CVE-2026-81828

Apache OFBiz: Server-side request forgery in SurveyWrapper

Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal network and cloud-metadata endpoints and local files via file:// — by setting an arbitrary URL as a product-store survey's template location, causing SurveyWrapper.getTemplate to call URL.openStream() on the resolved location and compile the fetched content as a FreeMarker template with no scheme or host validation, unlike the sibling widget location-loaders (ScreenFactory, FormFactory, GridFactory, MenuFactory, TreeFactory, ThemeFactory) which validate the resolved location before loading it. The fetched content is rendered into the HTTP response of any shopper who subsequently loads the affected product-store survey, making the disclosure non-blind. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Ofbiz Apache Ofbiz

CVE-2026-73578

Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact

Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted _LAST_VIEW_NAME_ value, which is stored as saved-view state in the anonymous session and later rendered without re-applying the original view's authentication requirement, potentially exposing protected views and associated business data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Ofbiz Apache Ofbiz

CVE-2026-73577

Apache OFBiz: Unauthenticated path-suffix view authorization bypass

Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., /catalog/control/ListLocales/showPortalPage), causing the servlet to authorize the request based on the public path component while rendering the protected suffix view. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Ofbiz Apache Ofbiz

CVE-2026-60041

CSRF in backend

An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Firmware Myrex24v2virtual Mbconnect24 and 1 more

CVE-2026-21441

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.

CVSS 4.0 · 8.9 High EPSS 2.9% KEV · Not listed

Vendors

Python Urllib3

Products

Urllib3 Urllib3

CVE-2026-17355

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-17352

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-17334

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-17330

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-17325

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-17188

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. When service definitions are imported, references to external resources are not sufficiently restricted, so the server could be made to request resources it should not access.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-17187

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-125404

Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption

Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to overflow a stack buffer in the Ettercap process, which normally runs as root.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Ettercap Ettercap-project

Products

Ettercap Ettercap

CVE-2026-125400

Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution

Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt memory and potentially execute code as root.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ettercap Ettercap-project

Products

Ettercap Ettercap

CVE-2026-125368

OmniAgent Bash Approval Gate Bypass via find -execdir in Safe-Command Allowlist

OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that treats any command starting with find as safe without inspecting -execdir arguments. Prompt-injected agents can run find with -execdir to invoke binaries like dd, nc, perl or openssl through an unsandboxed shell, overwriting files or executing code without human approval.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Yeqing17-2026

Products

Omniagent

CVE-2026-125364

frab through 0.9.1 Privilege Escalation via conference_users_attributes in UsersController

frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conference_users_attributes. Attackers can abuse UsersController#update or #create, which skip filter_conference_users, to gain orga on any conference and fully manage its events, schedule, reviewers and crew.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Frab

Products

Frab

CVE-2026-125360

Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment

Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Southclaws

Products

Storyden

CVE-2026-125117

Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set, and merging update documents in utils.mergeClone. Attacker-controlled keys such as toString or valueOf can therefore cause Mongoose to write into shared built-in functions instead of an own property. A crafted document, Mixed path, non-strict document or subdocument, findOneAndReplace() replacement, chained update, or Query.prototype.merge() source can overwrite Object.prototype.toString.call, causing later queries on unrelated models to fail until the process restarts. Separately, when an attacker controls the dotted path passed to doc.set(path, value) for a subdocument configured with strict: false, descent through $__set can reach $__schema and alter shared validators or schema options for later documents. Mongoose already blocks __proto__, constructor, and prototype, so this issue overwrites properties on reachable shared objects rather than adding new properties directly to Object.prototype. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Automattic

Products

Mongoose

CVE-2026-125107

Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Julianhille

Products

Muhammarajs

CVE-2026-125075

SourceCodester Smart Attendance System with QR Code Scanner Admin Account Creation create_admin.php getMessage missing authentication

A vulnerability has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This impacts the function getMessage of the file create_admin.php of the component Admin Account Creation. Such manipulation of the argument e leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Smart Attendance System With Qr Code Scanner