CVE-2026-110620

Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Formbricks

Products

Formbricks

CVE-2026-110610

ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Iocoder Yunaiv

Products

Ruoyi-vue-pro Ruoyi-vue-pro

CVE-2026-110605

libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line

libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Tomolt

Products

Libschrift

CVE-2026-110595

BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import

BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users with mass-import permission can send oversized CSV files concurrently to /api/contacts/import/ and /api/cases/import/ endpoints to exhaust worker memory and trigger out-of-memory termination.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Micropyramid

Products

Django Crm

CVE-2026-109574

Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Gohugo

Products

Hugo

CVE-2026-109571

Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairing, bonding, or any confirmation on the watch.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Fire-boltt

Products

Bsw013

CVE-2026-109566

Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Zofe

Products

Rapyd-admin

CVE-2026-109356

LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase every deleted port on all visible devices.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Librenms

Products

Librenms

CVE-2026-109351

Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gitoxidelabs

Products

Gix-date

CVE-2026-109346

better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Better-auth

Products

Better Auth

CVE-2026-109341

SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into readable destinations, or abuse test mismatch errors as a disclosure oracle.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Surrealdb

Products

Surrealdb

CVE-2026-109336

SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive exact stored values in CREATE, UPDATE, and DELETE notifications.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Surrealdb

Products

Surrealdb

CVE-2026-109331

Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget

Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP script parameter beside a benign file_path or command, evading denyPatterns to write web shells or execute scripts.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Network-ai

Products

Network-ai

CVE-2026-109176

MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mogublog Project

Products

Mogublog

CVE-2026-109171

yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Guchengwuyue

Products

Yshop-crm

CVE-2026-109164

TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the request body to permanently delete submissions platform-wide.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tduckcloud

Products

Tduck-survey-form

CVE-2026-105773

Canimaan Software ClamXAV local privilege escalation

Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Canimaan Software

Products

Clamxav

CVE-2025-2708

zhijiantianya ruoyi-vue-pro Backend File Upload upload path traversal

A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 4ae3f6b2c9883978837638c14e3d18419819eeb0. Applying a patch is advised to resolve this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Iocoder Zhijiantianya

Products

Ruoyi-vue-pro Ruoyi-vue-pro

CVE-2025-2707

zhijiantianya ruoyi-vue-pro Front-End Store upload path traversal

A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store Interface. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Iocoder Zhijiantianya

Products

Ruoyi-vue-pro Ruoyi-vue-pro

CVE-2020-37282

office-converter through 1.0.2 OS Command Injection via fileName in generatePdf

office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.

CVSS 4.0 · 9.3 Critical EPSS 3.4% KEV · Not listed

Vendors

Vworld4u

Products

Office-converter