CVE-2026-125285 is an authentication bypass vulnerability in TIBCO Platform’s Self-Hosted Control Plane versions 1 through 1.21. The flaw allows an attacker to bypass authentication by exploiting an alternate path or channel. This vulnerability has a high severity rating with a CVSS score of 8.8.
BookStack versions before 26.09.3 have an authorization vulnerability in the ImageController that allows authenticated non-admin users to bypass page-level content restrictions for images whose pages are soft-deleted (moved to the recycle bin). This occurs because the permission check fails when the page is null, allowing attackers to enumerate image IDs and access metadata of restricted images. Users with certain image privileges can also modify or delete images belonging to content they cannot view, causing persistent damage even after page restoration.
Zohocorp ManageEngine DDI Central versions prior to 6301 contain an authorization bypass and PowerShell command injection vulnerability. This flaw allows authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers by using crafted DNS suffix values. The vulnerability is addressed in version 6301.
PapaParse versions before 5.7.1 have an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service. This occurs when attackers submit delimiter-free quoted CSV input to the Papa.parse() function, causing repeated full-buffer scans that grow quadratically with input size. The result is CPU exhaustion and blocking of the Node.js event loop or freezing of browser tabs.
CVE-2026-111552 is a vulnerability in Hyper Teknoloji Ltd. Şti.'s Hyper E-Commerce Infrastructure products involving the use of single-factor authentication, which allows authentication bypass. The affected products include the core infrastructure before version 1.1, dealer integration before 1.2, and storefront application and management panel before 2.1796. This vulnerability has a high severity with a CVSS score of 7.1. Fixed versions are available for all affected components.
Zohocorp ManageEngine DDI Central versions prior to 6301 contain an authorization bypass vulnerability. Authenticated users without administrative privileges could modify DHCP options on subnets in clusters they are not authorized to access. This flaw allows unauthorized configuration changes, potentially impacting network integrity and availability.
CVE-2026-126994 is a vulnerability in braindecode versions 1.8.0 and 1.8.1 affecting the resolve_type_kwargs function in the Model Config Deserialization component. It allows an attacker to remotely manipulate the Activation argument, leading to the use of externally-controlled input to select classes or code. This flaw can result in unintended code execution. The issue is addressed by upgrading to braindecode version 2.0.0.
CVE-2026-110951 is a high-severity vulnerability in Hyper Teknoloji Ltd. Şti.'s Hyper E-Commerce Infrastructure products. It involves a weak password recovery mechanism that affects the main infrastructure, dealer integration, and storefront application and management panel. Versions before 1.1, 1.2, and 2.1796 respectively are vulnerable. The flaw allows exploitation of the password recovery process, potentially leading to full compromise of confidentiality, integrity, and availability. The issue has been fixed in versions 1.1, 1.2, and 2.1796.
Zohocorp ManageEngine DDI Central versions prior to 6301 contain an authorization bypass vulnerability. This flaw allows authenticated users without administrative privileges to modify Windows DHCP filter-list configurations on clusters they are not authorized to access. The vulnerability is addressed in version 6301.
Backup Migration for WordPress versions before 2.1.8 contains a path traversal vulnerability in its PclZip restore fallback. This flaw allows an attacker to write arbitrary files outside the intended directory when an administrator restores a malicious backup archive on a server without the PHP zip extension. The vulnerability arises because PclZip's extract() function processes crafted zip entries with '..' sequences without directory restriction, enabling remote code execution by placing PHP files in the web-accessible directory.
CVE-2026-123139 is a medium severity vulnerability in Opera Neon 1.0.0 on macOS and Windows. It involves improper verification of the source of a communication channel, allowing a malicious browser extension to send commands through the MCP Hub to the built-in Browser Operator extension, potentially taking control of the browser.
Zohocorp ManageEngine DDI Central versions prior to 6301 contain an improper authorization vulnerability (CWE-862) that allows authenticated non-administrative users to delete DNS zones outside their assigned scope. This flaw could lead to significant disruption of DNS services by unauthorized deletion of zones.
Zohocorp ManageEngine DDI Central versions prior to 6301 contain an authentication bypass vulnerability in the Windows DNS and DHCP agent synchronization APIs. This flaw allows unauthenticated users to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications. The vulnerability is critical with a CVSS score of 9.1 and has been fixed in version 6301.
CVE-2026-126993 is a vulnerability in SiteServer SSCMS versions 7.2.0, 7.2.1, and 7.2.2 involving inadequate encryption strength in an unknown function related to the /api/v1/captcha endpoint. The flaw allows remote attackers to manipulate an argument named Value, weakening encryption. Public exploit code has been released, but no vendor response or patch is available.
Zohocorp ManageEngine DDI Central versions prior to 6301 contain a PowerShell injection vulnerability caused by insufficient validation of user-supplied TXT record values in Windows DNS operations. This vulnerability allows an attacker with low privileges to execute arbitrary OS commands. The issue is fixed in version 6301.
An information disclosure vulnerability in the MISP Modules website component (external_tools module) allows unauthenticated network clients to retrieve stored API keys via the /external_tools/list endpoint. These API keys are exposed in JSON responses and also pre-populated in browser forms, increasing exposure risk. The flaw affects versions up to 3.1.4 and impacts confidentiality of API keys used for authenticating external service submissions.
Fortinet has addressed multiple vulnerabilities in its FortiOS product. Specific details about the vulnerabilities, affected versions, and impact are not provided in the available data.
The bsv-rs crate's Shamir backup recovery mechanism accepted shares with an x coordinate of 0, allowing an attacker to supply a crafted share that directly determines the recovered private key. This flaw existed since the crate's first release (0.2.0) and was fixed in versions 0.8.7 and 0.9.0-beta.7.0. The vulnerability allows an attacker to substitute the recovered private key if the application recovers a Shamir backup from shares it did not originally produce.
CVE-2026-124705 is an open redirect vulnerability in Progress Software's Telerik UI for .NET MAUI versions 5.2.0 up to but not including 16.0.0. The flaw exists in the RadRichTextEditor hyperlink handling and RadPdfViewer link annotation handling, allowing an unauthenticated attacker to craft documents or PDF links that launch arbitrary operating system protocol handlers with attacker-controlled arguments when opened by a user. This vulnerability is fixed in version 16.0.0.
Fortinet has addressed multiple vulnerabilities in FortiManager and FortiAnalyzer products, including their cloud versions and related products such as FortiManager Cloud, FortiAnalyzer Cloud, FortiAnalyzer-BigData, FortiSASE-Sovereign, and FortiSASE-Sovereign GUI. The specific vulnerabilities span a range of common weakness enumerations (CWEs) but no detailed impact or exploitation information is provided.