CVE-2026-127079

OpsTree BuildPiper before 2.7.0 OTP Brute Force via password_reset/check_otp

OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target's password and taking over the account.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-127088

2FAuth before 9.0.1 Password Reset Poisoning via Host Header

2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

2fauth

Products

2fauth

CVE-2026-127090

Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass

Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128014

FrankenPHP 1.8.0 before 1.13.2 Out-of-Bounds Write via Bundled Brotli Decoder

FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli 1.2.0, whose decoder contains an out-of-bounds write (CVE-2026-111497). Unauthenticated remote attackers can send crafted data to applications that pass it to brotli_uncompress_add() to crash the entire FrankenPHP process, and possibly cause memory disclosure or code execution.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128023

FrankenPHP before 1.13.0 Authentication Bypass via Dot-Form Header Name Aliasing

FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X.Forwarded.For that map to $_SERVER keys, spoofing user identity, client IP, or scheme.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128041

OpenMage magento-lts before 20.18.2 Stored XSS via RSS Review Feed

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that executes when an administrator opens the pending-reviews feed, enabling admin account takeover.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128044

OpenMage magento-lts before 20.18.2 OAuth Callback URL Allowlist Bypass

OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator's or customer's request token and verifier, then obtain an access token with the victim's API privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128046

OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options

OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128047

OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key

OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit confirmation key via the unrate-limited confirmAction endpoint to log in as pending customers, or predict administrator reset tokens after recovering generator state.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128242

actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Actix

Products

Actix-http Actix-web

CVE-2026-128329

Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoFile

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to read arbitrary files by supplying ../ sequences in the filePath of patch.readRepoFile. Attackers with service read permission can read /etc/shadow, SSH private keys, and secret environment files on the Dokploy host or managed remote servers.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-128332

listmonk 6.0.0 before 7.0.0-beta.2 TOTP Brute-Force via /admin/login/twofa

Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, each allowing 15 more guesses, gaining sessions for 2FA-protected accounts including Super Admin.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128333

listmonk 6.0.0 before 7.0.0-beta.2 2FA Bypass via Password Reset Flow

listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a password reset. Attackers who can complete a reset, such as by reading the victim's reset email, obtain fully authenticated sessions including Super Admin without the TOTP code.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128337

ExcelJS through 4.4.0 Prototype Pollution via x14 Conditional Formatting Rule ID

ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of __proto__. Attackers can craft an xlsx file that, when loaded with xlsx.load(), sets properties such as type, direction, border and cfvo on every object in the process until it restarts.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Exceljs Project

Products

Exceljs

CVE-2026-128339

ExcelJS through 4.4.0 Memory Exhaustion via Oversized Merged Cell Range

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Exceljs Project

Products

Exceljs

CVE-2026-128340

ExcelJS through 4.4.0 Memory Exhaustion via Oversized Defined Name Range

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load().

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Exceljs Project

Products

Exceljs

CVE-2026-128341

ExcelJS through 4.4.0 Denial of Service via Oversized Data Validation sqref

ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load() iterate billions of addresses, blocking the event loop and crashing the process with an uncatchable out-of-memory error.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Exceljs Project

Products

Exceljs

CVE-2026-128343

ExcelJS through 4.4.0 Denial of Service via Oversized Row Number

exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Exceljs Project

Products

Exceljs

CVE-2026-128346

ExcelJS through 4.4.0 Resource Exhaustion via Streaming WorkbookReader Temporary Files

ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before xl/sharedStrings.xml to fill the temporary directory and exhaust file descriptors.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Exceljs Project

Products

Exceljs

CVE-2026-128347

ExcelJS through 4.4.0 Arbitrary File Read via WorkbookWriter addImage Filename

ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Exceljs Project

Products

Exceljs