CVE-2026-115750

mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Frontmcp

Products

Mcp-from-openapi

CVE-2026-115495

Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket

Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Mobile Vpn With Ssl Client

CVE-2026-115413

AWS API MCP Server OAuth Token Audience Validation Bypass

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate this issue, users should upgrade to version 1.6.0 and configure the expected token audience or client ID for the server.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Aws-api-mcp-server

CVE-2026-115353

Mistune before 3.3.0 Path Traversal via include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Lepture Mistune Project

Products

Mistune Mistune

CVE-2026-115334

Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Uselotus

Products

Lotus

CVE-2026-115330

Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Uselotus

Products

Lotus

CVE-2026-114598

Access of resource using incompatible type ('type confusion') in EPICS Base

In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

The Epics Community

Products

Epics Base

CVE-2026-114597

Improper handling of length parameter inconsistency in EPICS Base

In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

The Epics Community

Products

Epics Base

CVE-2026-114596

Integer overflow or wraparound in EPICS Base

In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

The Epics Community

Products

Epics Base

CVE-2026-114595

Integer overflow or wraparound in EPICS Base

In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

The Epics Community

Products

Epics Base

CVE-2026-114409

Docker Desktop logs can expose stored third-party credentials

Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Desktop

CVE-2026-113881

Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution

A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial of service condition and potentially execute arbitrary code as an unprivileged process by sending a specially crafted request.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-112710

Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution

A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-112709

Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution

A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-112331

Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping

Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting required CloudEvent attributes (id, source, type), the attacker triggers an ArgumentException in KafkaMessageConsumer.SingleMessageHandlingAsync that is treated as fatal, causing the host to stop and re-process the same poison record on every restart, resulting in a permanent crash-loop.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Gdatasoftwareag

Products

Motornet

CVE-2026-111585

Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow

An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Full Client Portable Remote

CVE-2026-111584

Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows

A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Teamviewer Remote - Patch Management

CVE-2026-111583

Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows

Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can place a crafted installer options file that is processed by the Advanced Asset Management installer during service activation.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Full Client Host

CVE-2026-111582

Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows

A DLL loading vulnerability in the TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges. Exploitation requires user interaction.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Remote Management - Monitoring

CVE-2026-111548

Stack Buffer Overflow in Moxa Wireless Device Server Web Interface

A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers. An authenticated remote attacker with low privileges could exploit insufficient bounds checking of user-supplied input, causing the web management service to become unresponsive. Restoring the service requires power cycling the affected device, while other device functions remain operational.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Moxa

Products

Nport W2150a-w4 W2250a-w4 Series