CVE-2026-9950

chromium-browser: chromium-browser: Insufficient validation of untrusted input in iOS

Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Iphone Os Chrome

CVE-2026-10265

itsourcecode Content Management System edit_topic.php sql injection

A vulnerability was identified in itsourcecode Content Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/edit_topic.php. Such manipulation of the argument topic_id leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Content Management System

CVE-2026-9759

NULL Pointer Dereference in Wireshark

ROHC protocol dissector crash in Wireshark 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-10269

decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization

A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Decolua

Products

9router

CVE-2026-10259

H3C Magic B0 aspForm SetMobileAPInfoById stack-based overflow

A security vulnerability has been detected in H3C Magic B0 up to 100R002. The affected element is the function SetMobileAPInfoById of the file /goform/aspForm. Such manipulation of the argument param leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

H3c

Products

Magic B0

CVE-2026-45701

Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.23 and 3.0.6, the password reset tokenand API key generation uses a weak cryptographical hash algorithm. This issue has been patched in versions 2.6.23 and 3.0.6.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sulu

Products

Sulu

CVE-2026-45707

n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.2, when ENABLE_MULTI_TENANT=true, the HTTP transport documents that the target n8n instance is selected per-request from x-n8n-url / x-n8n-key headers. Requests that omitted those headers — or supplied only one of them — silently fell back to the process-level N8N_API_URL / N8N_API_KEY credentials configured for the operator's own n8n instance. As a result, an authenticated MCP tenant could cause n8n management calls to execute against the operator's instance instead of its own. This affects HTTP-mode deployments of n8n-mcp that are run as a shared multi-tenant service. Single-tenant deployments (ENABLE_MULTI_TENANT unset or false) are not affected. This vulnerability is fixed in 2.51.2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Czlonkowski N8n-mcp

Products

N8n-mcp N8n-mcp

CVE-2026-43081

net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ Fix the field masks to match the hardware layout documented in downstream GSI (GSI_V3_0_EE_n_GSI_EE_GENERIC_CMD_*). Notably this fixes a WARN I was seeing when I tried to send "stop" to the MPSS remoteproc while IPA was up.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2025-41265

OS Command Injection in Waterfall WF-500 Administration WebUI Allows Remote Authenticated Execution

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-500 TX Host.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Waterfall Waterfall-security

Products

Wf-500 Wf-500 Wf-500 Firmware

CVE-2025-41266

OS Command Injection in Waterfall WF‑500 Administration WebUI Enables Remote Execution

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-500 TX Host.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Waterfall Waterfall-security

Products

Wf-500 Wf-500 Wf-500 Firmware

CVE-2025-41267

OS Command Injection in Waterfall WF‑500 TX Host Administration WebUI

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-500 TX Host.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Waterfall Waterfall-security

Products

Wf-500 Wf-500 Wf-500 Firmware

CVE-2025-41271

Relative Path Traversal in Waterfall WF-500 Console WebUI Enables Remote File Read

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to read arbitrary files from the device.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Waterfall Waterfall-security

Products

Wf-500 Wf-500 Wf-500 Firmware

CVE-2025-41273

Authentication Bypass in Waterfall WF‑500 Console WebUI

Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to bypass authentication of the Console web application and perform actions as an authenticated user.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Waterfall Waterfall-security

Products

Wf-500 Wf-500 Wf-500 Firmware

CVE-2025-41278

Out‑of‑Bounds Read Allowing Remote Code Execution via TX Host Access on Waterfall WF‑500

Nozomi Networks Labs identified a CWE-125: Out-of-bounds Read in Waterfall WF-500 RX Host in version 7.10.0.0 R2601141040 that allows attackers with access to the TX Host to execute code on the RX Host.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Waterfall Waterfall-security

Products

Wf-500 Wf-500 Wf-500 Firmware

CVE-2025-41280

Relative Path Traversal in Waterfall WF‑500 Allowing Remote Code Execution

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal (Zip Slip) in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector is configured and file compression is enabled.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Waterfall Waterfall-security

Products

Wf-500 Wf-500 Wf-500 Firmware

CVE-2025-41279

OS Command Injection in Waterfall WF-500 Administration WebUI Allows Remote Authenticated RCE

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-500 RX Host.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Waterfall Waterfall-security

Products

Wf-500 Wf-500 Wf-500 Firmware

CVE-2025-41281

OS Command Injection in Nozomi Networks Waterfall WF-500 RX Host Enables Remote Code Execution

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector is configured.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Waterfall Waterfall-security

Products

Wf-500 Wf-500 Wf-500 Firmware

CVE-2026-45344

LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on uninitialized LinkAce instances accepts attacker-controlled database credential fields and writes them back into .env without escaping. A remote attacker who can reach the setup endpoints and supply a database they control can inject mail configuration variables and achieve command execution when the application later sends mail. This vulnerability is fixed in 2.5.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Kovah

Products

Linkace

CVE-2026-9934

chromium-browser: Use after free in Aura

Use after free in Aura in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-9941

chromium-browser: Use after free in ANGLE

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome