CVE-2026-119251

Privilege Escalation via Improper Access Control in Ubiquiti WiFiman Desktop for macOS

A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Ubiquiti

Products

Wifiman Desktop For Macos

CVE-2026-119325

Bricks Theme Broken Access Control via load_popup_content

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Bricks Wordpress-extensions

Products

Bricks Theme Bricks Theme

CVE-2026-61645

Docat has Arbitrary File Upload exists in Upload API

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Docat-org

Products

Docat

CVE-2023-22793

Unauthenticated Remote Code Execution in Veeam Management Pack for Microsoft System Center

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Veeam

Products

Management Pack For Microsoft System Center

CVE-2026-107239

Remote Code Execution via Veeam Management Pack Collector

A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Veeam

Products

Management Pack For Microsoft System Center

CVE-2026-107238

Authenticated Domain User Enables LocalSystem RCE in Veeam Management Pack

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Veeam

Products

Management Pack For Microsoft System Center

CVE-2026-92744

Delinea Privilege Manager agent unauthenticated remote code execution vulnerability

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Delinea

Products

Privilege Manager

CVE-2026-119713

Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Paperclip Paperclipai

Products

Paperclipai/server Paperclipai\/server Paperclipai/server

CVE-2026-97638

Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared "continue later" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpmudev

Products

Forminator Forms Forminator Forms

CVE-2026-87941

Patreon - Critical - Unsupported - SA-CONTRIB-2026-139

Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Patreon

CVE-2026-79876

Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing

A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-107034

Insecure Permissions Allowing Unauthorized Reading of User Notes in LeafPad

Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-107060

tailscale: Tailscale: Unauthorized modification of VPN configurations via insecure permissions

Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Tailscale

Products

Tailscale

CVE-2026-107262

Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Advanced Filesystem

CVE-2026-107308

Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Country

CVE-2026-107306

Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Menu Link Attributes

CVE-2026-3322

Privilege escalation via request replaying in Lobster_pro

Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Lobster Gmbh

Products

Lobster Pro

CVE-2026-112345

TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure

TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Sciener Ttlock

Products

Ttlock App Ttlock

CVE-2026-62047

WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Liquid Web / Stellarwp Wordpress-extensions

Products

Event Tickets Event Tickets

CVE-2026-114572

Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Domain Login Restrict