CVE-2026-124465

Trendyol kafka-konsumer 2.3.3 before 2.6.18 Denial of Service via Batch Consumer Panic

Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before offset commit, causing a persistent crash loop.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Trendyol

Products

Kafka-konsumer

CVE-2026-14434

IBM Turbonomic kubeturbo agent used by IBM Turbonomic Application Resource Management is affected by vulnerability

IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Turbonomic Kubeturbo Agent

CVE-2026-120386

Effect File Validation Flaw Causes Application Crash

Effekseer improperly validates "effect" files. When a crafted effect file is loaded to the affected runtime, the host process may be forced to crash.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Effekseer

Products

Effekseer

CVE-2026-109582

Insecure Storage of Sensitive Information in SS1 Exposes Confidential Data

Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd. Sensitive information used by the product may be obtained.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Dos-osaka

Products

Ss1

CVE-2026-113437

Arbitrary File Deletion via Path Traversal in SS1/SS1 Cloud and rocoeyes

Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd. and the ODM product rocoeyes provided by Rococo Co. Ltd. Arbitrary files may be deleted.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Dos-osaka Rococo

Products

Ss1 Ss1 Cloud Rocoeyes

CVE-2026-123870

[Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when GITHUB_WEBHOOK_SECRET is unset

The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed

Vendors

Eclipse Foundation

Products

Otterdog

CVE-2026-92683

Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql

Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Neo4j

Products

Graphql

CVE-2026-124621

kongxin-github Java_Library_Management_System Swing UI Layer MainInterface.java Landing.sureadmin improper authorization

A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.deletebook/Category.addcategory/Category.setcategory/Landing.sureadmin of the file src/view/MainInterface.java of the component Swing UI Layer. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kongxin-github

Products

Java Library Management System

CVE-2026-112172

Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure

CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.

CVSS 4.0 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Xdent Xmedical

CVE-2026-118450

Venere loads replaceable unsigned components from a writable installation location

Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Venere

CVE-2026-118458

AIS shared test login provider contains fixed administrative credentials

The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.

CVSS 4.0 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Phronesis Venere

CVE-2026-118459

AIS PasswordSOS permits authentication without legitimate credentials

A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118460

AIS embedded private keys enable practitioner impersonation

Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.

CVSS 4.0 · 8 High EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118461

AIS PersonnelService client performs unauthenticated doctor-specific operations

The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.

CVSS 4.0 · 8 High EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118462

AIS update mechanism executes unverified code

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118464

AIS shared cryptographic services use fixed cryptographic secrets

Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118465

AIS products use vendor-wide hard-coded database credentials

Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118467

AIS products expose clinical and personal data via logs and telemetry

Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118468

AIS XML parsers allow external entity resolution

XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118790

Multiple Hardcoded Credentials

Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Wingesfar