CVE-2026-109683

UPnP Newline Injection Vulnerability in TP-Link Archer BE805

A newline injection vulnerability exists in the UPnP service of Archer BE805 v1 such that an adjacent attacker can supply newline characters in a UPnP port-mapping description due to improper sanitization, resulting in possible injection of unintended content into UPnP port-mapping data. Successful exploitation may allow an unauthenticated attacker on the local network to modify runtime UPnP port-mapping information and create spoofed entries within the affected service. The issue is limited to the integrity of UPnP mapping data and does not demonstrate code execution or privilege escalation.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Archer Be805 V1

CVE-2026-123787

nexmoe VidBee Local HTTP Service local-api.ts information disclosure

A weakness has been identified in nexmoe VidBee up to 1.3.13/2.0.2. The affected element is an unknown function of the file apps/desktop/src/main/local-api.ts of the component Local HTTP Service. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 is sufficient to fix this issue. This patch is called 141b8d39c1c11da4589264f814cee077df81e7f6. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nexmoe

Products

Vidbee

CVE-2026-77442

Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)

Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller's user_id while replacing the targeted integration's provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim's integration. Exploitation requires obtaining the victim's non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ignisda

Products

Ryot

CVE-2026-118054

LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter

The LearnPress – Course Review plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'review_title (inside `data.args.review_title`)' parameter in all versions up to, and including, 4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes after an administrator approves the submitted review, though sites with comment_previously_approved auto-approval configured may bypass manual moderation.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Thimpress Wordpress-extensions

Products

Learnpress – Course Review Learnpress

CVE-2026-119510

WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Stored XSS.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Saeed Wordpress-extensions

Products

Mc Woocommerce Wishlist Mc Woocommerce Wishlist

CVE-2026-119511

WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Saeed Wordpress-extensions

Products

Mc Woocommerce Wishlist Mc Woocommerce Wishlist

CVE-2026-123570

Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts

The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123571

Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding

Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to trigger a panic via malformed records. Attackers can send a crafted TSIG record in DNS wire format to cause unchecked subtraction underflow, crashing builds with overflow checks enabled and causing denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123572

Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser

Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123574

Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser

The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123575

Hickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodies

Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-95778

Remote Code Execution in HPE Morpheus Software

A remote code execution vulnerability exists in HPE Morpheus Software.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Morpheus Software

CVE-2026-95733

Use of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code Execution

A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95736

Unauthenticated Adjacent Improper Certificate Validation Vulnerabilities in HPE Networking Fabric Composer

Improper certificate validation vulnerabilities exist in the affected interface of HPE Networking Fabric Composer, which could be exploited by an unauthenticated adjacent attacker if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept sensitive information.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95737

Local Privilege Escalation in HPE Networking Fabric Composer

A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with high privileges to gain elevated privileges on the underlying host operating system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95738

Authentication Bypass in the Affected Interface of HPE Networking Fabric Composer

Authentication bypass vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95749

Unauthenticated Missing Integrity Verification in HPE Networking Fabric Composer

A missing integrity verification vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95752

Local Privilege Escalation in HPE Networking Fabric Composer

A local privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to elevate their privileges on the affected system.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95756

Authenticated Command Injection Vulnerability in the API of HPE Networking Fabric Composer

A command injection vulnerability exists in the API of HPE Networking Fabric Composer and could be exploited by an authenticated remote attacker with administrative privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain elevated privileges on the underlying operating system.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-119503

WordPress Welcart e-Commerce plugin <= 2.12.6 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Code Injection.This issue affects Welcart e-Commerce: from n/a through 2.12.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Welcart Wordpress-extensions

Products

Welcart E-commerce Welcart E-commerce