CVE-2026-112174

Privilege escalation in Enter’s Iperius Backup

Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator privileges, a local attacker with low privileges can use the native Windows dialogues exposed by the application to run programmes that inherit its elevated context. This allows commands to be executed with SYSTEM or Administrator privileges, depending on the application’s context, and compromises the affected Windows system.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Enter

Products

Iperius Backup

CVE-2026-124057

TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow

A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument Key1Str1 results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

Ca300-poe Ca300-poe Firmware

CVE-2026-124040

CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State

CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Civetweb Project

Products

Civetweb

CVE-2026-123958

TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow

A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument lanDns/lanSecDns/langType leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

Ca300-poe Ca300-poe Firmware

CVE-2026-56451

JWT Algorithm Validation Bypass in Siemens Opcenter X

A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm specified in the JSON Web Token (JWT) header. This could allow an unauthenticated remote attacker to forge arbitrary JWT, bypass authentication mechanisms and impersonate any user including administrative accounts, potentially gaining full unauthorized access to the application.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Siemens

Products

Opcenter X

CVE-2026-126542

WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login

WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-126539

Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface

Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or delete records in any user-defined collection.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Monospace

Products

Directus

CVE-2026-82533

DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a confined tool-executed process can reach the loopback API without any port exposure and use it to escape its own OS sandbox, escalate to unconfined execution, and disable the approval prompt. When the port is externally reachable via tunnel, SSH forward, or reverse proxy, a remote attacker can exploit the same flaw to create sessions, execute arbitrary commands, and exfiltrate stored conversation transcripts without credentials.

CVSS 4.0 · 9.4 Critical EPSS 1.2% KEV · Not listed

Vendors

Deepseek

Products

Deepseek-harness

CVE-2024-58385

Yonyou U8 CRM SQL Injection via fillbacksettingedit.php

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Yonyou

Products

U8 Crm

CVE-2026-73458

On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various rou

On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD session(s).

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-73447

Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-126187

React: Unauthenticated Remote Code Execution in React Server Components

React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.

CVSS 4.0 · 9.5 Critical EPSS 1.8% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125298

AsiaInfo Business Support System (BSS) Missing JWT Signature Verification

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125297

AsiaInfo Business Support System (BSS) Missing Authentication

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-124469

OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee Sheet product lines with constant subqueries to run a time-based blind oracle, extracting patient data and users_secure bcrypt hashes.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124490

OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the file_path parameter. Attackers can use action=download to read credentials and source code, or action=setup with base64 content to write web-executable files for code execution.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-125881

Schema-hint SSRF via service import schema validation

Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. This issue affects N-central: before 26.4.1.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-86005

Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the administrative BullMQ dashboard was mounted without an authentication check. The vulnerable surface is the Bull Board/BullMQ administration dashboard at /apps/queues. A remote unauthenticated attacker reaches /apps/queues on a Chartbrew instance where Redis and BullMQ are enabled and a reverse proxy does not independently block the route. The dashboard trusted network reachability as authorization and exposed its queue-management interface directly. Redis and BullMQ must be enabled and the route must be reachable. Available actions depend on the installed Bull Board version and queue state, while confidentiality depends on job payload and log contents. An unauthenticated user can inspect exposed job payloads and logs and, when enabled by the installed version and queue state, retry or delete jobs or otherwise alter queue processing, affecting confidentiality, integrity, or availability. This issue is fixed in version 5.2.3.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Chartbrew

Products

Chartbrew

CVE-2026-63011

GroupOffice Vulnerable to RCE in TemplateParser eval() via Contact/labels

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string (tpl parameter) that is passed without restriction to TemplateParser::parse(). When the template contains an [assign] block whose expression includes a {{...}} variable reference, the engine calls eval() on the expanded expression after running it through a validateExpression() guard. The guard double-quotes unrecognized tokens, but PHP 7+ allows a string enclosed in parentheses to be invoked as a function ("system")("id") is valid PHP and calls system("id"). A single authenticated HTTP request is sufficient to execute arbitrary OS commands as the web server user (www-data). This issue has been patched in versions 6.8.167, 25.0.102, and 26.0.27.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123959

TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow

A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument langType results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

Ca300-poe Ca300-poe Firmware