CVE-2026-119748

GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice

The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-119747

GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API

The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin's manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users' invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-118684

MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Project-monai

Products

Monai

CVE-2026-118679

n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-118675

n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to serve content that resolves project credentials and returns their decrypted values.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-118377

mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mewebstudio

Products

Pos

CVE-2026-117929

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-117928

Same-origin policy bypass in the CSS Parsing and Computation component

Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117921

Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117920

Use-after-free in the DOM: HTML Parser component

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117918

Use-after-free in the Graphics: Canvas2D component

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117466

Privilege Escalation in Octopus Server via System Manager role

In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Octopus

Products

Octopus Server

CVE-2026-117341

Privilege Escalation through Exposure of Invitation Code in Octopus Server Audit Log

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Octopus

Products

Octopus Server

CVE-2026-116662

Tanium addressed a compression bomb vulnerability in Enforce.

Tanium addressed a compression bomb vulnerability in Enforce.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Enforce

CVE-2026-116659

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Enforce

CVE-2026-116657

Tanium addressed a denial of service vulnerability in Enforce.

Tanium addressed a denial of service vulnerability in Enforce.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Enforce

CVE-2026-116656

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Enforce

CVE-2026-116214

MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Maccms Magicblack

Products

Maccms Maccms10

CVE-2026-115750

mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Frontmcp

Products

Mcp-from-openapi

CVE-2026-115495

Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket

Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Mobile Vpn With Ssl Client