Trending Vulnerabilities

CVE-2026-83548 is a critical pre-authentication server-side request forgery vulnerability in the SonicWall SMA1000 Appliance Work Place interface. An unintended alternate access path causes the appliance to function as an unintended proxy, allowing unauthenticated remote requests to reach sensitive functionality or internal appliance services that should not be externally accessible. The issue is also associated with CWE-441, Unintended Proxy or Intermediary. It affects SMA1000 6210, 7210, and 8200v appliances running platform-hotfix 12.4.3-03453 and earlier or 12.5.0-02835 and earlier.

CVE-2026-19949 is an unauthenticated second-order SQL injection vulnerability in ServMask All-in-One WP Migration and Backup for WordPress through version 7.109. Attacker-controlled WordPress trackback fields can be stored in the comments database table and later processed during an administrator-initiated export and subsequent import or archive restore. The vulnerable Ai1wm_Database::replace_table_values() database-rewrite logic inadequately handles escaping and SQL preparation. Its regular-expression handling of quoted strings and backslashes can incorrectly alter a SQL string boundary, converting the previously stored trackback content into executable SQL during restoration. The injection can be used to read the ai1wm_secret_key from the WordPress options table and expose it through an approved comment.

CVE-2026-20212 is a critical vulnerability in the Silicon One integration of affected Cisco Nexus 9000 Series Switches. TCP ports 43210 and 43211 are reachable in the default Layer 3 VRF, permitting an unauthenticated remote attacker to submit crafted input that is executed as code with root privileges. The vulnerability is associated with CWE-1327.

CVE-2026-83549 is a post-authentication OS command injection vulnerability in the SonicWall SMA1000 Appliance Management Console (AMC). Insufficient neutralization of special elements in operating-system command input can, under unspecified conditions, allow a remote attacker authenticated with administrator privileges to execute arbitrary OS commands on the appliance. The issue affects SMA1000 6210, 7210, and 8200v appliances running platform-hotfix 12.4.3-03453 or earlier, or 12.5.0-02835 or earlier. The vulnerability has been reported as actively exploited and may be combined with CVE-2026-83548 to remove the normal authentication prerequisite.

CVE-2026-9586 is a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition versions prior to 8.4.0.2, including version 8.3 build 104997. The unauthenticated phone-notification handler accepts XML messages and concatenates an attacker-controlled PhoneIP value directly into PostgreSQL statements without validation, sanitization, or parameterized queries. A single crafted request can inject arbitrary SQL and can be leveraged for operating-system command execution through the PostgreSQL service context.

CVE-2026-82329 is a critical improper-authentication vulnerability in the JFrog Access component of self-managed JFrog Artifactory. Under the default configuration, an unauthenticated attacker with network access can abuse credential and join-key handling to forge access and mint administrator-level authentication tokens. The issue affects Artifactory 7.111.4 through 7.111.20, 7.117.0 through 7.117.27, 7.125.0 through 7.125.19, 7.133.0 through 7.133.28, 7.146.0 through 7.146.36, and 7.161.0 through 7.161.19. It is rated CVSS 9.8 and has been actively exploited.

CVE-2026-32475 is an unrestricted dangerous file-upload vulnerability in the Elementor Pro Forms module for WordPress through version 4.2.1. The flaw is in the File Upload field handling, where Upload::validation() and process_field() process upload-array entries inconsistently. When an initial entry indicates no uploaded file, validation returns early rather than continuing to validate subsequent entries; processing skips the empty entry and continues handling later entries. An unauthenticated attacker can therefore submit a crafted multipart upload containing an empty first entry followed by a PHP payload, bypassing extension and file-type validation. The payload is stored in a web-accessible Elementor form-upload location with an attacker-controlled PHP extension and can be invoked to execute server-side code.

CVE-2026-62911 is an authentication bypass by capture-replay vulnerability in on-premises Microsoft Exchange Server. The issue affects an HTTP.sys-hosted Mailbox Replication Service Proxy (MRSProxy) interface that accepts Negotiate authentication without enforcing Extended Protection for Authentication channel binding validation. This permits relaying captured NTLM authentication material, including an Exchange server machine account’s credentials, to have the relayed identity treated as a trusted Exchange server account. Microsoft classifies the issue as network-based elevation of privilege. Public research further reports that the bypass can be chained with insufficient file-path validation in mailbox-replication functionality to perform arbitrary file writes and obtain code execution.

CVE-2026-73749 is a critical buffer-overflow vulnerability in a daemon within HPE Aruba Networking AOS-CX. The daemon improperly processes malformed input supplied in specially crafted packets sent to its exposed service. An unauthenticated remote attacker can trigger the flaw and execute code with elevated privileges on an affected AOS-CX device.

CVE-2026-85012 is an OS command injection vulnerability in the blueprint resynthesis framework of the AWS CodeCatalyst Blueprints package before version 0.3.156. The framework passed the owner value from a local merge-strategy entry to an operating-system command through a shell without sufficient validation. A repository contributor could supply shell metacharacters in that value to inject and execute arbitrary commands during blueprint resynthesis. Version 0.3.156 eliminates shell interpretation by executing the command directly and validating values against an allowlisted command form.

