CVE-2026-13533

agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access

A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the function Spyc::YAMLLoad of the file /config/config.yaml of the component htaccess Handler. Such manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Configuration settings should be changed. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Agentejo

Products

Cockpit Cockpit Cms

CVE-2026-45792

RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM

rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.32.0, RTK (Rust Token Killer) improperly trusts project-local configuration files. RTK automatically loads .rtk/filters.toml from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., strip_lines_matching) to shell command output before it is shown to the LLM, without any indication that the output has been modified. This allows attackers to selectively suppress or alter command output (including file contents, diffs, and security scan results) without detection, potentially concealing malicious code during AI-assisted development or review. This vulnerability is fixed in 0.32.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Rtk-ai

Products

Rtk

CVE-2026-7500

Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled

When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak

CVE-2026-57285

Jenkins GitHub Branch Source Plugin: Jenkins GitHub Branch Source Plugin: Information disclosure via missing permission check

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Jenkins Project

Products

Github Branch Source Jenkins Github Branch Source Plugin

CVE-2016-20092

NetDrive 2.6.12 Unquoted Service Path Elevation of Privilege

NetDrive 2.6.12 contains an unquoted service path vulnerability in the Netdrive2_Service_Netdrive2 service that allows local users to execute arbitrary code with SYSTEM privileges. Attackers can insert malicious executables in the system root path that will be executed during service startup or system reboot, resulting in privilege escalation.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Netdrive

Products

Netdrive

CVE-2020-37250

TFTP Broadband 4.3.0.1465 Unquoted Service Path Privilege Escalation

TFTP Broadband 4.3.0.1465 contains an unquoted service path vulnerability in the tftpt.exe service binary that allows local attackers to execute arbitrary code with system privileges. Attackers can place a malicious executable in the Program Files directory path that will be executed during service startup or system reboot with LocalSystem privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Weird-solutions

Products

Tftp Broadband

CVE-2025-13162

Advant Master Online Builder DLL vulnerability

Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master. This issue affects Control Builder A: through 1.4/4; 800xA for Advant Master: through 6.0.3-1, through 6.1.1-1, 6.1.1-3, 6.2.0-1.

CVSS 4.0 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Abb

Products

800xa For Advant Master Control Builder A

CVE-2026-47937

Acrobat Reader | Uncontrolled Search Path Element (CWE-427)

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Acrobat Acrobat Dc Acrobat Reader and 3 more

CVE-2026-50100

Printer Driver Privilege Escalation via Malicious Driver

Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability. If this vulnerability is exploited, an attacker who can log in to a computer running an affected printer driver could elevate privileges by using a specially crafted driver.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Konica Minolta Ricoh

Products

Multiple Printer Drivers Multiple Printer Drivers

CVE-2026-34028

Unauthenticated direct access to web data in Wertheim SafeController Software exposes files

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not protected by an authorization scheme. An unauthenticated attacker can directly access HTTP endpoints to download files from locations such as /Resources/CompanyId_[ID]/Audio/ and /SafeData/.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-5064

HP One Agent Software – Security Update

Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or denial of service. HP is releasing software updates to mitigate these potential vulnerabilities.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Hp Hp Inc.

Products

One Agent Software Hp One Agent Software

CVE-2026-42089

yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package installation and code execution during CLI bootstrap. The vulnerable method is installLocalGenerators(), which calls repository.install() directly without prompting the user. This issue has been fixed in version 6.0.0.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Yeoman

Products

Environment

CVE-2026-6645

Insecure Search Path Vulnerability in PaperCut Print Deploy Client for Windows

An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, which typically operates with high-level system privileges, attempts to perform an internal validation check by invoking a secondary system utility using an unqualified file reference. Because the application does not specify an absolute path to this utility, it relies on the operating system's default search order to locate the executable. Under specific conditions, a local attacker with the ability to modify directories within the system's search path could plant a malicious binary that mimics the expected utility. This could result in the malicious code being executed with SYSTEM privileges, leading to a full compromise of the affected host.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Papercut

Products

Print Deploy

CVE-2016-20089

Iperius Remote 1.7.0 Unquoted Service Path Elevation of Privilege

Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation path. When installed from directories containing spaces, attackers can place malicious executables in the path to be executed with elevated privileges during service startup or system reboot.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Iperiusremote

Products

Iperius Remote

CVE-2016-20095

Matrix42 Remote Control Host 3.20.0031 Unquoted Path Privilege Escalation

Matrix42 Remote Control Host 3.20.0031 contains an unquoted service path vulnerability in the FastViewerRemoteService and FastViewerRemoteProxy services that allows local users to execute arbitrary code with SYSTEM privileges. Attackers can place a malicious executable in the Program Files directory with a crafted name to be executed by the service during startup, gaining elevated privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Matrix42

Products

Matrix42 Remote Control Host

CVE-2023-4736

Untrusted Search Path in vim/vim

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Vim

Products

Macos Vim

CVE-2026-10521

Authenticated unintended access to critical program parameters

An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mb Connect Line

Products

Mbconnect24 Mymbconnect24

CVE-2026-54232

vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-49241

Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension

The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. Prior to 21.2.4, the client-side Angular Language Service VS Code extension reads the custom TypeScript SDK paths typescript.tsdk and js/ts.tsdk.path directly from workspace configurations (.vscode/settings.json) without verifying VS Code Workspace Trust state or asking for user consent (located in client/src/client.ts). The client-side extension then passes the parsed settings path as a command-line argument (--tsdk) to the background Node.js language server process. During server initialization, the background language server resolves and dynamically imports (via standard Node.js require()) the module library tsserverlibrary.js relative to the workspace-specified custom directory path. An attacker can exploit this behavior by committing a repository containing a local malicious tsserverlibrary.js script inside a custom folder, and a crafted .vscode/settings.json file pointing to that folder. When a developer opens the repository folder in VS Code, the extension automatically attempts to initialize and load the server, which dynamically resolves, loads, and executes the malicious script silently in the background. This vulnerability is fixed in 21.2.4.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Angular

Products

Angular Angular Language Service

CVE-2023-54353

Chromacam 4.0.3.0 Unquoted Service Path Privilege Escalation

Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that allows local attackers to execute arbitrary code by placing malicious executables in unquoted path directories. Attackers with write access to C:\ or subdirectories like C:\Program Files (x86)\Personify\ can place a malicious Program.exe or PsyFrameGrabberService.exe file that executes with LocalSystem privileges when the service starts automatically at boot.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Personifyinc

Products

Chromacam