CVE-2026-105279

J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

J4care

Products

Dcm4chee-arc-light

CVE-2026-105667

J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

J4care

Products

Dcm4chee-arc-light

CVE-2026-111728

Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags via the transcodeHwAccelCustomSettings field, which are appended verbatim to the ffmpeg argument vector. Attackers can trigger execution via the mediastream request and HLS playlist endpoints to achieve arbitrary file write and file truncation on the host as the user running seanime, with the injected input options also enabling potential arbitrary local file read and outbound data exfiltration through ffmpeg's protocol handlers.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

5rahim

Products

Seanime

CVE-2026-96424

Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Ubports

Products

Lomiri-download-manager

CVE-2026-96425

Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ubports

Products

Lomiri-download-manager

CVE-2026-111612

netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Qaiu

Products

Netdisk-fast-download

CVE-2026-111616

Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API

Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oqtane

Products

Oqtane Framework

CVE-2026-111617

WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mgdaaslab

Products

Wharttest

CVE-2026-111626

Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers

Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Webreaper

Products

Damselfly

CVE-2026-111661

waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wayn111

Products

Waynboot-mall

CVE-2026-111676

Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Faveosuite Ladybirdweb

Products

Faveo-helpdesk Faveo Helpdesk

CVE-2026-111681

EFAK through 5.1.0 Privilege Escalation via /api/users REST API

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Smartloli

Products

Efak

CVE-2026-111682

EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Smartloli

Products

Efak

CVE-2026-111691

WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Wimoor-erp

Products

Wimoor

CVE-2026-111692

DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Databufflabs

Products

Databuff

CVE-2026-111721

Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping

Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jingsewu

Products

Open-wes

CVE-2026-111722

LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API

LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Lingguoai

Products

Lingguo-drama

CVE-2026-112009

smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffer

smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashes applications opening it through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Icculus

Products

Smpeg

CVE-2026-112010

smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp

smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEG_new, SMPEG_new_rwops or SMPEG_new_data to trigger a reachable assertion or out-of-bounds copy, crashing the application.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Icculus

Products

Smpeg

CVE-2026-98806

octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled Previously, BPID assignment under CONFIG_DCB assumed `queue_to_pfc_map` was always initialized. For SDP VFs this leads to invalid memory access as it was not initialized. This patch adds a NULL check for `queue_to_pfc_map` before dereferencing it. Also, simplifies the logic by always assigning a default BPID first, then conditionally overriding it if CONFIG_DCB is enabled and the map exists.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel