CVE-2026-72657

Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against the server-side record of the requesting agent's assignment. An authenticated party in possession of a valid enrolled agent credential could therefore retrieve a policy the agent is not assigned to.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Fleet Server

CVE-2026-85637

jofpin trape Admin Endpoint sockets.py join_room missing authentication

A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join_room of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jofpin

Products

Trape

CVE-2026-85546

MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the __initialiseSGQuickEdit() helper, where the HTTP method validation intended to restrict these operations to POST requests was commented out. As a result, these state-changing actions could be invoked using GET requests. An attacker could craft a URL targeting one of the affected actions and cause an authenticated MISP user with sufficient privileges to request it, for example through a malicious link or embedded web resource. Successful exploitation could modify the membership of a MISP sharing group without the victim intentionally performing the operation. Depending on the action performed, an attacker could add or remove organisations or servers from a sharing group, potentially granting unintended access to information distributed through that sharing group or disrupting legitimate information sharing. The patch restores HTTP method enforcement centrally in __initialiseSGQuickEdit() by calling allowMethod(['post']), ensuring that all four affected quick-edit operations require POST requests and are therefore subject to the application's normal protections for state-changing requests.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Misp

Products

Misp

CVE-2026-85540

Interinfo｜DreamMaker - SQL Injection

DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Interinfo

Products

Dreammaker

CVE-2026-85538

MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes

An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_modify_org permissions. The affected attribute deletion paths relied on organization membership checks performed by MispAttribute::deleteAttribute() but did not consistently enforce MISP's event modification authorization rules. Consequently, a user belonging to the organization associated with an event could potentially delete individual attributes or perform bulk attribute deletion even when their assigned role was not authorized to modify the event. This created an inconsistency between attribute editing and deletion: editing an attribute correctly used MISP's ACL::canModifyEvent() authorization logic, whereas the affected deletion operations could bypass these permission checks. An authenticated attacker with access to an affected MISP instance and membership in the organization owning an event could exploit this flaw to remove attributes from that event, potentially causing unauthorized modification or loss of threat intelligence data. The patch introduces a common authorization check for all affected deletion paths. Before deletion, MISP now resolves the associated events and verifies that the current user is authorized to modify each event using the same authorization mechanism used by normal event and attribute modification operations.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Misp

Products

Misp

CVE-2026-85533

MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performed only when the request explicitly set the distribution field to 4 ("Sharing Group"). An attacker could therefore craft a request containing a sharing_group_id while omitting the distribution parameter, or otherwise avoiding the distribution == 4 condition, causing the Sharing Group authorization check to be skipped. This could allow a user with permission to create or modify the affected MISP objects to associate data with a Sharing Group that they are not authorized to use. Depending on the affected object's existing distribution settings and subsequent processing, this could bypass intended information-sharing boundaries and result in unauthorized placement or distribution of data to members of another Sharing Group. The issue affected attribute attachment and editing operations as well as Galaxy Cluster creation and editing. The fix ensures that authorization is performed whenever a non-empty sharing_group_id is submitted, independently of the distribution parameter. It also centralizes the authorization decision in SharingGroup::canUse() and explicitly rejects empty Sharing Group identifiers rather than allowing them to be interpreted as an unrestricted query.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Misp

Products

Misp

CVE-2026-85504

FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Freeipmi

Products

Freeipmi

CVE-2026-85458

Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyph

Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Xpdf

Products

Xpdf

CVE-2026-85094

Header Leak in Canva Android App Enables Session Hijacking via External WebView

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Canva

Products

Canva

CVE-2026-82911

CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Roskus

Products

Prospero Flow Crm

CVE-2026-82729

Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS

Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parse_hex_prefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumulator with acc * 16 + digit and imposes no limit on the digit count. Because the accumulator grows without bound, the multiplication is not constant time and one pass over N digits costs O(N squared). handle_data/2 prepends conn.buffer and re-parses from the start on every socket message, so a server that dribbles the digits out in small packets makes the client pay that cost repeatedly. A run of roughly 512,000 hex digits costs over ten seconds of CPU in a single pass, measured on stock defaults. The parser reaches this state after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 1.9.3 before 1.10.0.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elixir-mint

Products

Mint

CVE-2026-82728

Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decode_status_line/4 stores the unconsumed data in conn.buffer when the status line is incomplete, and decode_body/5 does the same for an unterminated chunk-extension line. Both wait for a CRLF the server never has to send, and conn.buffer is prepended to every subsequent socket message. The :max_header_list_size budget is wired only into decode_headers/5 and decode_trailer_headers/4, so neither of these states is covered by it. A malicious server, or one reached through an attacker-controlled redirect or a fetched URL, streams bytes indefinitely until the BEAM node is killed by the operating system out-of-memory handler. The chunk-extension variant is reached after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 0.1.0 before 1.10.0.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Elixir-mint

Products

Mint

CVE-2026-81302

Default Permission Vulnerability in PALLET CONTROL Enables Local Privilege Escalation to SYSTEM

PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Jalinfotec

Products

Pallet Control Palletcontrol Palletcontrol Cloud

CVE-2026-75604

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.

CVSS 3.1 · 9 Critical EPSS 2.1% KEV · Not listed

Vendors

Vercel

Products

Next.js

CVE-2026-70403

Hard‑coded Password Vulnerability in XING CPTrans‑ME‑X Allows Unrestricted Device Access

XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Xing

Products

Xing Cptrans-me-x

CVE-2026-6217

Information Disclosure in Pik Online Software's Portal

Use of a One-Way hash without a salt vulnerability in Pik Online Software Solutions Inc. Pik Online Portal allows Cryptanalysis. This issue affects Pik Online Portal: through 3.5.1.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pik Online Software

Products

Pik Online Portal

CVE-2026-69657

Use of Default Password Enables Unauthorized Access to XING CPTrans‑ME‑X

XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Xing

Products

Xing Cptrans-me-x

CVE-2026-67402

Remote Command Execution via Insecure Apache CGI Mapping in ConfigServer Security & Firewall Messenger v3

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Configserver

Products

Configserver Security Firewall

CVE-2026-67397

Root-level code execution via path traversal in Plesk 18.0.80

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Webpros

Products

Plesk

CVE-2026-66840

Sensitive System Information Leakage in XING CPTrans-ME-X

XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Xing

Products

Xing Cptrans-me-x