CVE-2026-121547

dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname, causing spoofed or hidden output and window-title changes when another user runs dysk.

CVSS 4.0 · 1 Low EPSS < 1% KEV · Not listed

Vendors

Canop

Products

Dysk

CVE-2026-121552

domain-admin before 1.6.79 Missing Authorization via getGroupUserList

Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dromara

Products

Domain-admin

CVE-2026-121555

Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Drizzletime

Products

Foxel

CVE-2026-121560

LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Logchimp

Products

Logchimp

CVE-2026-65107

Unauthorized File Write via sbcast Supplemental Group Manipulation in NVIDIA Slurm

NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Slurm

CVE-2026-65108

Heap Buffer Overflow in NVIDIA Slurm slurmstepd with Root Privileges

NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Slurm

CVE-2026-97350

Local Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for Windows

Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow non-privileged local users to influence operations performed with NT AUTHORITY\SYSTEM privileges. Two attack vectors have been identified: * Improper authorization of configuration checksum updates: The privileged service does not properly validate the authorization of connecting clients when updating the checksum of an OpenVPN configuration. This allows a non-privileged local user to modify an OpenVPN configuration and set a valid checksum without administrator privileges. The modified configuration is subsequently processed with NT AUTHORITY\SYSTEM privileges. * Argument injection via proxy settings: The client does not properly validate or sanitize proxy settings before passing them as arguments to OpenVPN. A non-privileged local user can inject additional arguments through the proxy settings, influencing the execution of OpenVPN with NT AUTHORITY\SYSTEM privileges. This attack vector does not require direct communication with the privileged service or modification of the protected OpenVPN configuration.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Securepoint

Products

Securepoint Ssl Vpn Client V2

CVE-2026-120754

Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter

HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.

CVSS 4.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Hdfgroup The Hdf Group

Products

Hdf5 Scale-offset Filter

CVE-2026-120755

Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter

HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.

CVSS 4.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hdfgroup The Hdf Group

Products

Hdf5 Szip Filter

CVE-2026-65109

Symlink Resolution Issue in NVIDIA Slurm Container Cleanup Allows Unintended File Deletion

NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Slurm

CVE-2026-65138

slurm: slurm: Information disclosure via arbitrary memory read in slurmstepd socket API

NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Slurm

CVE-2026-65139

slurm: Slurm: Arbitrary code execution via SQL injection in SlurmDBD RPCs

NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Slurm

CVE-2026-65140

Operator Privilege Escalation via Inconsistent Authorization Checks in NVIDIA Slurm

NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Slurm

CVE-2026-65165

Unauthorized Node Access via Manipulated Nodelist in NVIDIA Slurm

NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Slurm

CVE-2026-65168

Heap-Based Buffer Overflow in NVIDIA Slurm Socket Handling

NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Slurm

CVE-2026-92080

Path Traversal Leading to Arbitrary Mount in TÜBİTAK BİLGEM's pardus-boot-repair

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal. This issue affects pardus-boot-repair: from 1.0.8 before 1.1.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tubitak Bilgem Software Technologies Research Institute

Products

Pardus Boot Repair

CVE-2026-121602

Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOIN

Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Solanum-ircd

Products

Solanum

CVE-2026-121603

Solanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL Handler

Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Solanum-ircd

Products

Solanum

CVE-2026-115714

Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections

Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elastic Docker Images

CVE-2026-121624

Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation

Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Nanosystems

Products

Supremo