CVE Watch3 de nov. de 2026

CVE-2026-121539

A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the f

CVSS

6.3

Média

EPSS

0.2%

p11

KEV

—

Exploit Today

0-100

Publicado: 3 de nov. de 2026 · Última mod.: 3 de nov. de 2026 · CWE-266 · CWE-284

EPSS · 30d

0.2%EPSS · 30 dias0.2%

2026-11-042026-11-05

Descrição técnica

A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-49939—

—

———In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP. Users are recommended to upgrade to version 3.9.1 which fixes this issue.8h CVE-2026-1208449.8 CRÍ

—

———Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.12h CVE-2026-97976.5 MÉD

—

———A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.13h CVE-2026-1182395.6 MÉD

—

———The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.8h CVE-2026-104137—

—

——0OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0.1d CVE-2026-104136—

—

——0OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the new_recall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege authenticated user who knows or enumerates a patient identifier can retrieve patient details, contact fields, HIPAA notification preferences, recent appointment information, and existing recall information. This issue is fixed in version 8.3.0.1d