CVE-2026-79876

Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing

A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-107034

Insecure Permissions Allowing Unauthorized Reading of User Notes in LeafPad

Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-107060

tailscale: Tailscale: Unauthorized modification of VPN configurations via insecure permissions

Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Tailscale

Products

Tailscale

CVE-2026-107262

Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Advanced Filesystem

CVE-2026-107308

Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Country

CVE-2026-107306

Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Menu Link Attributes

CVE-2026-3322

Privilege escalation via request replaying in Lobster_pro

Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Lobster Gmbh

Products

Lobster Pro

CVE-2026-112345

TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure

TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Sciener Ttlock

Products

Ttlock App Ttlock

CVE-2026-62047

WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Liquid Web / Stellarwp Wordpress-extensions

Products

Event Tickets Event Tickets

CVE-2026-114572

Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Domain Login Restrict

CVE-2026-107311

Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Permissions By Term

CVE-2026-107310

Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213

Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Freelinking

CVE-2026-107309

Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212

Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Easy Breadcrumb

CVE-2026-107307

SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Smartlinker Ai

CVE-2026-107267

DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Dkan

CVE-2026-107268

Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Two Factor Authentication - Tfa / Passwordless Login

CVE-2026-96389

Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Xray Audit

CVE-2026-107265

Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Leaflet

CVE-2026-107264

Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Inline Formatter Field

CVE-2026-107263

Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202

Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Gutenberg