CVE-2026-128021

FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker Mode

FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_get_errors() or libxml_get_last_error() to obtain other clients' parsed-document fragments and server filesystem paths.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128033

OpenMage magento-lts before 20.18.2 Information Disclosure via Order-Status RSS Feed

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-memo comments. Authenticated customers can open the /rss/order/status feed for their order to read internal staff comments, such as fraud-review and payment notes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-87801

API Framework Data Exposure in Synology DSM

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Synology

Products

Diskstation Manager

CVE-2026-68512

Paaster: No rate limiting on account login, combined with a public username-enumeration/salt endpoint, enables offline credential-stuffing

Paaster is a pastebin application. Prior to version 3.3.0, Paaster's account login has no rate limiting, lockout, or CAPTCHA of any kind, and a companion endpoint openly discloses whether a username exists along with that account's password-hashing salts. Together these let an attacker enumerate real accounts and then brute-force their passwords with unlimited, unthrottled attempts. This issue has been patched in version 3.3.0.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wardpearce

Products

Paaster

CVE-2026-11732

An insufficient input validation vulnerability exists in the website blocking feature of certain NETGEAR RAX/CAX series models

An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker with access to the local network (such as through Wi-Fi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Cax30 Rax30 Rax5 and 1 more

CVE-2026-57500

REVA: Access to internal metadata

REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Opencloud-eu

Products

Reva

CVE-2026-126327

Unauthorized Retrieval of Historical Passwords via Devolutions Server Connection History API

Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

Devolutions

Products

Server

CVE-2026-126331

Authenticated User Leakage of API Key Secret Hashes via User List API

Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

Devolutions

Products

Server

CVE-2026-126882

chromium-browser: skia: Information leak in Skia

Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-47217

BACnet Stack: Channel member self-reference causes uncontrolled recursion and stack overflow in default BACnet/IP server

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, a remote attacker can trigger an uncontrolled recursion and stack overflow in the default server application of bacnet-stack by abusing the Channel object. This issue has been patched in versions 1.4.4 and 1.5.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-47258

BACnet Stack: Stack-based buffer overflow in Notification Class AddListElement recipient-list decoding

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-based out-of-bounds write exists in the Notification Class object implementation when handling AddListElement for the recipient-list property. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-126878

chromium-browser: Information leak in Core

Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-126920

chromium-browser: skia: Information leak in Skia

Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-126862

chromium-browser: chromium-browser: Web origin policy bypass via co-installed application

Improper input validation in Core in Google Chrome on on Android prior to 157.0.8103.78 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: High)

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-126957

ICMPv4 Record Route / Timestamp option: stack OOB read via ptr underflow in icmpv4.c

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zephyrproject-rtos

Products

Zephyr

CVE-2026-116314

PostgreSQL pg_restore executes arbitrary code due to missing non-plain archive validation

Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-97041

Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link

Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116327

PostgreSQL security_barrier analysis can expose hidden values through indirect expressions

Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-126356

Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator('form') uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal parameter or extra whitespace after a semicolon. The validation callback receives an empty object even though c.req.parseBody() or c.req.formData() can still parse and expose all submitted fields to the handler. An unauthenticated client can therefore bypass allow-list or required-field checks when the application relies on the form validator and its callback accepts an empty object. application/x-www-form-urlencoded requests are not affected. This issue is fixed in version 4.13.16.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-121674

PowerShell Information Disclosure Vulnerability

Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Powershell Powershell 7.6 Powershell 7.7