CVE-2026-7102

Tenda F456 httpd WriteFacMac FromWriteFacMac command injection

A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipulation of the argument mac results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

CVSS 4.0 · 5.3 Medium EPSS 3.3% KEV · Not listed

Vendors

Tenda

Products

F456 F456 Firmware

CVE-2026-5937

Foxit PDF Editor/Reader's insufficient parameter validation leads to denial-of-service vulnerability

Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argument" exception, ultimately causing the program to terminate.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2026-5938

Foxit PDF Editor/Reader Infinite Loop Denial-of-Service Vulnerability

Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2026-3503

Fault injection attack with ML-DSA and ML-KEM on ARM

Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attacker to compromise key material and/or cryptographic outcomes via induced transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion. This issue affects wolfSSL (wolfCrypt): commit hash d86575c766e6e67ef93545fa69c04d6eb49400c6.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wolfssl

Products

Wolfcrypt Wolfssl

CVE-2026-5939

UAF in Foxit PDF Editor/Reader via XFA calculate event

A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2026-4159

wc_PKCS7_DecodeEnvelopedData 1 byte out-of-bounds read

1-byte OOB heap read in wc_PKCS7_DecodeEnvelopedData via zero-length encrypted content. A vulnerability existed in wolfSSL 5.8.4 and earlier, where a 1-byte out-of-bounds heap read in wc_PKCS7_DecodeEnvelopedData could be triggered by a crafted CMS EnvelopedData message with zero-length encrypted content. Note that PKCS7 support is disabled by default.

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed

Vendors

Wolfssl

Products

Wolfssl

CVE-2026-5940

Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2026-5446

wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reuse

In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wc_AriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is zero-initialized at session setup and never incremented in non-FIPS builds. This vulnerability affects wolfSSL builds configured with --enable-aria and the proprietary MagicCrypto SDK (a non-default, opt-in configuration required for Korean regulatory deployments). AES-GCM is not affected because wc_AesGcmEncrypt_ex maintains an internal invocation counter independently of the call-site guard.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Wolfssl

Products

Wolfssl

CVE-2026-5941

Foxit PDF Editor/Reader AcroForm Signature Remote Code Execution Vulnerability

Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during internal data structure construction.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2026-5447

Heap buffer overflow in CertFromX509() via AuthorityKeyIdentifier

Heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier size confusion. A heap buffer overflow occurs when converting an X.509 certificate internally due to incorrect size handling of the AuthorityKeyIdentifier extension.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wolfssl

Products

Wolfssl

CVE-2026-5263

URI nameConstraints not enforced in ConfirmNameConstraints()

URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Wolfssl

Products

Wolfssl

CVE-2026-5942

Foxit PDF Editor/Reader AcroForm Signature Use-After-Free Vulnerability

Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidated objects and crash the program.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2026-5264

DTLS 1.3 ACK heap buffer overflow

Heap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buffer overflow.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Wolfssl

Products

Wolfssl

CVE-2026-5943

Foxit PDF Editor/Reader AcroForm Annotation Use-After-Free Remote Code Execution Vulnerability

Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modifications, object reference validity was not properly maintained, leading to a crash when accessing an invalid pointer during page information queries.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Pdf Editor Pdf Reader Foxit Pdf Editor and 1 more

CVE-2026-4958

OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization

A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.send_data of the file XAgentServer/application/websockets/replayer.py of the component WebSocket Endpoint. Such manipulation of the argument interaction_id leads to authorization bypass. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Openbmb

Products

Xagent

CVE-2026-4957

OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file

A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of the file XAgent/function_handler.py of the component API Key Handler. This manipulation of the argument api_key causes sensitive information in log files. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Openbmb

Products

Xagent

CVE-2026-4959

OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication

A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the component ShareServer WebSocket Endpoint. Performing a manipulation of the argument interaction_id results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openbmb

Products

Xagent

CVE-2026-7389

EyouCMS common.php GetSortData sql injection

A security vulnerability has been detected in EyouCMS up to 1.7.9. The affected element is the function GetSortData of the file application/common.php. The manipulation of the argument sort_asc leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Eyoucms

Products

Eyoucms

CVE-2026-0919

Unauthenticated Denial of Service via Oversized URL in HTTP Parser on TP-Link Tapo C210, C220 & C520WS

The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup code that assumes allocated buffers exist, leading to a crash and service restart. An unauthenticated attacker can force repeated service crashes or device reboots, causing denial of service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Tapo Tapo C220 Tapo C220 Firmware and 4 more

CVE-2026-35379

uutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class Handling

A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space character (0x20) in the [:graph:] class and excludes it from the [:print:] class, effectively reversing the standard behavior established by POSIX and GNU coreutils. This vulnerability leads to unintended data modification or loss when the utility is used in automated scripts or data-cleaning pipelines that rely on standard character class semantics. For example, a command executed to delete all graphical characters while intending to preserve whitespace will incorrectly delete all ASCII spaces, potentially resulting in data corruption or logic failures in downstream processing.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Uutils

Products

Coreutils