CVE-2026-88811

Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Rancher

CVE-2026-116116

Yoosee GM8135S Camera Secure Boot signature verification

A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Yoosee

Products

Gm8135s Camera

CVE-2026-115823

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Miyagawa

Products

Starman

CVE-2026-110475

Improper Authentication Vulnerability in CreditNirvana Collections Platform

This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system. Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Creditnirvana

Products

Creditnirvana Collections Platform (collectionworkz) Creditnirvana Collections Platform Collectionworkz

CVE-2026-79872

Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8

A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-63244

Authentication Bypass Vulnerability

An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, potentially resulting in unauthorised access to user accounts and full administrative control of the LMS platform.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wizlearn Technologies

Products

Learning Management System

CVE-2026-117603

Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass

Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Electrum

Products

Electrum

CVE-2026-115931

Arbitrary file read and backend crash through unrestricted provider method calls

Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Gitroomhq

Products

Postiz-app

CVE-2026-107685

WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers

Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on. The OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected. This issue affects req_llm: from 1.9.0 before 1.29.0.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Agentjido

Products

Req Llm

CVE-2026-79853

Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10

Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79874

Authentication Bypass in the API allows Administrative Access of AOS-10

An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79873

Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access

Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data on affected devices.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-120344

WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection

A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 10 Critical EPSS 2.0% KEV · Not listed

Vendors

Wavlink

Products

Wn551x3-a

CVE-2026-120283

Linksys E8450 portal.cgi strcpy stack-based overflow

A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Linksys

Products

E8450 E8450 Firmware

CVE-2026-120279

WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection

A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 10 Critical EPSS 2.0% KEV · Not listed

Vendors

Wavlink

Products

Wn536ax6-a

CVE-2026-120240

WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection

A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

CVSS 4.0 · 9.4 Critical EPSS 1.7% KEV · Not listed

Vendors

Wavlink

Products

Wn553x1-b

CVE-2026-120232

Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption

A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit is publicly available and might be used. A fix is planned for the upcoming release.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Horizon Datasys

Products

Reboot Restore Standard

CVE-2026-120228

WAVLINK WN553X1-B ioos Service sub_416D88 os command injection

A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 9.4 Critical EPSS 1.7% KEV · Not listed

Vendors

Wavlink

Products

Wn553x1-b

CVE-2026-120224

Oray Pugongying X5 Pro API Authorization run_async_task improper authorization

A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Oray

Products

Pugongying X5 Pro

CVE-2026-120209

AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Anji-plus

Products

Aj-report