CVE-2026-122325

eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API

fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Fossasia

Products

Eventyay-exhibition

CVE-2026-122324

SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails

SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense notes, recurrence schedules, and full user rows of participants and group members.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Oss-apps

Products

Splitpro

CVE-2026-122308

Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequest

Kyverno before 1.19.2 contains an authorization bypass vulnerability in the Generation Handler that allows users with create/update permissions to trigger synchronized generate policies by spoofing internal generate.kyverno.io labels. Attackers can label a ConfigMap as managed-by kyverno with crafted policy, rule, and trigger labels to clone sensitive Secrets from restricted namespaces into their own namespace.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Kyverno

Products

Kyverno

CVE-2026-122019

6amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization

A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument user_response leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

6amtech

Products

6valley

CVE-2026-121732

RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment

RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Rosariosis

Products

Rosariosis

CVE-2026-121582

Umami Record API Endpoint route.ts authorization

A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Umami

Products

Umami

CVE-2026-112198

Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App

XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Tactis

Products

Novigest Desktop App

CVE-2026-10844

IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to conduct phishing attacks.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server Liberty

CVE-2026-102339

Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Telepresenceio

Products

Telepresence

CVE-2026-77442

Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)

Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller's user_id while replacing the targeted integration's provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim's integration. Exploitation requires obtaining the victim's non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ignisda

Products

Ryot

CVE-2026-123584

Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses

The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can spoof malformed responses to abort client queries, causing denial of service.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123598

Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning

The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123602

Hickory DNS Recursor Ghost Domain Attack via Child-Side NS RRset Caching

The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a zone's NS records, an attacker keeps the stale RRset cached indefinitely, letting name servers whose delegation the parent revoked keep answering for the zone.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-124465

Trendyol kafka-konsumer 2.3.3 before 2.6.18 Denial of Service via Batch Consumer Panic

Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before offset commit, causing a persistent crash loop.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Trendyol

Products

Kafka-konsumer

CVE-2026-118459

AIS PasswordSOS permits authentication without legitimate credentials

A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118468

AIS XML parsers allow external entity resolution

XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118795

AIS stores authorization state in locally modifiable databases

Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Profim Venere

CVE-2026-123088

UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII Disclosure

The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-12080

Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux Enterprise Linux Nvidia and 2 more

CVE-2024-4603

Excessive time spent checking DSA keys and parameters

Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the `-check` option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Netapp Openssl Redhat

Products

500f 500f Firmware 8300 and 37 more