CVE-2026-40797

WordPress WebinarIgnition plugin <= 4.08.253 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder LLC WebinarIgnition allows Blind SQL Injection. This issue affects WebinarIgnition: from n/a through 4.08.253.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Saleswonder Wordpress

Products

Webinarignition Wordpress

CVE-2026-7834

EFM ipTIME NAS1dual misc_main.cgi get_csrf_whites stack-based overflow

A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This issue affects the function get_csrf_whites of the file /cgi/advanced/misc_main.cgi. Such manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Iptime

Products

Nas1dual

CVE-2026-31457

mm/damon/sysfs: check contexts->nr in repeat_call_fn

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts->nr in repeat_call_fn damon_sysfs_repeat_call_fn() calls damon_sysfs_upd_tuned_intervals(), damon_sysfs_upd_schemes_stats(), and damon_sysfs_upd_schemes_effective_quotas() without checking contexts->nr. If nr_contexts is set to 0 via sysfs while DAMON is running, these functions dereference contexts_arr[0] and cause a NULL pointer dereference. Add the missing check. For example, the issue can be reproduced using DAMON sysfs interface and DAMON user-space tool (damo) [1] like below. $ sudo damo start --refresh_interval 1s $ echo 0 | sudo tee \ /sys/kernel/mm/damon/admin/kdamonds/0/contexts/nr_contexts

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-29169

Apache HTTP Server: mod_dav_lock indirect lock crash

A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0. Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Http Server Apache Http Server

CVE-2026-32699

FacturaScripts unauthorized modification of immutable nick field via EditUser controller

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Neorazorx

Products

Facturascripts

CVE-2026-3118

Rhdh: graphql injection leading to platform-wide denial of service (dos) in rh developer hub orchestrator plugin

A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing. This results in the entire Backstage application crashing and restarting, leading to a platform-wide Denial of Service (DoS). As a result, legitimate users temporarily lose access to the platform.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Developer Hub Rhdh

CVE-2026-6918

Eclipse Open9J: Eclipse Open9J: Denial of Service in JITServer via crafted TCP message

In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Openj9

CVE-2023-54345

Frappe Framework ERPNext 13.4.0 Remote Code Execution

Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Erpnext Frappe

Products

Erpnext Erpnext

CVE-2026-7707

Open5GS UDR nudr-handler.c udr_nudr_dr_handle_subscription_context denial of service

A vulnerability was found in Open5GS up to 2.7.7. Impacted is the function udr_nudr_dr_handle_subscription_context of the file /src/udr/nudr-handler.c of the component UDR. The manipulation of the argument pei results in denial of service. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Open5gs

Products

Open5gs

CVE-2026-7695

Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform elecMaxMinAvgValue sql injection

A vulnerability has been found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. This affects an unknown function of the file /SubstationWEBV2/main/elecMaxMinAvgValue. The manipulation of the argument fCircuitids leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Acrel Electrical

Products

Eems Enterprise Power Operation And Maintenance Cloud Platform

CVE-2026-6553

TYPO3 CMS Stores Cleartext Password in User Settings Module

Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Typo3

CVE-2026-7688

Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injection

A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. This affects the function _checkValForAPI of the file htdocs/expedition/class/expedition.class.php of the component Shipments API Endpoint. The manipulation of the argument fields leads to sql injection. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Dolibarr

Products

Erp Crm

CVE-2026-43824

github.com/argoproj/argo-cd/: Argo CD: Information disclosure via ServerSideDiff allows reading Kubernetes Secret data

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Argoproj

Products

Argo-cd Argo Cd

CVE-2026-37459

frr: denial of service via crafted BGP UPDATE message

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Frrouting

Products

Frrouting

CVE-2026-43864

mutt: Mutt: Denial of Service via null pointer dereference in show_sig_summary

mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Mutt

Products

Mutt

CVE-2026-43861

mutt: Mutt: URL processing vulnerability due to improper null character handling

mutt before 2.3.2 does not check for '\0' in url_pct_decode.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Mutt

Products

Mutt

CVE-2026-43859

mutt: Mutt: Low integrity impact in IMAP authentication due to cryptographic digest mishandling

mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Mutt

Products

Mutt

CVE-2026-43863

mutt: Mutt: Remote Denial of Service via crafted input

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Mutt

Products

Mutt

CVE-2026-43862

mutt: Mutt: Security bypass due to mishandled IMAP authentication

In mutt before 2.3.2, the imap_auth_gss security level is mishandled.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Mutt

Products

Mutt

CVE-2026-43860

mutt: mutt: Authentication bypass due to IMAP CRAM-MD5 hash truncation

mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Mutt

Products

Mutt