CVE-2026-75954

Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Cmsjunkie.com

Products

J-businessdirectory Extension For Joomla

CVE-2026-75949

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controlled root (_path_type could point at the component site/admin trees), did not enforce path containment, and used a weak extension check. CSRF token was also missing on upload/remove.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Cmsjunkie.com

Products

J-businessdirectory Extension For Joomla

CVE-2026-76590

TRENDnet TEW-755AP ssi wan.cgi stack-based overflow

A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. Affected by this issue is some unknown functionality of the file /cgi-bin/wan.cgi of the component ssi. Such manipulation of the argument cameo.wan.wan_pppoe_password_00 leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Trendnet

Products

Tew-755ap Tew-755ap Firmware

CVE-2026-77645

Critical Remote Code Execution (RCE) vulnerability reported in Windchill

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Ptc

Products

Flexplm Windchill Pdmlink

CVE-2026-77683

Comfast CF-N1-S mbox-config system command injection

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS 2.9% KEV · Not listed

Vendors

Comfast

Products

Cf-n1-s

CVE-2026-76156

Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root.

CVSS 4.0 · 9.4 Critical EPSS 1.1% KEV · Not listed

Vendors

Datiphy

Products

Data Management Center

CVE-2026-76155

Datiphy Data Management Center - Use of Default Credentials

Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Datiphy

Products

Data Management Center

CVE-2026-76158

Datiphy Data Management Center - External Control of File Name or Path

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Datiphy

Products

Data Management Center

CVE-2026-63382

libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

CVSS 4.0 · 9.2 Critical EPSS 2.0% KEV · Not listed

Vendors

Libevent Project

Products

Libevent

CVE-2026-75110

MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Memtensor

Products

Memos

CVE-2026-75626

SpiderFoot Stored Cross-Site Scripting via Correlation Titles

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Smicallef

Products

Spiderfoot

CVE-2026-71878

Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Gbif

Products

Integrated Publishing Toolkit

CVE-2026-71879

Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Gbif

Products

Integrated Publishing Toolkit

CVE-2026-50161

libre: Integer overflow in websock_decode() masked frame length check leads to heap buffer overflow

libre is a generic library for real-time communications with asynchronous input and output support. Prior to 4.8.1, the websock_decode() function in src/websock/websock.c contains an integer overflow when validating a masked WebSocket frame that uses the 64-bit extended length encoding. The expression 4 + hdr->len can wrap when hdr->len is close to UINT64_MAX, causing the mbuf_get_left() bounds check to pass. The subsequent XOR unmasking loop then writes beyond the heap buffer. Applications using websock_accept() or websock_accept_proto() to implement a WebSocket server are affected, and exploitation can cause attacker-controlled heap corruption or denial of service after the HTTP WebSocket upgrade handshake. This issue is fixed in version 4.8.1.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Baresip

Products

Re

CVE-2026-76214

phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge

phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back to the database. At login the anti-replay comparison is skipped by its own null guard, allowing an attacker who captures a successful WebAuthn assertion to replay it indefinitely and authenticate as the user without any interaction or hardware key.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Phpmyfaq

Products

Phpmyfaq

CVE-2026-55769

CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning search_path in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER could create overloaded built-in operators in the public schema and change the database or role search_path, causing instance-manager introspection queries such as SELECT COUNT(*) > 0 FROM pg_catalog.pg_extension WHERE extname = $1 to execute attacker-controlled functions as the postgres superuser. The same trust issue affected direct sql.Open("pgx", ...) callsites and the public.user_search SECURITY DEFINER function, enabling PostgreSQL superuser access, operating system command execution through COPY ... FROM PROGRAM, and access to the pod ServiceAccount token. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Cloudnative-pg

Products

Cloudnative-pg

CVE-2026-72530

Remote Code Execution via Script Upload in TrueConf Server

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

CVSS 4.0 · 9.5 Critical EPSS 1.7% KEV · Listed

Vendors

Trueconf

Products

Server Trueconf Server

CVE-2026-77148

Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow

A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Comfast

Products

Cf-n1-s

CVE-2026-75784

TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflow

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

CVSS 4.0 · 10 Critical EPSS 1.1% KEV · Not listed

Vendors

Trendnet

Products

Tew-wlc100

CVE-2026-76244

stigmem-node Insecure Federation Transport Configuration

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Eidetic-labs

Products

Stigmem