CVE Watch3 nov 2026

CVE-2026-121539

A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the f

CVSS

6.3

Medio

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 3 nov 2026 · Última mod.: 3 nov 2026 · CWE-266 · CWE-284

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1215146.3 MED

—

———A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.3h CVE-2026-1215095.3 MED

—

———A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.2h CVE-2026-1199228.8 ALT

—

———Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.4h CVE-2026-1214167.1 ALT

—

———SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.6h CVE-2026-169007.5 ALT

—

——0Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.5h CVE-2026-135949.1 CRÍ

—

——0Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.5h