CVE-2026-123975

Grid Community Toolkit globus-gss-assist before 12.9 Pre-Authentication Heap Out-of-Bounds Write

Grid Community Toolkit before 6.2.20261111 (globus-gss-assist before 12.9) contains a heap out-of-bounds write in globus_gss_assist_token_get_fd() triggered by SSLv2 record lengths below 3. Remote unauthenticated clients can send a crafted GSI handshake record to services like globus-gatekeeper and myproxy to corrupt heap memory and crash the service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Grid Community Forum

Products

Globus-gss-assist Grid Community Toolkit

CVE-2026-103769

WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.4.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce pdf-invoices-and-packing-slips-for-woocommerce allows Object Injection.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.4.10.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Acowebs Wordpress-extensions

Products

Pdf Invoices And Packing Slips For Woocommerce Pdf Invoices And Packing Slips For Woocommerce

CVE-2026-125852

WordPress Realtyna Organic IDX plugin plugin <= 5.4.2 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Path Traversal.This issue affects Realtyna Organic IDX plugin: from n/a through 5.5.0.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Realtyna Wordpress-extensions

Products

Realtyna Organic Idx Plugin Realtyna Organic Idx Plugin

CVE-2026-125853

WordPress Everest Backup plugin <= 2.3.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through 2.3.15.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Everestthemes Wordpress-extensions

Products

Everest Backup Everest Backup

CVE-2026-125837

WordPress Make theme <= 1.10.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thethemefoundry Make make allows Reflected XSS.This issue affects Make: from n/a through 1.10.10.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Thethemefoundry Wordpress-extensions

Products

Make Make

CVE-2026-125855

WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through 3.3.9.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Elextensions Wordpress-extensions

Products

Elex Wordpress Helpdesk & Customer Ticketing System Elex Wordpress Helpdesk & Customer Ticketing System

CVE-2026-125858

WordPress CleverReach® WP plugin <= 1.5.26 - Broken Access Control vulnerability

Missing Authorization vulnerability in CleverReach CleverReach® WP cleverreach-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CleverReach® WP: from n/a through 1.5.26.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cleverreach Wordpress-extensions

Products

Cleverreach® Wp Cleverreach Wp

CVE-2026-124970

WordPress WP BASE Booking plugin <= 6.5.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.5.2.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wp Base

Products

Wp Base Booking Wp Base Booking

CVE-2026-124420

WordPress Woody ad snippets plugin <= 2.7.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody ad snippets insert-php allows Reflected XSS.This issue affects Woody ad snippets: from n/a through 2.7.10.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Themeisle Wordpress-extensions

Products

Woody Ad Snippets Woody Ad Snippets

CVE-2026-124267

WordPress Gmail SMTP plugin <= 1.2.3.23 - Broken Access Control vulnerability

Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Noor Alam Wordpress-extensions

Products

Gmail Smtp Gmail Smtp

CVE-2026-124415

WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Alejandro Wordpress-extensions

Products

Alex Reservations Alex Reservations

CVE-2026-125432

WordPress reCAPTCHA for WooCommerce plugin <= 1.4.7 - Broken Authentication vulnerability

Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Relywp Wordpress-extensions

Products

Recaptcha For Woocommerce Recaptcha For Woocommerce

CVE-2026-63079

RBH Integra32 5.1.11 .NET Remoting Deserialization RCE

RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service, exposed on TCP port 2001 via the AxcvcLt.dll library using BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without requiring authentication. A remote unauthenticated attacker can send a malicious serialized gadget payload (such as a ysoserial.net TypeConfuseDelegate chain) to the IntegraURI object endpoint, or exploit MarshalByRefObject/MarshalByValue unmarshalling for arbitrary file read/write and SMB/NTLMv2 credential coercion, to achieve remote code execution as NT AUTHORITY\SYSTEM and fully compromise the host.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Rbh Access Technologies

Products

Integra32 Security Management System

CVE-2026-105671

Zenitel Connect login allows username enumeration via verbose error responses

The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-129105

Cudy TR3000 before 2.5.42 pppd Option Injection via net.set_wan L2TP Credentials

Cudy TR3000 before 2.5.42 contains an option injection vulnerability that allows authenticated administrators to inject arbitrary pppd options by embedding quotes and newlines in L2TP credentials. Attackers can submit crafted usernames or passwords to the net.set_wan RPC method, which l2tp.sh writes into a pppd options file, adding options like logfile to the root pppd process.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Shenzhen Cudy Technology

Products

Tr3000

CVE-2026-129104

Cudy TR3000 before 2.5.42 dnsmasq Configuration Injection via net.set_dhcp

Cudy TR3000 before 2.5.42 contains a dnsmasq configuration injection vulnerability that allows authenticated administrators to inject directives by embedding a newline in the net.set_dhcp leasetime field. Attackers can append address= entries via /etc/init.d/dnsmasq to alter DNS answers for LAN clients, or insert invalid lines that stop dnsmasq.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Shenzhen Cudy Technology

Products

Tr3000

CVE-2026-129103

Cudy TR3000 before 2.5.42 Command Injection via Scheduled Reboot Time

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, which /etc/init.d/autoreboot writes to the root crontab for crond to run.

CVSS 4.0 · 8.6 High EPSS 2.0% KEV · Not listed

Vendors

Shenzhen Cudy Technology

Products

Tr3000

CVE-2026-129102

Cudy TR3000 before 2.5.42 Command Injection via vpn.set_conf IPsec keyexchange

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.set_conf RPC method. Attackers can append a second leftupdown directive to ipsec.conf, which StrongSwan's updown plugin runs as root when an attacker-controlled peer establishes the CHILD_SA.

CVSS 4.0 · 8.6 High EPSS 1.7% KEV · Not listed

Vendors

Shenzhen Cudy Technology

Products

Tr3000

CVE-2026-129101

Cudy TR3000 before 2.5.42 Authenticated RCE via vpn.set_conf Mass Assignment

Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.set_conf App RPC method that allows authenticated administrators to inject arbitrary OpenVPN server options. Attackers can set enabled=1 and a malicious up option in the openvpns object, which the openvpn-hotplug wrapper executes via /bin/sh as root.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Shenzhen Cudy Technology

Products

Tr3000

CVE-2026-129100

Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Key Upload Injection

Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to execute commands as root by uploading crafted OpenVPN private or tls-auth keys. Attackers can close the inline key block with </key>, inject directives such as tls-verify that bypass the .ovpn denylist, and have OpenVPN execute the hook as root.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Shenzhen Cudy Technology

Products

Tr3000