CVE-2026-118541

Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Commerce Core

CVE-2026-118540

Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Commerce Core

CVE-2026-114571

Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252

Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Rabbit Hole

CVE-2026-118567

Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280

Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Bulk Update User Roles

CVE-2026-118557

Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Commerce Shipping

CVE-2026-118556

Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Commerce Shipping

CVE-2026-118555

Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260

Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Commerce License

CVE-2026-118548

AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268

Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Artificial Intelligence

CVE-2026-114554

AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251

Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Ai File To Text

CVE-2026-120450

LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Laradashboard

Products

Lara Dashboard

CVE-2026-119625

Gitea user and organization feed token scope bypass

The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a private organization through the organization feed; a public-only token could list the owner's private repositories and organizations and render private profile READMEs. For a site administrator's token this applied to every account. Tokens are now accepted on this route only for feeds, which require `read:user` or `read:organization`.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea

CVE-2026-118598

epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as: } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) { Because that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog. A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality. Requirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt. Affected: Epiphany >= 45.0 (bug present at least through 51.x). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976 Reporter acknowledgment: Fernando Munoz

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-119377

SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Sqlite

Products

Sqlite

CVE-2026-48751

Incus has a restricted project bypass leading to arbitrary command execution

Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Lxc

Products

Incus

CVE-2026-46499

Collabora Online: Read-only session authorization bypass permits live document edits

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to `LibreOfficeKit` in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted `WebSocket` messages to execute document-mutating `UNO` commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Collaboraoffice

Products

Online

CVE-2026-31482

s390/entry: Scrub r12 register on kernel entry

In the Linux kernel, the following vulnerability has been resolved: s390/entry: Scrub r12 register on kernel entry Before commit f33f2d4c7c80 ("s390/bp: remove TIF_ISOLATE_BP"), all entry handlers loaded r12 with the current task pointer (lg %r12,__LC_CURRENT) for use by the BPENTER/BPEXIT macros. That commit removed TIF_ISOLATE_BP, dropping both the branch prediction macros and the r12 load, but did not add r12 to the register clearing sequence. Add the missing xgr %r12,%r12 to make the register scrub consistent across all entry points.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-119115

Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes

Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize. To remediate this issue, users should upgrade aws-privateca-issuer to version v1.10.1 or the AWS Private CA Connector for Kubernetes EKS add-on to version v1.10.1-eksbuild.1, and update any certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer, since v1.10.1 requires issuerRef.kind to be exactly AWSPCAIssuer or AWSPCAClusterIssuer and to match the issuer it references.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Aws-privateca-issuer

CVE-2025-32348

Background Activity Launch Enables Local Privilege Escalation in Android

In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-119147

ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Proftpd

Products

Proftpd

CVE-2026-102280

Sandboxie-Plus: Sandbox containment bypass

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing file outside the sandbox. The direct primitive changes file attributes, timestamps, writeability, or 8.3 short names; a short-name redirection can additionally contribute to SYSTEM code execution when a privileged process resolves an attacker-controlled short-name path in a location SbieSvc can open. This vulnerability is fixed in 1.18.6.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sandboxie-plus

Products

Sandboxie