dereference Causing Denial of Service in Schneider Electric PowerLogic™ P7

CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the device’s HMI and configuration functionality unavailable when malformed requests are received over exposed network interfaces.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Schneider-electric

Products

Powerlogic P7 Powerlogic P7 Firmware

CVE-2026-9718

Reachable Assertion Causing Authenticated DoS in PowerLogic P7

CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impacting system availability when a specially crafted request is sent to a vulnerable network-exposed service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Schneider-electric

Products

Powerlogic P7 Powerlogic P7 Firmware

CVE-2026-12844

List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function

List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. pairwise() collects the values returned by the block into a heap buffer sized to the longer input array, then grows the buffer before each copy with a single quadrupling (alloc <<= 2) instead of a loop. A block call that returns more than four times the current allocation in one invocation outgrows that one quadrupling, and the copy writes past the end of the buffer. Any caller of pairwise() whose block returns, for a single pair, more than four times the longer input array's length writes past the buffer and corrupts the heap.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Drolsky

Products

List::someutils::xs

CVE-2026-4522

Missing Authentication in HYPR Passwordless Enables Credentials Interception

Missing authentication for critical function vulnerability in HYPR Passwordless on Windows allows Credentials Interception. This issue affects HYPR Passwordless: before 11.1.1.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hypr

Products

Passwordless

CVE-2026-9086

Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak

CVE-2026-56766

Hydra - Stack Buffer Overflow in NTLM Authentication Handler

Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an excessively long domain string, causing base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling remote code execution on systems without stack protection.

CVSS 4.0 · 8.6 High EPSS 2.4% KEV · Not listed

Vendors

Vanhauser-thc

Products

Thc-hydra