CVE WatchNov 9, 2026

CVE-2026-124987

A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. S

CVSS

6.3

Medium

EPSS

—

KEV

—

Exploit Today

0-100

Published: Nov 9, 2026 · Last modified: Nov 9, 2026 · CWE-74 · CWE-116

EPSS · 30d

Not enough EPSS history yet.

Technical description

A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-63497—

—

———titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches.14h CVE-2026-125112—

—

———djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name. A template using {% with %}, {% for %}, {% include ... with %}, tuple unpacking, or assign tags can therefore rebind a name that previously held mark_safe content and emit the new attacker-controlled value without escaping, including descendant lookups through the rebound name. This can cause stored or reflected cross-site scripting when a victim renders the affected template. This issue is fixed in versions 1.0.10 and 1.1.2.14h CVE-2026-1246256.3 MED

—

——0A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-include/pp-functions.php of the component Admin Panel. The manipulation of the argument selected_ids/ItemID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.22h CVE-2026-1245915.5 MED

—

——0A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.13h CVE-2026-1245886.3 MED

—

——0A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolve_component_cls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.1d CVE-2026-1245817.3 HIG

18.2%

——5A vulnerability was determined in itsourcecode Airline Reservation System 1.0. Affected is an unknown function of the file /admin/manage_flight.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.1d