CVE-2026-93325

Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx

Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-91910

Path Traversal Vulnerability in Dell OpenManage Enterprise Allows Information Disclosure

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information exposure.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Openmanage Enterprise

CVE-2026-121577

Unescaped header separators in whatstk build a regular expression that backtracks exponentially

Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the CPU of the process that parses it for an unbounded time, because the function builds the header regular expression by replacing each %x code with its named capture group and leaves every other character of the header format in the pattern unescaped. A header whose date separator is a regular expression metacharacter therefore alters the pattern instead of matching itself: a separator of + quantifies the preceding capture group, giving (?P<day>\d{1,2})+(?P<month>\d{1,2})+(?P<year>\d{2,4}), and a run of digits that cannot complete the header then makes the engine try every way of partitioning that run. Header auto detection is enabled by default and derives the format from the text of the file, so the separator is taken from the export itself and no header format has to be passed by the caller. Separators of (, ) and \ instead raise re.PatternError, separators of *, | and ? raise TypeError, and separators of ^ and $ raise KeyError, none of which the library catches. This results in the parse of a file of a few hundred bytes consuming CPU without completing, or in an uncaught exception in the calling program.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Lucasrodes

Products

Whatstk

CVE-2026-121565

Tanium addressed an improper certificate validation vulnerability in multiple products

Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120775

Tanium addressed a heap-based buffer overflow vulnerability in Deploy.

Tanium addressed a heap-based buffer overflow vulnerability in Deploy.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Deploy

CVE-2026-120451

libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driver

libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Gphoto

Products

Libgphoto2

CVE-2026-120447

HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code

HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Bufanyun

Products

Hotgo

CVE-2026-120443

GoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Sea-team

Products

Gofound

CVE-2026-120439

QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort

QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Quickjs-ng Quickjs Project

Products

Quickjs Quickjs

CVE-2026-120435

Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow in xpmtoppm

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte colorName hash entries, causing crashes or potentially code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Netpbm Project

Products

Netpbm

CVE-2026-120431

Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflow

Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Netpbm Project

Products

Netpbm

CVE-2026-120427

MrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read

MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private template content of every user on the instance.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mrdoc

Products

Mrdoc

CVE-2026-120347

dayrui XunRuiCMS Member View.php View sql injection

A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Dayrui Xunruicms

Products

Xunruicms Xunruicms

CVE-2026-120342

mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mathurvishal

Products

Cloudclassroom-php-project

CVE-2026-120337

VStarcam O-KAM SuperIPCam P2P Session Teardown SuperIPCam.exe FUN_005a2d44 use after free

A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperIPCam.exe of the component P2P Session Teardown. This manipulation causes use after free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Vstarcam

Products

O-kam Superipcam

CVE-2026-120325

Webpro-nl Knip Workspace IssueFixer.ts writeFile path traversal

A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packages/knip/src/IssueFixer.ts of the component Workspace Handler. Such manipulation of the argument workspaces leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Webpro-nl

Products

Knip

CVE-2026-120320

jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization

A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.3 is able to resolve this issue. This patch is called 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. It is recommended to upgrade the affected component.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Jxxghp

Products

Moviepilot

CVE-2026-120315

LobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFile

LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile(). Attackers can create a file record via file.createFile with a traversal name, then trigger document parsing to overwrite application files like startServer.js for code execution or denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Lobehub

Products

Lobe Chat

CVE-2026-120311

Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID

Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can disclose credentials and grant tokens or delete configuration files to weaken AuthGuardian authorization.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Network-ai

Products

Network-ai

CVE-2026-120281

WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow

A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Wavlink

Products

Wn536ax6-a