CVE-2026-129117

C-Kermit 8.0.200 before 11.1.515 Missing Hostname Verification in AUTHENTICATION SSL

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because ssl_reply() never calls ssl_check_server_name(). Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Openkermit

Products

C-kermit

CVE-2026-129116

C-Kermit 7.0.197 before 11.1.515 IKSD Authentication Bypass via Refused Certificate Login

C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTH_VALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as any other account with any password, gaining that account's shell access.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Openkermit

Products

C-kermit

CVE-2026-126091

iDentalSoft website information exposure

Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Identalsoft

Products

Identalsoft

CVE-2026-124041

Catalis WebPro SQL Injection

Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL queries against the underlying MSSQL database, enabling exfiltration of sensitive property and taxpayer information.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Catalis

Products

Webpro

CVE-2026-123965

Jet Admin cloud platform prompt injection

A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to expose sensitive .env configuration files and exfiltrate critical credentials. Mitigated via sandbox component around October 29, 2026.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jet Admin

Products

Jet Admin Cloud Platform

CVE-2026-129171

NginxPulse 1.5.0 before 1.6.26 SQL Injection via /api/stats/:type

NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents, and read or write server files via PostgreSQL superuser functions.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Likaia

Products

Nginxpulse

CVE-2026-129169

PMail 2.5.0 through 2.9.8 Stored XSS via /api/email/send HTML Body

PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Jinnrry

Products

Pmail

CVE-2026-129168

PMail 2.9.1 through 2.9.8 Stored XSS via Inline HTML Attachments

PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endpoint returns email attachments verbatim with the sender-supplied Content-Type after cid: references are rewritten into attachment links. Unauthenticated SMTP senders can email a text/html attachment and a page-covering cid link, so a recipient who clicks the message runs script in their webmail session to change passwords, including the administrator's.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jinnrry

Products

Pmail

CVE-2026-129167

SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 Path Traversal RCE via confluence-to-wiki

Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability that allows unauthenticated attackers holding a public share token to execute code. Attackers supply an absolute filename to /api/v1/confluence-to-wiki/ to extract a ZIP from download_url into the Python library path, then trigger the module's import via a file-convert request.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Seafile

Products

Seadoc

CVE-2026-129164

Dromara free-fs 2.0.1 through 2.3.1 Share Code and Permission Scope Bypass

Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code-protected shares because share codes are enforced only client-side. Attackers knowing a share ID can call the share items and download endpoints to list and download files without the code, even on preview-only shares.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Dromara

Products

Free-fs

CVE-2026-129163

Dromara free-fs 2.0.1 through 2.3.1 Stored XSS via File Preview Endpoint

Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users to run script by uploading HTML files served inline as text/html. Attackers can send a victim the /api/file/stream/preview/{fileId} link to execute script in the application origin, calling /apis endpoints to expose the victim's files and account.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Dromara

Products

Free-fs

CVE-2026-129162

Dromara free-fs 2.0.1 through 2.3.1 Missing Authentication via File Stream Preview

Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user's or workspace's files.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Dromara

Products

Free-fs

CVE-2026-129161

Dromara free-fs 2.0.1 through 2.3.1 Password Reset Code Brute-Force Account Takeover

Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Dromara

Products

Free-fs

CVE-2026-129160

Dromara free-fs 2.0.1 through 2.3.1 SQL Injection via orderBy Parameter

free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Dromara

Products

Free-fs

CVE-2026-129158

ragent 1.1.0 Stored XSS via SVG Knowledge-Base Document Upload

ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/{kb-id}/docs/upload so that victims opening /knowledge-base/docs/{docId}/file execute it in the application origin, enabling account takeover.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Nageoffer

Products

Ragent

CVE-2026-129157

ragent 1.0.0 through 1.1.0 Missing Authorization via /rag/traces/runs

ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nageoffer

Products

Ragent

CVE-2026-128071

Nuxt: Incomplete fix for GHSA-6gq8-jgmh-3ffp: an encoded slash (`%2F`) in the request path bypasses route rules on catch-all page routes

Nuxt is an open-source web development framework for Vue.js. Nuxt from 3.0.0 until 4.6.4, @nuxt/nitro-server from 3.20.0 until 4.6.4, and @nuxt/vite-server from 4.6.0 until 4.6.4, routeRules matching leaves an encoded slash (%2F) in the request path while a catch-all page such as app/pages/[...slug].vue or a custom multi-segment page route decodes it into a route parameter. The getRouteRules result is therefore incomplete, and an unauthenticated request can render the page without the redirect, headers, proxy, SSR, noScripts, appMiddleware, or appLayout rules configured for the decoded path. Protected content is resolved only when the page interprets the decoded parameter accordingly: a custom multi-segment parameter can contain the decoded path, while a repeatable catch-all must join the slash-containing array element; route.path remains encoded and does not resolve that resource. Static pages, single-segment parameters, server/api handlers, and server/routes handlers are not affected because they do not have the same encoded-path mismatch. This issue is fixed in version 4.6.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nuxt

Products

Nuxt Nuxt/nitro-server Vite-server

CVE-2026-128072

@nuxt/webpack-builder and @nuxt/rspack-builder dev server serves built source to DNS rebinding pages

Nuxt is an open-source web development framework for Vue.js. From @nuxt/webpack-builder 3.0.0 and @nuxt/rspack-builder 3.12.2 until 4.6.4, the development middleware trusts Origin, Referer, or Sec-Fetch-Site when the Host header names the same attacker-controlled hostname. After DNS rebinding changes that hostname to a loopback address, a malicious page opened by a developer can read /_nuxt/*.js client chunks and inline source maps, exposing compiled application source, local filesystem paths, and developer-controlled values embedded in the client bundle. The attacker must know or guess the development-server port and induce the developer to open the malicious page; Chrome 142 and later and other Chromium-based browsers that enforce Local Network Access restrictions prompt before a public page can reach the loopback address. The default Vite builder and production builds are unaffected. This issue is fixed in version 4.6.4.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Nuxt

Products

Nuxt Nuxt/rspack-builder Nuxt/webpack-builder

CVE-2026-128079

envd: Host file disclosure through requirements path traversal and TOCTOU

envd provides reproducible development environments for humans and agents. In versions starting with 0.3.38 and before 1.3.6, insufficient containment of host-side requirements-file reads in  install.python_packages(requirements=...)  could allow access to files outside the build context. An attacker able to influence build input could cause file contents interpreted as dependency entries to appear in debug logs or build-step metadata, subject to the envd process’s permissions. Exploitation in version 1.3.5 additionally requires concurrent modification of relevant filesystem paths. This issue is fixed in version 1.3.6.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Tensorchord

Products

Envd

CVE-2026-68510

bit-vec: unsoundness arising with `deserialize` then `get_unchecked`

bit-vec is a compact vector of bits. Prior to version 0.10.0, there is undefined behavior if a user performs deserialize from an untrusted source and unsafe get_unchecked. A user of this library may be impacted by incorrect behavior if they perform deserialize from an untrusted source and run operations on the deserialized BitVec. This issue has been patched in version 0.10.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Contain-rs

Products

Bit-vec