CVE-2026-115484

Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Rhel Els

CVE-2026-11770

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Port389 Redhat

Products

389-ds-base 389 Directory Server Directory Server and 10 more

CVE-2026-50633

Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Cxf Build Of Apache Camel Fuse

CVE-2026-121054

chromium-browser: Improper state validation in XML

Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-82155

Untrusted Search Path Vulnerability in Dell OS Recovery Tool Enabling Local Command Execution

Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Os Recovery Tool

CVE-2026-59267

Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption

A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Openoffice

CVE-2026-120314

Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Network-ai

Products

Network-ai

CVE-2026-120241

Ruijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflow

A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ruijie

Products

Rg-es205gc Rg-es206gc-p Rg-es208gc and 2 more

CVE-2026-120040

Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure

The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin's default_view_role setting to a capability held by low-privileged users such as 'read'; on an untouched install the default of 'manage_options' restricts log access to administrators only.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-119163

FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfan_cart_id' parameter in all versions up to, and including, 3.8.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation is a two-step persisted attack: an unauthenticated attacker submits a crafted bwfan_cart_id value during a guest Store API checkout (requiring only a publicly obtainable WooCommerce cart nonce), and the injection fires when a scheduled Action Scheduler job later reloads the stored meta upon order status transition out of pending, failed, or cancelled.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-117983

Use-after-free in the Graphics component

Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117968

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117965

Same-origin policy bypass in the Address Bar component

Same-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117964

Use-after-free in the Panning and Zooming component

Use-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-117955

JIT miscompilation in the JavaScript: WebAssembly component

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117954

Use-after-free in the Layout: Positioned component

Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117569

Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters

Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Alishahid74

Products

Kali-gpt

CVE-2026-116747

Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret

Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.

CVSS 4.0 · 9.2 Critical EPSS 2.1% KEV · Not listed

Vendors

Rajnandan1

Products

Kener

CVE-2026-116086

Konflux-ci: jq filter injection in github workflow issue management

A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-109197

WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpdirectorykit

Products

Wp Directory Kit Wp Directory Kit