CVE-2026-119704

Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside a jail can plant symlinks pointing to host paths or other jail roots, so administrator-run copies overwrite or read host files with root privileges.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bastillebsd

Products

Bastille

CVE-2026-119700

WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpgraphql

Products

Wpgraphql Wpgraphql

CVE-2026-119664

Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wannabespace

Products

Tamery

CVE-2026-119660

MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Yincongcyincong

Products

Musebot

CVE-2026-119656

CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Coreshop

Products

Coreshop

CVE-2026-119652

HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hulaspark

Products

Hula-server

CVE-2026-119648

BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tencent

Products

Blueking Cmdb

CVE-2026-119644

Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wangyunf

Products

Blossom

CVE-2026-119601

AFFLIB through 3.7.22 Heap Out-of-Bounds Write in af_get_page

AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Afflib Project

Products

Afflib

CVE-2026-119597

OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Aidotnet

Products

Opendeepwiki

CVE-2026-119576

ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arcadedata

Products

Arcadedb

CVE-2026-119567

vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Vsftpd Project

Products

Vsftpd

CVE-2026-119563

phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Phpmyadmin

Products

Phpmyadmin

CVE-2026-119559

OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host's SNI with a protected Host header to access protected content.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Litespeedtech

Products

Openlitespeed

CVE-2026-119555

Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enrolment checks, so non-editing teachers can iterate userid values to read other groups' grade feedback and users' names and identity fields such as email.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2026-119547

Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Forgejo

Products

Forgejo

CVE-2026-119428

phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpmyadmin

Products

Phpmyadmin

CVE-2026-119424

OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity

OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Opnsense

Products

Core Opnsense

CVE-2026-119420

Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Getlago

Products

Lago

CVE-2026-119416

CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching

CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cakephp

Products

Cakephp