CVE-2026-75877

TRENDnet TV-IP751WIC alphapd FUN_0043372C stack-based overflow

A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function SystemNetworkChanged/SystemDDNSChanged/SystemEmailChanged/SystemFTPChanged/websCheckRealm/FUN_00432574/FUN_0043372C of the component alphapd. Executing a manipulation can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Trendnet

Products

Tv-ip751wic

CVE-2026-52735

ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept a block that zcashd rejects because the P2SH signature-operation counter undercounts redeem scripts containing a disabled opcode followed by signature opcodes. In zebra-script/src/lib.rs, p2sh_input_sigop_count used the pure-Rust script::Code::sig_op_count path, whose try_fold parser stops at disabled opcodes such as OP_CODESEPARATOR and returns only the partial count accumulated before the error. The zcashd reference implementation continues static signature-operation counting through disabled opcodes, so an attacker can broadcast P2SH spends that Zebra counts below MAX_BLOCK_SIGOPS while zcashd counts above the 20,000-operation limit. If a Zebra miner includes those transactions, Zebra validators accept the block while zcashd validators reject it, creating a consensus chain split that affects network integrity and availability without requiring the attacker to produce a block. This issue is fixed in version 4.5.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Zcashfoundation

Products

Zebra

CVE-2026-75625

Kraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with forged CRC32 corrections that passes per-piece checks, poisoning the cache with attacker-chosen container image layers or manifests that are re-seeded and executed by other hosts.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Uber

Products

Kraken

CVE-2026-75926

Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in config/security/securityConfig.go, which makes nodePermissionArgs in common/hexec/exec.go append --allow-child-process whenever the tool being launched is named tailwindcss. TailwindCSS loads the site's tailwind.config.js through require at startup, so top-level code in that file executes inside the permitted Node process and can call child_process to spawn a shell. The spawned process is not a Node process and inherits none of the permission flags, so it runs with the full privileges of the account performing the build. Building a site whose theme, module, or starter template supplies the Tailwind configuration therefore yields arbitrary command execution rather than the confined file access the permission model was introduced to enforce. Hugo 0.165.0 removes tailwindcss from the default security.exec.allow list, so the tool is no longer launched under the default configuration.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Gohugo

Products

Hugo

CVE-2026-75856

CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Hmbown

Products

Codewhale

CVE-2025-12011

CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow

A denial-of-service issue exists in  5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Rockwell Automation Rockwellautomation

Products

Compactlogix 5370 Compact Guardlogix 5370 Controllogix 5570 Guardlogix 5570 Compact Guardlogix 5370 Compactlogix 5370 and 2 more

CVE-2026-75627

Bastillion Authentication Bypass via Path-Prefix Routing Mismatch

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Bastillion-io

Products

Bastillion

CVE-2026-64879

Command Injection

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

CVSS 4.0 · 9.4 Critical EPSS 2.3% KEV · Not listed

Vendors

Linux Tenable

Products

Linux Kernel Security Center

CVE-2026-64878

Command Injection

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Linux Tenable

Products

Linux Kernel Security Center

CVE-2026-64877

SQL Injection in Tenable Security Center Ticketing API Exposes Sensitive Data

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Linux Tenable

Products

Linux Kernel Security Center

CVE-2026-13072

MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Mongodb Server

CVE-2026-75854

ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Arcadedata

Products

Arcadedb

CVE-2026-75835

Grav API Plugin before 1.0.14 Missing Authorization

Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a result, an authenticated attacker holding a scoped API key minted on a privileged account can bypass their declared scope restrictions to access authorize-gated UI metadata and item definitions (sidebar/menubar/widget items and users-list columns/row-actions/filter-tabs) that their key scope should deny, resulting in information disclosure.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav

CVE-2026-75094

COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVSS 4.0 · 9.4 Critical EPSS 3.2% KEV · Not listed

Vendors

Comfast

Products

Cf-n1-s

CVE-2026-19977

EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication

A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS 1.3% KEV · Not listed

Vendors

Efm Iptime

Products

Iptime A3004t A3004t

CVE-2026-75783

TRENDnet TEW-WLC100P DHCP blobmsg netifd stack-based overflow

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Trendnet

Products

Tew-wlc100p Tew-wlc100p Firmware

CVE-2026-75851

ArcadeDB before 26.8.1 Authentication Bypass via Async Command

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Arcadedata

Products

Arcadedb

CVE-2026-75828

Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav

CVE-2026-60112

AIT-GUI < 2.5.1 Missing Authentication via Sessions.create()

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Nasa Nasa-ammos

Products

Ait Gui Ait-gui

CVE-2026-60113

AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes

AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Nasa Nasa-ammos

Products

Ait Dsn Ait-dsn