CVE-2026-116769

Authentication bypass in Secure Access Servers

CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-89292

Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures

In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Eclipse Mnestix

CVE-2026-125383

INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypass

INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Go2ismail

Products

Asp.net-core-inventory-order-management-system

CVE-2026-125086

D-Link M60 emDaemon MQTT Broker mosquitto.conf system hard-coded credentials

A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

D-link

Products

M60

CVE-2026-125370

Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Kubero-dev

Products

Kubero

CVE-2026-124059

TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow

A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this vulnerability is the function setWiFiWdsAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ApCliKeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

Ca300-poe Ca300-poe Firmware

CVE-2026-123966

Tenda AC19 saveParentControlInfo heap-based overflow

A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 10 Critical EPSS 1.0% KEV · Not listed

Vendors

Tenda

Products

Ac19

CVE-2026-123960

TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow

A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument pppoeUser/priDns/secDns can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

Ca300-poe Ca300-poe Firmware

CVE-2026-123488

Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.

CVSS 4.0 · 9.3 Critical EPSS 1.9% KEV · Not listed

Vendors

Craftcms

Products

Cms Craft Cms

CVE-2026-119756

Tasmota 16.0.0 Heap Out-of-Bounds Write via Device Groups UDP

Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 that cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. Attackers can exploit this flaw to crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms that lack ASLR and heap cookies.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Arendst

Products

Tasmota

CVE-2026-119344

Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks

Cocos AI is a confidential computing system for AI. In version 0.8.2 and earlier, Cocos AI accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique machine identity and without enforcing revocation. A remote attacker who controls or compromises another platform trusted by the same verifier can substitute valid Evidence from that platform and cause authorization of the wrong platform. This vulnerability is addressed in 0.9.0. However, this vulnerability can't be patched in source code alone, since the vulnerability arises from the confidential computing threat model itself.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Ultravioletrs

Products

Cocos

CVE-2026-102530

JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user’s privileges. The Welcome view also unsafely renders RSS news-feed titles; exploitation through this separate input path requires control over content delivered through the application’s Jupyter Blog feed or its cached feed data, rather than submission of a remote-server URL. This issue affects all supported platforms and is fixed in version 4.6.2-1.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Jupyter

Products

Jupyterlab-desktop

CVE-2026-115934

SQL injection leading to privilege escalation

An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query execution and enabling escalation to an administrator. Note that this only affects MySQL/MariaDB. Impact * SQL injection — The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This gives unauthenticated read and write access to the application database. * Privilege escalation to administrator — The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Craft short-circuits its permission checks on this single column, so no further changes were needed. The same primitive can overwrite any account’s password hash. Update to the patched versions (4.18.9 and 5.11.2) to get the fix. If you cannot update immediately, you can block front-end requests with %5Battribute%5D and [attribute] anywhere in the query string as a temporary mitigation.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Cms

CVE-2026-123815

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling tarfile.extractall. On supported Python 3.9 through 3.13 runtimes, tarfile defaults to the fully_trusted extraction filter, so a user with ADD and STATUS permissions can cause extraction of a crafted archive containing character devices, block devices, or FIFOs. Python 3.14 defaults to a safe extraction filter. When pyLoad runs with operating-system privileges that permit device creation, including the official root-based Docker deployment, the archive can expose raw devices and compromise the host. Non-root deployments can still create FIFOs that cause hangs or IPC confusion. This issue is fixed in version 0.5.0b3.dev102.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Pyload

Products

Pyload

CVE-2026-52848

GLPI: MFA bypass

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-122992

Integer Underflow in DStarGateway RS-MS1A Sender Field

In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

G4klx

Products

Dstargateway

CVE-2026-114425

Forged LFT metadata permits arbitrary file read and deletion

SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Seppmail

Products

Seppmail Secure Email Gateway

CVE-2026-114424

Code execution through double evaluation in address replacement rules

SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context when an active rule uses message-derived replacement data and its search condition matches. The validated worker context was root.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-25874

LeRobot Unsafe Deserialization Remote Code Execution via gRPC

LeRobot through 0.6.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.

CVSS 4.0 · 9.3 Critical EPSS 15.5% KEV · Not listed

Vendors

Huggingface

Products

Lerobot

CVE-2026-120201

Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.

CVSS 4.0 · 9.3 Critical EPSS 2.1% KEV · Not listed

Vendors

Dromara

Products

Jpom