CVE-2026-115998

IDOR: User reads and modifies findings from other people's projects

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cervantessec

Products

Cervantes

CVE-2026-115994

BOLA Allows Cross-Project Target Tampering

BOLA Allows Cross-Project Target Tampering  in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Cervantessec

Products

Cervantes

CVE-2026-115993

Stored XSS in the “Notes” field of project checklists

Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cervantessec

Products

Cervantes

CVE-2026-97229

Integer Overflow or Wraparound in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

CVSS 3.1 · 10 Critical EPSS 69.3% KEV · Listed

Vendors

Gitlab Ruby-lang

Products

Gitlab Ruby

CVE-2026-78077

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.11

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.11 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were rendered without complete contextual escaping, allowing injection of malicious HTML/JS. Stricter sanitization and tag allowlists via `InputFilter` and `htmlspecialchars` were implemented.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Joomshaper

Products

Helix3 Extension For Joomla

CVE-2026-77026

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 1.0.0-4.4.16, 5.0.0-5.2.5

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 1.0.0-4.4.16, 5.0.0-5.2.5 - CAPTCHA and field validation bypass.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Tassos.gr

Products

Convert Forms Component For Joomia

CVE-2026-93336

Missing authorization in the unit resources download route in Juju controllers

Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model,  including container-registry credentials, via a crafted request naming an arbitrary unit.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Canonical

Products

Juju

CVE-2026-92450

Kiloview E3 NDI Encoder Use of Hard-coded Credentials

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Kiloview

Products

E3 Firmware

CVE-2026-89315

JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix

`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Keypont-gose

CVE-2026-89314

Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s

`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Keypont-gose

CVE-2026-89313

JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil

`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Keypont-gose

CVE-2026-89312

AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV

`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Keypont-gose

CVE-2026-79871

Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10

A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79870

Authentication Bypass leads to Unauthorized Access in AOS-8

An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79869

Authentication Bypass Leading to Remote Code Execution in AOS-10

Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-77157

ast-cli: Auto-update downloads are not verified against a checksum before execution

ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute the contents of the archive, since no integrity check was performed on the download. Successful exploitation requires compromising "download.checkmarx.com" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx's VSCode/JetBrains extensions) or cx scan "sca-realtime" on an affected version would have extracted and executed that binary in place of the intended download. The download is now verified against a published SHA-256 checksum before extraction.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Checkmarx

Products

Ast-cli

CVE-2026-77156

ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation. Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal. Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Checkmarx

Products

Ast-cli

CVE-2026-19678

Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure

A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Onphase

Products

Onphase Forms

CVE-2026-19677

Authentication Bypass Leading to Server-Side Command Execution

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Onphase

Products

Onphase Forms

CVE-2026-115519

Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub

Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Knime

Products

Business Hub