CVE-2026-119511

WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Saeed Wordpress-extensions

Products

Mc Woocommerce Wishlist Mc Woocommerce Wishlist

CVE-2026-123570

Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts

The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a client/resolver, with these counts set to 65535, forcing about 18MB of allocation per message.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123571

Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding

Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to trigger a panic via malformed records. Attackers can send a crafted TSIG record in DNS wire format to cause unchecked subtraction underflow, crashing builds with overflow checks enabled and causing denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123572

Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser

Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123574

Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser

The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123575

Hickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodies

Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-95778

Remote Code Execution in HPE Morpheus Software

A remote code execution vulnerability exists in HPE Morpheus Software.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Morpheus Software

CVE-2026-95733

Use of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code Execution

A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95736

Unauthenticated Adjacent Improper Certificate Validation Vulnerabilities in HPE Networking Fabric Composer

Improper certificate validation vulnerabilities exist in the affected interface of HPE Networking Fabric Composer, which could be exploited by an unauthenticated adjacent attacker if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept sensitive information.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95737

Local Privilege Escalation in HPE Networking Fabric Composer

A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with high privileges to gain elevated privileges on the underlying host operating system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95738

Authentication Bypass in the Affected Interface of HPE Networking Fabric Composer

Authentication bypass vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95749

Unauthenticated Missing Integrity Verification in HPE Networking Fabric Composer

A missing integrity verification vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95752

Local Privilege Escalation in HPE Networking Fabric Composer

A local privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to elevate their privileges on the affected system.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-95756

Authenticated Command Injection Vulnerability in the API of HPE Networking Fabric Composer

A command injection vulnerability exists in the API of HPE Networking Fabric Composer and could be exploited by an authenticated remote attacker with administrative privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain elevated privileges on the underlying operating system.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-119503

WordPress Welcart e-Commerce plugin <= 2.12.6 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Code Injection.This issue affects Welcart e-Commerce: from n/a through 2.12.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Welcart Wordpress-extensions

Products

Welcart E-commerce Welcart E-commerce

CVE-2026-123484

WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Crocoblock Wordpress-extensions

Products

Jetformbuilder Jetformbuilder

CVE-2026-71226

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat Smuellerdd

Products

Enterprise Linux Enterprise Linux Eus Hardened Images and 7 more

CVE-2026-123576

Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests

Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing pre-allocated buffers to persist without timeout and exhausting server memory.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123578

Hickory DNS 0.26.0 before 0.26.2 Response Validation Bypass via QDCOUNT=0

Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP response's question section matches the query when the response has an empty question section (QDCOUNT=0), and also skip the case-randomization check. Remote attackers able to inject spoofed UDP responses can send QDCOUNT=0 responses to bypass these checks, weakening defenses against DNS spoofing.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns

CVE-2026-123579

Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Wildcard Expansion

DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a zone with wildcard records, an attacker can combine an NSEC3 record matching the query name with a signed wildcard record into a bogus positive response that validation accepts.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hickory-dns

Products

Hickory-dns