CVE-2026-110133

Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback

A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ghostscript Red Hat Redhat

Products

Ghostscript Enterprise Linux Enterprise Linux and 1 more

CVE-2026-109971

Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool

A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Openshift and 2 more

CVE-2026-109970

Clevis: clevis: pkcs#11 token pin written to world-readable file

A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Openshift and 2 more

CVE-2026-109969

Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary device/key pairs, or connect to the data socket to receive LUKS passphrases.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Openshift and 2 more

CVE-2026-109968

Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Openshift and 2 more

CVE-2026-121059

chromium-browser: Information leak in Core

Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-50628

Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Cxf Build Of Apache Camel Fuse and 1 more

CVE-2026-82155

Untrusted Search Path Vulnerability in Dell OS Recovery Tool Enabling Local Command Execution

Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Os Recovery Tool

CVE-2026-59267

Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption

A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Openoffice

CVE-2026-120319

Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization

A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Publiccms

Products

Publiccms

CVE-2026-120314

Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Network-ai

Products

Network-ai

CVE-2026-120310

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Parse Community Parseplatform

Products

Parse Server Parse-server

CVE-2026-120280

WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection

A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 10 Critical EPSS 2.0% KEV · Not listed

Vendors

Wavlink

Products

Wn536ax6-a

CVE-2026-120276

WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection

A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

CVSS 4.0 · 10 Critical EPSS 3.2% KEV · Not listed

Vendors

Wavlink

Products

Wn536ax6-a

CVE-2026-120250

OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections

OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a forged certificate to intercept SMTP credentials and all later mail, including password-reset links.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Marketcalls

Products

Openalgo

CVE-2026-120246

FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-120241

Ruijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflow

A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ruijie

Products

Rg-es205gc Rg-es206gc-p Rg-es208gc and 2 more

CVE-2026-120237

ag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumption

A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/typescript/packages/client/src/interrupts/index.ts of the component Interrupt expiry. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ag-ui-protocol

Products

Ag-ui

CVE-2026-120233

ag-ui-protocol ag-ui HttpAgent http.ts information disclosure

A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ag-ui-protocol

Products

Ag-ui

CVE-2026-120229

WAVLINK WN553X1-B ioos sub_416B50 os command injection

A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 9.4 Critical EPSS 2.8% KEV · Not listed

Vendors

Wavlink

Products

Wn553x1-b