CVE-2026-120201

Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.

CVSS 4.0 · 9.3 Critical EPSS 2.1% KEV · Not listed

Vendors

Dromara

Products

Jpom

CVE-2026-85076

Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. lib/api.js and lib/api/event.js validate the parameter object without restricting its keys, and lib/job.js uppercases those keys and applies them to the child process environment after administrator-defined plugin variables. A key that collides with a security-sensitive environment variable can therefore override the plugin execution context and may cause privilege escalation, arbitrary code execution, data access, or service disruption depending on the plugin and runtime. This issue is fixed in version 0.9.124.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Jhuckaby

Products

Cronicle

CVE-2026-110469

Remote Code Execution via Unrestricted File Upload in WidzialniCMS

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Fundacja Widzialni

Products

Widzialnicms

CVE-2026-110468

Remote Code Execution via Unrestricted File Upload in WidzialniCMS

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Fundacja Widzialni

Products

Widzialnicms

CVE-2026-54384

VitaFit Cloud API Authentication Bypass via POST /front/login/sns/

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record, preventing the legitimate user from logging in.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Shenzhen Shine Industrial

Products

Vitafit

CVE-2026-54378

VitaFit Cloud API Broken Access Control via S3 Token Endpoint

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files, enabling unauthorized cross-user data access and manipulation.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Shenzhen Shine Industrial

Products

Vitafit

CVE-2026-122304

Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference context entries to read cross-namespace Secrets and modify validatingwebhookconfigurations using the cleanup controller's ServiceAccount.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Kyverno

Products

Kyverno

CVE-2026-122303

Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target with an attacker-chosen metadata.namespace, causing the privileged background controller to overwrite Secrets, Deployments, or policies cluster-wide.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Kyverno

Products

Kyverno

CVE-2026-122302

Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check

Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeting other namespaces or cluster-scoped kinds, making the background controller create or clone resources cluster-wide.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Kyverno

Products

Kyverno

CVE-2026-122013

Comfast CF-WR632AX Multipart webmgnt path traversal

A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Comfast

Products

Cf-wr632ax

CVE-2026-121933

Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication

A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Linksys

Products

E5350

CVE-2026-121932

Linksys E5350 apply.cgi system os command injection

A vulnerability was detected in Linksys E5350 1.0.00.037. This affects the function system of the file /wizard/apply.cgi. Performing a manipulation of the argument ping_ip/traceroute_ip results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS 2.4% KEV · Not listed

Vendors

Linksys

Products

E5350

CVE-2026-121931

Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection

A security vulnerability has been detected in Linksys WRT54GL 4.30.18. The impacted element is the function system of the file apply.cgi of the component Traceroute Diagnostic Function. Such manipulation of the argument traceroute_ip leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 9.4 Critical EPSS 2.7% KEV · Not listed

Vendors

Linksys

Products

Wrt54gl

CVE-2026-121930

Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection

A weakness has been identified in Linksys WRT54GL 4.30.18. The affected element is the function system of the file apply.cgi of the component Ping Diagnostic. This manipulation of the argument ping_ip causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 9.4 Critical EPSS 2.7% KEV · Not listed

Vendors

Linksys

Products

Wrt54gl

CVE-2026-121615

Linksys E5600 Login mesh_login.cgi improper authentication

A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Linksys

Products

E5600 E5600 Firmware

CVE-2026-121609

Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials

A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Qihoo 360

Products

Whole Home Router M5

CVE-2026-121607

Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection

A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS 2.0% KEV · Not listed

Vendors

Qihoo 360

Products

D600-2 D603-2 D606-6 and 1 more

CVE-2026-121597

TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow

A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

A950rg A950rg Firmware

CVE-2026-112197

Missing Authentication for Critical Function in Tactis' NoviGest Desktop App

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Tactis

Products

Novigest Desktop App

CVE-2026-110770

Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force

Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Databasus

Products

Databasus