CVE-2026-122007

Oqtane Framework before 10.3.0 Broken Access Control via SettingController

Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type settings, since IsAuthorized and FilterPrivate fail to verify the requested site matches the current alias SiteId. Attackers can exploit the /api/setting endpoints to disclose private values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and to alter another site's OIDC/OAuth2 authentication configuration without requiring host privileges.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Oqtane

Products

Oqtane Framework

CVE-2026-121993

wePOS before 2.0.3 Missing Authorization via payment/process Endpoint

wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish_shop_orders capability (such as Dokan vendor staff) can invoke the payment processing endpoint with an order ID they do not own to trigger the order completion lifecycle, including stock reduction and granting of paid-order access, without making any real payment.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-121966

Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Traefik

Products

Traefik

CVE-2026-121964

FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragment

FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capacity from the current stream position. A malicious or compromised RD Gateway can send crafted RPC fragments with manipulated alloc_hint and frag_length values to overwrite client heap memory with attacker-controlled data, causing a crash or potentially arbitrary code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-121946

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zbateson

Products

Mail-mime-parser

CVE-2026-121944

sngrep through 1.9.0 Infinite Loop DoS via Crafted NFLOG TLV

sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows attackers to cause denial of service via crafted NFLOG TLVs. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, making the capture thread spin at full CPU and stop processing packets.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Irontec

Products

Sngrep

CVE-2026-121942

ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c

ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mchehab

Products

Zbar

CVE-2026-121940

Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-delete data, and add themselves as project members.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Stonewuu

Products

Ai-fusion-video

CVE-2026-121939

Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking

Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

David-crty

Products

Databasement

CVE-2026-121937

loonflow before r3.2.3 IDOR via ticket_flow_history Endpoint

loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticket_flow_history endpoint, which skips ticket_view_permission_check, to obtain approval comments and processor names, emails and phone numbers.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Loonflow Project

Products

Loonflow

CVE-2026-121733

Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload

Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Webkul

Products

Bagisto

CVE-2026-121640

WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions

An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Authpoint Authentication Gateway

CVE-2026-121639

WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service

A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Authpoint Authentication Gateway

CVE-2026-121638

WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks

An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Authpoint Authentication Gateway

CVE-2026-121637

WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results

An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, resulting in unauthorized session outcomes.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Authpoint Authentication Gateway

CVE-2026-121598

TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow

A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/cstecgi.cgi of the component Basic Wireless Configuration Handler. The manipulation of the argument wepkey leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

A950rg A950rg Firmware

CVE-2026-121583

Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization

A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The web trade payment controller was removed starting with the 202608 series (commit 7329437).

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Publiccms Sanluan

Products

Publiccms Publiccms

CVE-2026-121542

Bake filesystem path entitlements approval can be skipped for path using basename prefix

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working directory whose names use the working directory's basename as a prefix can skip the filesystem entitlement check. Exploitation requires specific matching filenames next to the current project directory. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.

CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-121535

miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication

A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Miroslavpejic85

Products

Mirotalk P2p

CVE-2026-121373

Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)

The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to untrusted sites in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The shared declarative refresh steps in the WHATWG HTML Standard require a broader approach: the separator after the time may be ASCII whitespace alone, with no ; or ,, and the url= keyword is optional. Directives the browser honours, but the regular expression misses are returned unchanged, so the attacker URL skips UrlSanitizer entirely and both allowLinkSchemes and allowLinkHosts are defeated for the refresh navigation. This is reachable under any configuration that allows meta with http-equiv and content, including the documented allowStaticElements() preset.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sensiolabs

Products

Symfony