CVE-2026-12554 affects HP Easy Start for macOS versions before 2.16.7.260722. The software-installation workflow included the OSPFTP download component, an unmaintained third-party component that supported fallback download schemes including unencrypted FTP. This expanded the attack surface of the privileged installer by permitting software-download interference when an FTP fallback path is used.

CVE-2026-20355 is an insufficient message-integrity validation vulnerability in the S/MIME decryption functionality of Cisco Secure Email AsyncOS. The flaw affects devices running AsyncOS 16.5.0 or earlier when S/MIME is enabled. An unauthenticated attacker positioned to intercept and modify traffic exchanged between email gateways can exploit the deficient integrity validation to recover plaintext from encrypted S/MIME email messages.

CVE-2026-20354 is an insufficient message-integrity validation vulnerability in the S/MIME decryption functionality of Cisco Secure Email AsyncOS. A machine-in-the-middle attacker can intercept and modify traffic exchanged between email gateways, causing the affected decryption processing to reveal plaintext from encrypted S/MIME email messages. The issue affects Cisco Secure Email devices running AsyncOS 16.5.0 or earlier when S/MIME is enabled.

python-jose through version 3.5.0 improperly accepts DER-encoded asymmetric public keys as HMAC keys during HMAC initialization when those keys lack PEM armor or SSH key prefixes. In deployments that do not explicitly restrict permitted JWT algorithms, an attacker who possesses the service’s public key can use it as an HMAC secret to forge an HS256-signed token that the service accepts. The issue is an incomplete fix for CVE-2024-33663.

CVE-2026-58400 is an arbitrary operating-system command-execution vulnerability in GeoNetwork formatter rendering. In versions before 4.4.12 and 4.2.17, the Saxon XSLT processor is configured without secure processing enabled and with Java extension functions available. Consequently, an attacker-controlled formatter stylesheet can invoke Java runtime process-execution APIs, causing commands to run under the GeoNetwork process account.

CVE-2026-48710, known as BadHost, affects Starlette versions before 1.0.1. Starlette reconstructs request.url using an unvalidated HTTP Host header while routing continues to use the raw ASGI request path. A malformed Host value containing URL delimiters can cause URL parsing to produce a request.url.path different from the path dispatched by the router. Consequently, middleware or application endpoints that make path-based security decisions using request.url or request.url.path can be induced to evaluate an attacker-controlled benign or allowlisted path while the application processes a protected path.

CVE-2026-49869 is a critical improper authentication vulnerability in Kestra OSS versions before 1.0.45 and 1.3.21. The AuthenticationFilter exempts the public configuration endpoint from Basic Authentication using a suffix comparison on the request path. Because the validation does not require an exact endpoint match, API paths ending in the configuration segment can be incorrectly treated as public and bypass authentication. An unauthenticated attacker can use the bypass to create and execute arbitrary Kestra workflows. Default-enabled script execution plugins, including shell and Python runners, can convert workflow execution into remote code execution as root within the Kestra worker container.

CVE-2026-20280 is a Cisco IOS XR Software hardening advisory identifier for multiple internally discovered vulnerabilities involving improper checking or handling of exceptional conditions (CWE-703). Cisco identified the issues during an internal security review. The affected flaw details and individual vulnerable functions are not publicly specified. Cisco rates the identifier CVSS 8.8 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

CVE-2026-20277 is a Cisco IOS XR Software hardening vulnerability involving protection mechanism failures (CWE-693). The issue was identified during an internal security review and is addressed through Cisco IOS XR software hardening updates. Its CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H.

CVE-2026-12555 is an insecure temporary-file handling vulnerability in HP Easy Start for macOS before 2.16.7.260722. The HP Uninstaller used predictable temporary-file locations while executing with administrator privileges. A local attacker could prepare a symbolic link at an expected temporary-file location; once a user authorizes the uninstaller, the privileged process may follow that link when writing generated log data to an attacker-selected file.

CVE-2026-59822 is an authentication bypass in BerriAI LiteLLM versions earlier than 1.84.0. The MCP Streamable HTTP endpoint incorrectly handles OAuth2 passthrough failures: when LiteLLM key validation fails after receiving a fabricated Authorization header, a fallback path substitutes an empty UserAPIKeyAuth() object rather than rejecting the request. This causes the request to be treated as authenticated and permits access to MCP tooling without a valid LiteLLM key.

CVE-2026-84851 is an uncontrolled-recursion vulnerability in the Ion reader of Amazon Ion-C versions earlier than 1.1.6. Processing specially crafted Ion text or binary data can cause recursive parsing or rewriting operations to exceed the native call-stack limit. The resulting stack exhaustion crashes the application embedding the vulnerable library.

Peppermint through version 0.5.5 uses a hardcoded JWT signing secret in its deployment configuration. An attacker who obtains the published secret can generate JWTs with attacker-selected identity claims, including arbitrary user IDs. The application accepts these forged tokens as valid authentication tokens, permitting access to endpoints protected by JWT authentication without legitimate credentials.

CVE-2026-84645 is an unsafe deserialization and request-routing vulnerability in Jenkins 2.579 and earlier and Jenkins LTS 2.568.2 and earlier. Objects whose configuration is stored in independent top-level Jenkins configuration files, including global configuration and job objects, can be supplied as nested serialized PersistenceRoot values in submitted Jenkins configuration XML. The nested objects can subsequently service HTTP requests through Stapler, exposing an insufficiently protected Script Console and enabling remote code execution.