CVE-2026-123606

Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification

The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123607

Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. Upstream attackers can return NoData or NXDomain responses with a cross-zone SOA record to panic debug builds or exhaust memory in release builds.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123608

Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression

Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123610

rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rustls Rustls Project

Products

Rustls Rustls

CVE-2026-123611

rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello

rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later ClientHellos to send only classical shares and lose post-quantum confidentiality.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rustls Rustls Project

Products

Rustls Rustls

CVE-2026-124465

Trendyol kafka-konsumer 2.3.3 before 2.6.18 Denial of Service via Batch Consumer Panic

Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before offset commit, causing a persistent crash loop.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Trendyol

Products

Kafka-konsumer

CVE-2026-14434

IBM Turbonomic kubeturbo agent used by IBM Turbonomic Application Resource Management is affected by vulnerability

IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Turbonomic Kubeturbo Agent

CVE-2026-120386

Effect File Validation Flaw Causes Application Crash

Effekseer improperly validates "effect" files. When a crafted effect file is loaded to the affected runtime, the host process may be forced to crash.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Effekseer

Products

Effekseer

CVE-2026-109582

Insecure Storage of Sensitive Information in SS1 Exposes Confidential Data

Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd. Sensitive information used by the product may be obtained.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Dos-osaka

Products

Ss1

CVE-2026-113437

Arbitrary File Deletion via Path Traversal in SS1/SS1 Cloud and rocoeyes

Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd. and the ODM product rocoeyes provided by Rococo Co. Ltd. Arbitrary files may be deleted.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Dos-osaka Rococo

Products

Ss1 Ss1 Cloud Rocoeyes

CVE-2026-123870

[Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when GITHUB_WEBHOOK_SECRET is unset

The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed

Vendors

Eclipse Foundation

Products

Otterdog

CVE-2026-92683

Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql

Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Neo4j

Products

Graphql

CVE-2026-124621

kongxin-github Java_Library_Management_System Swing UI Layer MainInterface.java Landing.sureadmin improper authorization

A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.deletebook/Category.addcategory/Category.setcategory/Landing.sureadmin of the file src/view/MainInterface.java of the component Swing UI Layer. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kongxin-github

Products

Java Library Management System

CVE-2026-112172

Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure

CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.

CVSS 4.0 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Xdent Xmedical

CVE-2026-118450

Venere loads replaceable unsigned components from a writable installation location

Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Venere

CVE-2026-118458

AIS shared test login provider contains fixed administrative credentials

The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.

CVSS 4.0 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Phronesis Venere

CVE-2026-118459

AIS PasswordSOS permits authentication without legitimate credentials

A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118460

AIS embedded private keys enable practitioner impersonation

Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.

CVSS 4.0 · 8 High EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118461

AIS PersonnelService client performs unauthenticated doctor-specific operations

The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.

CVSS 4.0 · 8 High EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118462

AIS update mechanism executes unverified code

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more