CVE-2026-40514

SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG

SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys and initialization vectors derived from System.Random seeded with insufficient entropy, reducing the seed space to approximately 19,000 possible values. An unauthenticated attacker can use the attachment download endpoint as an oracle to determine the seed in use and derive encryption keys and initialization vectors to forge sharing tokens for arbitrary emails, attachments, or file storage contents without prior access to the targeted content.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Smartertools

Products

Smartermail

CVE-2026-9255

Tool Execution Without Authorization via Piped Stdin in Kiro CLI

Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker to execute arbitrary tools, including shell commands, without user approval by crafting content that is piped to kiro-cli via stdin. We recommend you to upgrade to kiro-cli version 1.28.0 or later.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Amazon Aws

Products

Kiro Cli Kiro Cli

CVE-2026-24162

Improper Deserialization Enables Code Execution in NVIDIA Merlin Transformers4Rec

NVIDIA Transformers4Rec for Linux contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Merlin Transformers4rec Transformers4rec

CVE-2026-6832

Nesquena Hermes WebUI Arbitrary File Deletion via Unvalidated session_id

Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/session/delete endpoint that allows authenticated attackers to delete files outside the session directory by supplying an absolute path or path traversal payload in the session_id parameter. Attackers can exploit unvalidated session identifiers to construct paths that bypass the SESSION_DIR boundary and delete writable JSON files on the host system.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Get-hermes Nesquena

Products

Hermes Web Ui Hermes-webui

CVE-2026-10800

PaddlePaddle FastDeploy MultimodalHasher hasher.py hash_features weak hash

A weakness has been identified in PaddlePaddle FastDeploy up to 2.4.1. Affected by this issue is the function hash_features of the file fastdeploy/multimodal/hasher.py of the component MultimodalHasher. Executing a manipulation can lead to use of weak hash. The attack requires local access. A high complexity level is associated with this attack. The exploitation is known to be difficult. This patch is called 374945747652a8d32965591c0c01a00c88b7067f. Applying a patch is advised to resolve this issue.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Paddlepaddle

Products

Fastdeploy

CVE-2026-10812

zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash

A vulnerability was detected in zilliztech GPTCache up to 0.1.44. Affected by this issue is the function BufferedReader.peek of the file gptcache/processor/pre.py of the component Cache Key Handler. Performing a manipulation of the argument input_data["image"] results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Zilliztech

Products

Gptcache

CVE-2026-10806

mjperpinosa stumasy add_post.php unrestricted upload

A vulnerability was found in mjperpinosa stumasy. The affected element is an unknown function of the file application/PHP/objects/updates/add_post.php. Performing a manipulation of the argument up_file_to_post results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mjperpinosa

Products

Stumasy

CVE-2026-40605

Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.1, a path traversal vulnerability in the cache deletion endpoint allows authenticated API access to delete directories outside the configured cache path. This can cause arbitrary data loss and service disruption. Version 2.17.1 fixes the issue.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Tautulli

Products

Tautulli

CVE-2019-25736

LabF nfsAxe 3.7 Ping Client Buffer Overflow

LabF nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious payload in the Host IP field. Attackers can craft a specially formatted input file with shellcode and overwrite the return address to execute calc.exe or other arbitrary commands.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Labf

Products

Nfsaxe

CVE-2019-25728

Care2x 2.7 Hospital Information System SQL Injection via ck_config

Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by manipulating the ck_config cookie parameter. Attackers can inject malicious SQL through the ck_config cookie in multiple endpoints including login.php, indexframe.php, and various module files to extract sensitive database information without authentication.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Care2x

Products

Care2x Hospital Information Management

CVE-2025-46638

Resource Exhaustion Leading to DoS in Dell BSAFE SSL-J

Dell BSAFE SSL-J contains an allocation of resources without limits or throttling vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to a Denial of Service (DoS).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Bsafe Ssl-j

CVE-2026-3888

Local Privilege Escalation in snapd

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed

Vendors

Canonical

Products

Ubuntu Ubuntu Linux

CVE-2026-10811

itsourcecode Fees Management System receipt.php sql injection

A security vulnerability has been detected in itsourcecode Fees Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /receipt.php. Such manipulation of the argument ef_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Fees Management System

CVE-2026-44479

Vercel: Non-interactive mode includes CLI arguments in suggested command output

Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode (--non-interactive or auto-detected AI agent), commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the user authenticated via --token or -t on the command line, the token value is included verbatim in those suggestions. The plaintext token may be captured in CI/CD logs, agent transcripts, or other automation output. This vulnerability is fixed in 52.0.1.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Vercel

Products

Vercel

CVE-2022-50957

Drupal avatar_uploader 7.x-1.0-beta8 Reflected XSS

Drupal avatar_uploader 7.x-1.0-beta8 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the file parameter. Attackers can craft URLs with script payloads in the file parameter of avatar_uploader.pages.inc to execute arbitrary JavaScript in victim browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Avatar Uploader Project

Products

Avatar Uploader

CVE-2026-28525

SWUpdate Integer Underflow in Multipart Upload Parser

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing. Attackers can trigger an integer underflow in the mg_http_multipart_continue_wait_for_chunk() function when the buffer length falls within a specific range, causing an out-of-bounds heap read past the allocated receive buffer to a local IPC socket.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Sbabic Swupdate

Products

Swupdate Swupdate

CVE-2026-6942

radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.

CVSS 4.0 · 9.3 Critical EPSS 1.9% KEV · Not listed

Vendors

Radare

Products

Radare2 Radare2 Mcp Server

CVE-2026-50033

DLL Hijacking Vulnerability in Acronis DeviceLock DLP Enables Local Privilege Escalation

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

CVSS 3.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Acronis

Products

Acronis Devicelock Dlp

CVE-2026-45433

Hardcoded Cryptographic Key Vulnerability in GX Earth ONT Models

This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware. A remote attacker could exploit this vulnerability by extracting the cryptographic private key from the firmware, which could lead to decryption of HTTPS traffic and Man-in-the-Middle (MITM) attacks on the targeted device.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Gx India

Products

Gx Earth 1010 Gx Earth 2022

CVE-2026-44682

DLL Hijacking Leading to Local Privilege Escalation in Acronis DeviceLock DLP

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

CVSS 3.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Acronis

Products

Acronis Devicelock Dlp