CVE-2026-121802 is a critical vulnerability in better-auth's Better Auth package versions before 1.7.16. It involves an origin validation error (CWE-346) where the software signs a caller-supplied state value without verifying if it was issued by the server. This flaw allows unauthenticated attackers to perform account takeover actions, such as changing any account's email address. The issue is fixed in version 1.7.16. After updating, the application secret must be rotated to ensure security.
CVE-2026-92196 is a server-side template injection vulnerability in Quest Foglight for Databases affecting the renderTemplateString method. It allows authenticated remote attackers to execute arbitrary code with SYSTEM privileges due to improper validation of user-supplied input before template processing. The vulnerability has a high severity rating with a CVSS score of 7.2.
CVE-2026-92199 is a local privilege escalation vulnerability in Quest Foglight for Databases caused by a hard-coded cryptographic key in the symmetricDecrypt method. An attacker with low-privileged code execution can exploit this flaw to escalate privileges to SYSTEM level and execute arbitrary code. The vulnerability has a high CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability.
The Core Temp kernel driver by ALCPU has an insufficient access control vulnerability in an exposed IOCTL interface. This flaw may allow an attacker with physical access to read or write physical memory, potentially leading to full system compromise. The vulnerability has a CVSS score of 6.7, indicating a medium severity level.
A SQL injection vulnerability exists in the sumiie24 School-Management-System in the parent_Login.php file within the Public Search Feature. The flaw allows remote attackers to manipulate the email argument to execute SQL injection attacks. The product uses a rolling release system, so specific affected or fixed versions are not disclosed. The vendor did not respond to early disclosure attempts. Exploit code has been published, and the vulnerability has a CVSS score of 7.3, indicating high severity.
CVE-2026-114549 is a critical heap-based buffer overflow vulnerability in the NoMachine nxwebrunner web service, which listens by default on TCP port 4443. This flaw allows remote attackers to execute arbitrary code without authentication due to improper validation of user-supplied data length before copying it to a heap buffer. The vulnerability affects NoMachine version 9.7.3.
CVE-2026-121730 is a missing authorization vulnerability in the 0xdps emailflare product before commit cf31f33. It affects the POST /api/inbox/compose endpoint, allowing authenticated users to send emails with arbitrary sender addresses. This flaw enables impersonation of other users or the organization to external recipients. The vulnerability has a high severity with a CVSS score of 7.1 and has been fixed in commit cf31f33bbb4a324d5353b8a5db0312fedc19618f.
A heap-based buffer overflow vulnerability was identified and addressed in Tanium Deploy. This flaw affects multiple versions prior to specific fixed releases. The vulnerability has a high severity rating with a CVSS score of 7.2, indicating it can lead to significant confidentiality, integrity, and availability impacts. Tanium has released fixes in versions 2.45.322, 2.40.235, and 2.36.294 to remediate the issue.
CVE-2026-108324 is an integer overflow or wraparound vulnerability in Tanium Client that could lead to a denial of service condition. The issue affects specific versions of Tanium Client prior to fixed releases 7.8.2.1258 and 7.8.4.1394. Tanium has addressed this vulnerability with patches in these versions.
CVE-2026-118865 is an authenticated OS command injection vulnerability in the Offline Download component of TP-Link Archer AX3000 v2 routers. An authenticated administrator attaching a USB storage device can submit a crafted path containing shell metacharacters that are not properly sanitized before being passed to a system command. This flaw allows arbitrary command execution on the affected device. The vulnerability has a CVSS 4.0 score of 7.3 (high severity). A fix is available in firmware version 1.1.3 Build 261026.
Dell OS Recovery tool versions prior to 2.4.4 contain a use of Untrusted Search Path vulnerability (CWE-428). This flaw allows an unauthenticated local attacker to potentially execute arbitrary commands by exploiting the way the tool searches for executable files. The vulnerability has a high severity with a CVSS score of 7.8.
A local privilege escalation vulnerability has been identified in the API of HPE Networking Fabric Composer. This flaw allows a low-privileged local attacker to elevate their privileges on the affected system. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity. No specific affected versions or patch information are provided at this time.
CVE-2026-95753 is a privilege escalation vulnerability in the API of HPE Networking Fabric Composer. An authenticated attacker with low privileges could exploit this flaw to disclose network traffic from switches managed by the Fabric Composer. The vulnerability has a high severity rating with a CVSS score of 7.1.
Netcore NBR100V2 version 1.3.240614.030928 contains an integer overflow vulnerability in the msg_aes_dec function of the /usr/bin/auto_ac file. This flaw allows remote attackers to cause a denial of service by triggering an integer overflow. The vulnerability has a high severity score of 7.5 and public exploit code is available. The vendor was notified but has not responded or provided a fix.
Etrel INCH AC charging station management web interface versions prior to 7.1.2 and 8.0.1 contain a hard-coded default credentials vulnerability. This flaw allows remote attackers to gain full Administrator access by authenticating with factory-default credentials over unencrypted HTTP. Exploitation enables unauthorized administrative control, including access to charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details.
CVE-2026-95728 is a local privilege escalation vulnerability in the Virtual Intranet Access (VIA) client for Linux. It involves an arbitrary file write flaw that allows a local attacker with low privileges to escalate their privileges on the affected system. The vulnerability affects VIA client versions from 0.0.0 up to and including 4.7.8. The CVSS v3.1 base score is 7.1, indicating high severity. No public exploits or in-the-wild exploitation have been reported. The vendor has not provided explicit patch or remediation information in the available data.
CVE-2026-95726 is a buffer overflow vulnerability in Hewlett Packard Enterprise's Virtual Intranet Access (VIA) product. It allows an unauthenticated remote attacker to cause a denial of service by interrupting the normal operation of the affected client software. The vulnerability affects versions from 0.0.0 up to and including 4.7.8. No confidentiality or integrity impact is indicated, but availability is severely impacted. The CVSS v3.1 base score is 7.5, indicating high severity.
CVE-2026-95725 is an authenticated local command injection vulnerability in the VIA client for Linux by Hewlett Packard Enterprise. A low-privileged local attacker could exploit this flaw to execute arbitrary commands with elevated privileges on the affected system. The vulnerability affects VIA client versions from 0.0.0 up to and including 4.7.8. The CVSS v3.1 base score is 7.8, indicating a high severity impact.