Text To Speech – Ttswp CVEs and Security Vulnerabilities

CVE-2026-120427

MrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read

MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private template content of every user on the instance.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mrdoc

Products

Mrdoc

CVE-2026-120347

dayrui XunRuiCMS Member View.php View sql injection

A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Dayrui Xunruicms

Products

Xunruicms Xunruicms

CVE-2026-120342

mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mathurvishal

Products

Cloudclassroom-php-project

CVE-2026-120337

VStarcam O-KAM SuperIPCam P2P Session Teardown SuperIPCam.exe FUN_005a2d44 use after free

A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperIPCam.exe of the component P2P Session Teardown. This manipulation causes use after free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Vstarcam

Products

O-kam Superipcam

CVE-2026-120325

Webpro-nl Knip Workspace IssueFixer.ts writeFile path traversal

A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packages/knip/src/IssueFixer.ts of the component Workspace Handler. Such manipulation of the argument workspaces leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Webpro-nl

Products

Knip

CVE-2026-120320

jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization

A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.3 is able to resolve this issue. This patch is called 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. It is recommended to upgrade the affected component.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Jxxghp

Products

Moviepilot

CVE-2026-120315

LobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFile

LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile(). Attackers can create a file record via file.createFile with a traversal name, then trigger document parsing to overwrite application files like startServer.js for code execution or denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Lobehub

Products

Lobe Chat

CVE-2026-120311

Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID

Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can disclose credentials and grant tokens or delete configuration files to weaken AuthGuardian authorization.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Network-ai

Products

Network-ai

CVE-2026-120281

WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow

A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Wavlink

Products

Wn536ax6-a

CVE-2026-119724

Apache JClouds: XML External Entity (XXE) in provider-response parsing

** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Jclouds

CVE-2026-119084

Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters

Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath. To remediate this issue, users should upgrade to version 2.3.0 or later.

Search vulnerabilities

MrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read

dayrui XunRuiCMS Member View.php View sql injection

mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection

VStarcam O-KAM SuperIPCam P2P Session Teardown SuperIPCam.exe FUN_005a2d44 use after free

Webpro-nl Knip Workspace IssueFixer.ts writeFile path traversal

jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization

LobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFile

Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID

WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow

Apache JClouds: XML External Entity (XXE) in provider-response parsing

Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters

Tanium addressed an improper access controls vulnerability in Discover.

Tanium addressed an uncontrolled resource consumption vulnerability in Discover.

Tanium addressed an improper access controls vulnerability in Discover.

Tanium addressed an information disclosure vulnerability in Discover.

Tanium addressed an information disclosure vulnerability in Discover.

Tanium addressed an improper access controls vulnerability in Discover.

Tanium addressed an improper output sanitization vulnerability in Discover.

Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response.

macOS Privacy Preference Bypass via Authorization Flaw