CVE-2026-124578
A security vulnerability has been detected in Pantum BP5100DW 3.A.4.7. The impacted element is an unknown function of the file /shtml/omDB.s
CVSS
5.3
Média
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 9 de nov. de 2026 · Última mod.: 9 de nov. de 2026 · CWE-287 · CWE-306
Ainda não há histórico EPSS suficiente.
A security vulnerability has been detected in Pantum BP5100DW 3.A.4.7. The impacted element is an unknown function of the file /shtml/omDB.shtml of the component Web Interface. The manipulation leads to missing authentication. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-112170——
———The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.2hCVE-2026-118461——
———The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.3hCVE-2026-68982——
———Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.
Users are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it.2hCVE-2026-1245779.8 CRÍ—
———A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.00.74 is sufficient to fix this issue. Upgrading the affected component is advised.7hCVE-2026-1245737.3 ALT—
———A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.8hCVE-2026-1189048.1 ALT—
——0IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.19h