CVE-2026-107411

Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler

Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-49747

GPU DDK - OOB write for mappings larger than 4GB due to integer overflow in PVRDmaBufOpsMapCommon

Software installed and run as a non-privileged user may conduct GPU system calls to trigger an integer overflow and allow OOB writes to GPU buffers. The integer overflow caused when mapping a GPU buffer >4GB causes corruption of array length, and can lead to kernel panics or out of bounds access.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-127285

Cairo-dock Glx-Dock href Attribute bg_forum.php cross site scripting

A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bg_forum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Cairo-dock

Products

Glx-dock

CVE-2026-125787

WordPress Quiz And Survey Master plugin <= 11.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 11.3.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Expresstech Wordpress-extensions

Products

Quiz And Survey Master Quiz And Survey Master

CVE-2026-125785

WordPress JetEngine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Crocoblock Wordpress-extensions

Products

Jetengine Jetengine

CVE-2026-15465

GPU DDK - Write UAF in OSDebugSignalPID due to incorrect management of PID resources

Software installed and run as a non-privileged user may conduct improper GPU system calls through the DDK kernel module interface. Under unsupported use of the interface, a use-after-free condition may occur that can lead to kernel memory corruption, platform instability, or system reboot. The weakness occurs when software references memory after it has been released. Accessing memory after free may result in corruption of valid data structures, unexpected program behaviour, process crashes, or execution of unintended operations.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-127284

SourceCodester Food Ordering System Admin Write add_category.php sql injection

A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/add_category.php of the component Admin Write Handler. Performing a manipulation of the argument title/description/price/current_image/featured/active/id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Sourcecodester

Products

Food Ordering System

CVE-2026-126330

Docker Sandboxes restores removed automatically assigned port publications

Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon removes the active binding but retains the original publication request, allowing a later port change or sandbox restart to publish the service again on a new host port. An attacker able to reach the restored endpoint may regain access to the service. Both TCP and UDP mappings are affected. Exposure is limited to the original bind address, which defaults to loopback. The issue is fixed in version 0.53.0.

CVSS 4.0 · 2.4 Low EPSS n/a KEV · Not listed

Vendors

Docker

Products

Docker Sandboxes

CVE-2026-126346

basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF

basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login(), an attacker-influenced password reaches the PASS command after a server sends a 331 response, and in a resumed download an attacker-influenced remote path reaches the RETR command after a 350 response to REST. The resulting exception does not reject client.access() or downloadTo(), escapes ordinary promise error handling, and terminates the Node.js process, while the validation guard still prevents command injection. This issue is fixed in version 6.2.3.

CVSS 3.1 · 5.9 Medium EPSS n/a KEV · Not listed

Vendors

Patrickjuchli

Products

Basic-ftp

CVE-2026-127283

SourceCodester Food Ordering System Admin Image update_food.php unrestricted upload

A vulnerability was identified in SourceCodester Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file admin/update_food.php of the component Admin Image Handler. Such manipulation of the argument cmd leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Sourcecodester

Products

Food Ordering System

CVE-2026-127282

SourceCodester Smart Attendance System with QR Code Scanner reset_password.php cross site scripting

A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality of the file reset_password.php. This manipulation of the argument Username causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Sourcecodester

Products

Smart Attendance System With Qr Code Scanner

CVE-2026-106018

Authentication Bypass via Alternate Path in Johnson Controls EasyIO Firmware

Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass. This issue affects EasyIO FW: through 3.0b25.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-123039

Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket

The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.

CVSS 3.1 · 7.8 High EPSS n/a KEV · Not listed

Vendors

Checkpoint

Products

Quantum Security Gateway Quantum Security Management

CVE-2026-116308

PostgreSQL dict_int reads beyond zero-length tokens

Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 4.3 Medium EPSS n/a KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-126329

Docker Sandboxes privilege escalation through untrusted state directories

Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx or sandboxd is run as root with HOME or, on Linux, XDG_STATE_HOME pointing to an attacker-controlled location, a local unprivileged user can substitute control-plane sockets and configuration trusted by the root process, potentially executing commands as root. Exploitation requires a privileged invocation with an attacker-influenced environment. The issue affects Linux and macOS and is fixed in version 0.53.0.

CVSS 4.0 · 7.3 High EPSS n/a KEV · Not listed

Vendors

Docker

Products

Docker Sandboxes

CVE-2026-126343

@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Hono

Products

Node-server

CVE-2026-126344

@hono/node-server: WebSocket upgrade request-target starting with `//` replaces the host in `c.req.url`, bypassing `Origin` checks

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the request-target as a network-path reference and replace the host in c.req.url. Routing still uses the local WebSocket path, so an application that compares the Origin header with the origin of c.req.url, including checks implemented with csrf(), compares an attacker's origin with itself and accepts the connection. A page on another site can consequently open a WebSocket with the victim's cookies and read and send messages when the application uses upgradeWebSocket and trusts the host in c.req.url. Ordinary HTTP requests are not affected. This issue is fixed in version 2.1.6.

CVSS 3.1 · 5.4 Medium EPSS n/a KEV · Not listed

Vendors

Hono

Products

Node-server

CVE-2026-126345

basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()

basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named __proto__ therefore resolves to Object.prototype, bypasses the missing-handler guard, and is called as though it were a function, producing a TypeError. The error propagates through Client.list() and APIs that depend on it because it is not an FTPError. A malicious or compromised FTP server, or an on-path attacker on a plaintext FTP session, can make the affected operation reject, and the Node.js process terminates under the default behavior in Node.js 15 and later only if the application leaves that rejection unhandled. This issue is fixed in version 6.2.4.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Patrickjuchli

Products

Basic-ftp

CVE-2026-127281

lanyulei ferry JWT Validation auth.go improper authentication

A vulnerability was found in lanyulei ferry 1.0.0-beta.1/1.0.0. Affected is an unknown function of the file middleware/auth.go of the component JWT Validation. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Lanyulei

Products

Ferry

CVE-2026-116309

PostgreSQL plperl blessed-reference type confusion may execute arbitrary code

Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

Postgresql

Products

Postgresql