CVE-2026-76899

CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULE_SETTING_UPDATE to place an arbitrary database function in SortRequest.name because CustomerPoolController.page omits Spring request validation, SortRequest.getName relies on an incomplete blacklist, and the CommonMapper.xml sort fragment inserts ${sortName} into an ORDER BY clause. Functions such as extractvalue and updatexml bypass the blacklist and can expose database values through an error oracle when the query returns at least one row. This issue is fixed in version 1.7.4.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

1panel-dev

Products

Cordyscrm

CVE-2026-93015

BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds Write

BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static objects and crash the process or sever event delivery.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Bluekitchen

Products

Btstack

CVE-2026-12974

Security Policy Bypass in Forcepoint Security Engine (NGFW)

A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW). This issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7.1.13, from 7.3.0 through 7.3.1, 7.3.3, from 7.4.0 through 7.4.1, and 7.5.0.

CVSS 4.0 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Forcepoint

Products

Forcepoint Security Engine Ngfw

CVE-2026-19517

Excessive Allocation of Resources via Unchecked Quantity Validation in rlottie

Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung Samsung Open Source

Products

Rlottie Rlottie

CVE-2026-19518

Improper Validation of Quantity Field Leading to Input Data Manipulation in Samsung Open Source rlottie

Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung Samsung Open Source

Products

Rlottie Rlottie

CVE-2026-93749

source-map-js through 1.2.1 Event Loop Denial of Service

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

7rulnik

Products

Source-map-js

CVE-2026-83115

Unauthenticated Remote Disclosure via RapidClone Command in Oracle Applications Manager

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Applications Manager

CVE-2026-89420

Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free

Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.accept_voucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling maybe_spend/2. The credential verifies, the protected resource is served, and spent and units stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on MPP.Session.Method through the Plug, MCP, JSON-RPC and WebSocket transports. This issue affects mpp: from 0.14.0 before 0.16.2.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Zenhive Zenhive

Products

Mpp Mpp

CVE-2026-69186

c-ares: Memory-amplification denial of service via unvalidated DNS header record counts

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

C-ares

Products

C-ares

CVE-2026-48977

OpenSlide: Arbitrary memory write with crafted Ventana BIF file

OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Openslide

Products

Openslide

CVE-2025-36178

Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Controller

CVE-2026-50285

Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in internal/authenticateflow/stateless.go. In hosted or stateless authentication deployments, an unauthenticated attacker can obtain the receiver key from /.well-known/pomerium/hpke-public-key, provide a matching attacker-controlled sender key, and send a compressed payload to /.pomerium/callback that expands before validateSenderPublicKey rejects the sender. This can allocate hundreds of megabytes per request, exhaust proxy memory, crash or degrade the process, and block access to applications protected by the deployment. Stateful deployments are not affected because the stateful callback verifies its HMAC signature before decryption and decompression. This issue is fixed in version 0.32.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Pomerium

Products

Pomerium

CVE-2026-76442

Cisco Secure Email Gateway Security Hardening Release

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76442 are related to issues with improper validation of specified quantity in input that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-1284.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Secure Email Secure Email And Web Manager

CVE-2026-73436

Security Advisory 0171

On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-69210

Http4s: WebSocket decoder accepts negative length, causing infinite decode loop

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send such a frame, causing the decoder to return an empty frame without advancing its input. The decode loop then runs indefinitely, pins a worker at full CPU, and grows an ArrayBuffer without bound, resulting in denial of service. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Http4s

Products

Http4s

CVE-2026-45765

Suricata dnp3: unbounded reassembly can lead to resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable DNP3 (which is not enabled by default) if it is not needed, and/or define a limited `stream.reassembly.depth` (0 or absent is unlimited).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Oisf

Products

Suricata

CVE-2026-39829

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Ssh

CVE-2024-53922

kernel: Kernel: Denial of Service in buffer queue driver

An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length check leads to a Denial of Service in the kernel.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-89701

nfsd: validate nseconds in TIME_DELEG decode paths

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIME_DELEG decode paths The xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms store a raw uint32_t nseconds directly into tv_nsec without enforcing nseconds < NSEC_PER_SEC. The legacy nfsd4_decode_nfstime4 has this check but the TIME_DELEG paths do not. A malformed timespec can propagate through notify_change() to disk. Add range checks in both nfs4xdr.c (SETATTR path) and nfs4callback.c (CB_GETATTR path).

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-87962

t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tdunning

Products

T-digest