CVE-2026-121390

FreeRDP before 3.32.2 Null Pointer Crash via ARM Gateway Response

FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing or non-string redirectedServerCert field and passes a null buffer to the certificate parser. A malicious or malformed user-selected gateway can return such a response to abort the client process.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-121386

FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers

FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-120752

PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120740

Hivex: hivex: denial of service via out-of-bounds read in big-data block processing

A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application processing the registry file to crash, resulting in a Denial of Service (DoS).

CVSS 3.1 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Rhel Els

CVE-2026-120518

BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler

The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submitting a zero-byte file with the 'field_N_hidden' parameter during registration makes the plugin store the raw value, which is then resolved against the document root when the pending signup is activated. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted. Requires open registration and an image-type profile field on the signup form.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120501

An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable src

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to render the file as a table, exposing any stored remote credentials.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redimp

Products

Otterwiki

CVE-2026-120416

AndyFactory newspaper4k Image Extractor image_extractor.py Article.parse server-side request forgery

A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Andyfactory

Products

Newspaper4k

CVE-2026-119738

Amlogic DroidLogic SubTitleService Infinite Loop via get_vob_spu()

The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Amlogic Nexbox

Products

Amlogic Android Sdk A95x

CVE-2026-119734

Munshi IDOR via Purchase Inquiry Thread Endpoint

Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Attackers can modify the thread ID to read supplier communication and quotation-related content belonging to other users, resulting in unauthorized disclosure of sensitive business information outside their access scope.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Petpooja

Products

Munshi

CVE-2026-109161

Buffer Overflow in Digital I/O

Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Welotec

Products

Tk100 Tk500 V2 Tk500 V3

CVE-2026-106991

Incorrect Access Control Allows Registered Users to Manipulate Forum Threads in hustoj 24.09.10–26.08.19

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-105978

Command Injection in Management Control Functions

Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Welotec

Products

Tk100 Tk500 V2 Tk500 V3

CVE-2026-101473

Unauthenticated HTTP Access Enables Remote Takeover of Oracle Agile Product Lifecycle Management

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Agile Product Lifecycle Management For Process

CVE-2026-101564

Oracle Agile PLM 2.6 Unauthenticated Data Access via TLS

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect). The supported version that is affected is 2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Agile Plm

CVE-2026-101571

Oracle Helidon Local Privilege Escalation via IDCS Mapper

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-idcs-mapper). Supported versions that are affected are 3.0.0-3.2.21 and 4.0.0-4.5.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Helidon executes to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Helidon

CVE-2026-99261

drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Linux Kernel

CVE-2026-101547

Unauthenticated HTTP Data Modification and Read Vulnerability in Oracle Demand Planning

Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demand Planning. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Demand Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Demand Planning accessible data as well as unauthorized read access to a subset of Oracle Demand Planning accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Demand Planning

CVE-2026-101574

Unauthenticated OIDC Component Vulnerability in Oracle Helidon Enables Unauthorized Data Exposure and Limited Modification

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: OIDC). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data as well as unauthorized update, insert or delete access to some of Helidon accessible data. CVSS 3.1 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N).

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Helidon

CVE-2026-77879

Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API

Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Control-webpanel Control Web Panel

Products

Webpanel Control Web Panel

CVE-2026-120492

Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls

Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant on origins that strip semicolon path parameters.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Chainlit

Products

Chainlit