CVE-2026-23760

SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

CVSS 4.0 · 9.3 Critical EPSS 96.4% KEV · Listed

Vendors

Smartertools

Products

Smartermail

CVE-2026-1201

Authorization Bypass Through User-Controlled Key in Hubitat Elevation Hubs

An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Hubitat

Products

Elevation C3 Elevation C4 Elevation C5 and 3 more

CVE-2026-1472

Out-of-band SQL injection in Quatuor Performance Evaluation

An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'txAny' in '/evaluacion_competencias_autoeval_list.aspx', could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Quatuor

Products

Evaluacion De Desempeno

CVE-2026-25047

deepHas vulnerable to Prototype Pollution via constructor.prototype

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Sharpred

Products

Deephas

CVE-2026-21626

Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla

Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Joomla Stackideas

Products

Joomla Joomla! Easydiscuss

CVE-2026-26065

calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruption. This issue has been fixed in version 9.3.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Calibre-ebook Kovidgoyal

Products

Calibre Calibre

CVE-2026-2584

SQL Injection in Ciser System SL firmware

A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system. An unauthenticated, remote attacker (AV:N/PR:N) can exploit this flaw by sending specially crafted SQL queries through the login interface. Due to low attack complexity (AC:L) and the absence of specific requirements (AT:N), the vulnerability allows for a total compromise of the system's configuration data (VC:H/VI:H). While the availability of the service remains unaffected (VA:N), the breach may lead to a limited exposure of sensitive information regarding subsequent or interconnected systems (SC:L).

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ciser System

Products

Csip Firmware

CVE-2026-22785

orval MCP client is vulnerable to a code injection attack.

orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or escaping. This allows an attacker to "break out" of the string literal and inject arbitrary code. This vulnerability is fixed in 7.18.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Orval Orval-labs

Products

Orval Orval

CVE-2026-22239

Email Sending Vulnerability in BLUVOYIX

The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable email sending API. Successful exploitation of this vulnerability could allow the attacker to send unsolicited emails to anyone on behalf of the company.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Bluspark Global Blusparkglobal

Products

Bluvoyix Bluvoyix

CVE-2026-22240

Plaintext Passwords Vulnerability in BLUVOYIX

The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the plaintext passwords of all user users. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform by logging in using an exposed admin email address and password.

CVSS 4.0 · 10 Critical EPSS 3.4% KEV · Not listed

Vendors

Bluspark Global Blusparkglobal

Products

Bluvoyix Bluvoyix

CVE-2026-23947

Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in nature to CVE-2026-22785, but affects a different code path in @orval/core that was not addressed by CVE-2026-22785's fix. The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files. Orval 7.19.0 and 8.0.2 contain a fix for the issue.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Orval Orval-labs

Products

Orval Orval

CVE-2026-23518

Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment

Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Fleetdm

Products

Fleet

CVE-2026-24794

Chunk Unloading Security Vulnerability in CardboardPowered/cardboard

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in CardboardPowered cardboard (src/main/java/org/cardboardpowered/impl/world modules). This vulnerability is associated with program files WorldImpl.Java. This issue affects cardboard: before 1.21.4.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Cardboardpowered

Products

Cardboard

CVE-2026-24798

An Uninitialized stack variable vulnerability in GaijinEntertainment/DagorEngine

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in GaijinEntertainment DagorEngine (prog/3rdPartyLibs/miniupnpc modules). This vulnerability is associated with program files upnpreplyparse.C. This issue affects DagorEngine: through dagor_2025_01_15.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Gaijinentertainment

Products

Dagorengine

CVE-2026-24803

A possible infinite loop vulnerability in coolsnowwolf/lede

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7615d/src/mt_wifi/embedded/security modules). This vulnerability is associated with program files bn_lib.C. This issue affects lede: through r25.10.1.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Coolsnowwolf

Products

Lede

CVE-2026-24810

A buffer overflow in rethinkdb/rethinkdb

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb (src/cjson modules). This vulnerability is associated with program files cJSON.Cc. This issue affects rethinkdb: through v2.4.4.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Rethinkdb

Products

Rethinkdb

CVE-2026-24814

A integer overflow in swoole/swoole-src

Integer Overflow or Wraparound vulnerability in swoole swoole-src (thirdparty/hiredis modules). This vulnerability is associated with program files sds.C. This issue affects swoole-src: before 6.0.2.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Swoole

Products

Swoole

CVE-2026-24822

a heap-based buffer overflow vulnerability in ttttupup/wxhelper via src/mongoose.

Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in ttttupup wxhelper (src modules). This vulnerability is associated with program files mongoose.C. This issue affects wxhelper: through 3.9.10.19-v1.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Ttttupup

Products

Wxhelper

CVE-2026-24826

Out-of-bounds write in turso3d

Out-of-bounds Write, Divide By Zero, NULL Pointer Dereference, Use of Uninitialized Resource, Out-of-bounds Read, Reachable Assertion vulnerability in cadaver turso3d.This issue affects .

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Cadaver

Products

Turso3d

CVE-2026-24871

Code injection in Minecraft-Rcon-Manage

Improper Control of Generation of Code ('Code Injection') vulnerability in pilgrimage233 Minecraft-Rcon-Manage.This issue affects Minecraft-Rcon-Manage: before 3.0.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Pilgrimage233

Products

Minecraft-rcon-manage