CVE-2026-128065

@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is not registered under the override message type, override maps are stored under a type URL instead of the configured HTTP filter name, and VirtualHost override maps are not read. When experimental RBAC is enabled and a trusted xDS control plane supplies a broad top-level ALLOW policy with a stricter matching override, affected servers evaluate RPCs under the broad policy and can accept requests that should be denied. This issue is fixed in version 1.14.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Grpc

Products

Grpc-node

CVE-2026-124664

Mine CloudVod < 2.6.7 - Unauthenticated Paid Lesson Content Disclosure

The Mine CloudVod WordPress plugin before 2.6.7 does not check whether the requester is enrolled in a course, or authorised at all, before returning the course's full curriculum together with the raw content of every published lesson, allowing unauthenticated visitors to retrieve paid lesson content, such as direct video source URLs, and the passwords of password-protected lessons.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Mine Cloudvod

CVE-2026-97041

Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link

Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-97038

Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/go

Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "#cgo LDFLAGS", and libraries in "-L" directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or ".syso" files (or loaded via "-l:<filename>" or "-l" containing path separators), injecting unallowlisted linker flags via PE/COFF ".drectve" sections on Windows or Mach-O "LC_LINKER_OPTION" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects. The go command now verifies that ".syso" files, direct linker inputs, and libraries in "-L" directories are valid binary objects or archives that do not contain unallowlisted ".drectve" directives, "LC_LINKER_OPTION" load commands, or LTO IR sections, and disallows "-l:<filename>" and ":", "=", or path separators in "-l" flags.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-97033

Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; "-target" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and "-x" permitted specifying arbitrary compiler input languages beyond those supported by cgo. "--sysroot" and "-target" are now disallowed in "#cgo" flags, "-isysroot" and "-Wl,-syslibroot" are verified not to point to regular files, and "-x" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-53700

Insecure Storage of Sensitive Information in Johnson Controls iSTAR Ultra Series

CWE‑922 Insecure Storage of Sensitive Information vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑15 File Manipulation. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.

CVSS 4.0 · 6.3 Medium EPSS n/a KEV · Not listed

Vendors

Johnson Controls Johnsoncontrols

Products

Istar Edge G2 Istar Ultra Istar Ultra G2 and 7 more

CVE-2026-128067

Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size

Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimensions. The affected TiffImagePlugin._save path allows ImageWidth, ImageLength, or SamplesPerPixel from exif=, tiffinfo=, or a source TIFF IFD to make libtiff consume a larger scanline than the buffer supplied by ImagingLibTiffEncode. This can read heap memory into the generated TIFF or crash the process. When TIFF Predictor 2 is enabled, libtiff can rewrite the oversized scanline in place and corrupt memory beyond the buffer. A carried-over PlanarConfiguration value of 2 instead makes libtiff use a shorter scanline and can produce an undecodable output file, but is not established to cause the out-of-bounds access. This issue is fixed in version 13.0.0.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Python-pillow

Products

Pillow

CVE-2026-126839

Deserialization allow-list bypass via anonymous-type misdetection in BSON object deserialization

A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identification. An unauthorized party able to supply BSON content that an application later deserializes into a loosely typed member can cause types outside the intended allow-list to be constructed and populated with unauthorized party-supplied values inside the consuming application. This can lead to unexpected object state and errors in downstream application logic. No elevated privileges beyond the ability to place unauthorized party-influenced content in the deserialization path are required.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver

CVE-2026-126982

Remote code execution via generic-type allow-list bypass in BSON object deserialization

A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON data that the application later deserializes can cause the application process to instantiate .NET types outside the intended allow-list and populate them with unauthorized party-controlled values. In applications that contain a suitable gadget type, this can lead to arbitrary code execution in the context of the application, with corresponding loss of confidentiality, integrity, and availability. No special privileges beyond the ability to introduce data the application reads are required.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver

CVE-2026-103813

Dell PowerStore OS Command Injection Vulnerability with Privilege Escalation Risk

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability, potentially leading to privilege escalation to root on the appliance.

CVSS 3.1 · 9.1 Critical EPSS n/a KEV · Not listed

Vendors

Dell

Products

Powerstore 1000t Powerstore 1200t Powerstore 3000t and 9 more

CVE-2025-43867

File Manipulation via Vulnerable Third-Party Component in Johnson Controls FX Series

- Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, and Johnson Controls FX90 allows CAPEC‑17: Accessing, Modifying or Deleting Files. This issue affects FX Server: before 14.10.10 and before 14.14.1; FX80: before 14.14.10 and before 14.14.1; FX90: before 14.10.10 and before 14.14.1.

CVSS 4.0 · 8.5 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-102632

Privilege Escalation via Incorrect App Token Role Assignment in Devolutions PowerShell Universal

Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Devolutions

Products

Powershell Universal

CVE-2025-53698

Missing Protection Mechanism for Alternate Hardware Interface Allowing Functionality Bypass in Johnson Controls iSTAR Ultra

Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson Controls iSTAR Ultra SE allows CAPEC‑554: Functionality Bypass. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02.

CVSS 4.0 · 7 High EPSS n/a KEV · Not listed

Vendors

Johnson Controls Johnsoncontrols

Products

Istar Ultra Istar Ultra Se Istar Ultra and 1 more

CVE-2025-43874

OS Command Injection via Improper Input Validation in Johnson Controls iSTAR Devices

: Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows : OS Command Injection. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Johnson Controls Johnsoncontrols

Products

Istar Edge G2 Istar Ultra Istar Ultra G2 and 7 more

CVE-2026-15465

GPU DDK - Write UAF in OSDebugSignalPID due to incorrect management of PID resources

Software installed and run as a non-privileged user may conduct improper GPU system calls through the DDK kernel module interface. Under unsupported use of the interface, a use-after-free condition may occur that can lead to kernel memory corruption, platform instability, or system reboot. The weakness occurs when software references memory after it has been released. Accessing memory after free may result in corruption of valid data structures, unexpected program behaviour, process crashes, or execution of unintended operations.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-49747

GPU DDK - OOB write for mappings larger than 4GB due to integer overflow in PVRDmaBufOpsMapCommon

Software installed and run as a non-privileged user may conduct GPU system calls to trigger an integer overflow and allow OOB writes to GPU buffers. The integer overflow caused when mapping a GPU buffer >4GB causes corruption of array length, and can lead to kernel panics or out of bounds access.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

Imaginationtech

Products

Graphics Ddk

CVE-2026-120863

Memory overflow in the management plane can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

Memory overflow in the management plane can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Citrix

Products

Gateway Netscaler Adc Netscaler Gateway

CVE-2026-128344

ExcelJS through 4.4.0 Memory Exhaustion via Oversized Image Anchor Column

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages() anchor positions makes Worksheet.getColumn allocate millions of Column objects and abort with a heap out-of-memory error.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Exceljs Exceljs Project

Products

Exceljs Exceljs

CVE-2026-126487

OpenEMR before 8.5.0 Global Configuration Override via user_settings.php

OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows authenticated users to override system-wide global configuration values by storing global-prefixed keys through library/ajax/user_settings.php. Attackers can submit lab or target parameters with global: prefixed setting names to disable audit logging, weaken password policies, or alter security-sensitive settings persistently for their sessions.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-128987

Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations

A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors as retryable, the application enters a continuous retry loop. This can lead to excessive CPU consumption, resulting in a denial of service (DoS) for the target process.

CVSS 3.1 · 6.2 Medium EPSS n/a KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux