CVE Intelligence Workbench

CVE-2026-12223 affects Yealink SIP-T46U phones running version 108.86.0.118. A local-network attacker with low privileges could inject operating-system commands through the phone’s web FastCGI service. Public exploit material is reported, but the sources do not show confirmed active exploitation. Vendor response and fixed firmware are not identified in the provided sources.

CVE-2026-12219 affects Yealink SIP-T46U phones running firmware 108.86.0.118. A remote authenticated user may inject operating-system commands through the phone’s web diagnosis function. Public sources say exploit material has been published, but they do not show confirmed active exploitation.

CVE-2026-12216 is a memory corruption issue in Duktape, an embeddable JavaScript engine. It requires local access, so it is not described as remotely exploitable. A public exploit reference exists, but the sources do not show active exploitation. Business urgency is moderate, especially for products or appliances embedding affected Duktape versions.

CVE-2026-12213 is an improper authorization issue in Huly Platform through 0.7.0. A logged-in remote user may access limited user information they should not be allowed to see. Public exploit information exists, but the provided sources do not show active exploitation or a vendor fix.

CVE-2026-12212 is an access-control flaw in Huly Platform’s RPC interface affecting versions up to 0.7.0. A low-privileged remote user may be able to access mailbox secret data through getMailboxSecret. Public disclosure exists, but the provided sources do not show confirmed active exploitation.

CVE-2026-12211 affects the Intelbras iNVU 7016 FT web interface. A high-privileged remote user could abuse the syslog file-loading path to traverse directories and read limited data. The vendor reportedly released a fixed version. Risk is moderated by required privileges, but public exploit information increases urgency for exposed devices.

CVE-2026-12210 is a server-side request forgery issue in python-utcp 1.1.0 affecting utcp-gql/utcp-websocket. A remote authenticated attacker may be able to make the server send unintended requests, potentially reaching internal resources. Public exploit information is reported, but active exploitation is not confirmed by KEV or the provided sources.

CVE-2026-4887 affects GIMP when a user opens a malicious PCX image. The likely impact is application crash and limited memory disclosure, not system takeover. Business urgency is moderate: prioritize endpoints or servers where GIMP is installed and users handle untrusted image files.

CVE-2025-5372 is a libssh cryptographic error-handling flaw. In affected builds, a failed key-derivation operation may be treated as successful, causing SSH sessions to use uninitialized keys. That can weaken confidentiality, integrity, and availability, but the published severity is medium and exploitation is not reported in the provided sources.

CVE-2026-12209 affects RubyLouvre avalon’s template filter handling. A remote attacker may be able to modify JavaScript object prototypes, which can undermine application logic and potentially lead to code injection impacts. Public exploit material is referenced, but active exploitation is not confirmed by KEV or the provided sources.

CVE-2026-12208 is a prototype pollution issue in the jsonata JavaScript library through version 2.2.0. A remote, unauthenticated attacker may be able to alter object prototype attributes when affected functionality processes attacker-controlled input. Public exploit material is referenced, but the provided sources do not show confirmed active exploitation.

CVE-2026-12207 affects medkey-org medkey’s HTTP REST API. A logged-in remote user may manipulate a patient ID parameter to access an unintended patient resource. The public record says exploit material is available, but there is no KEV listing or cited evidence of active exploitation.

CVE-2026-12206 is a SQL injection issue in Grit42 Grit through 0.11.0. A remote authenticated user may be able to interfere with database queries, affecting confidentiality, integrity, and availability. Public exploit material is referenced, but the provided sources do not show confirmed active exploitation.

CVE-2026-12203 exposes research export data in HKUDS AI-Trader through an endpoint that did not require proper authentication or capability checks. The reported endpoint is /api/research/agents.csv. The issue is remotely reachable, and public exploit information is reported, but it is not listed in CISA KEV.

CVE-2026-12202 is a cross-site scripting issue in Intelliants Subrion CMS 4.0.0 through 4.0.3. It affects the Blocks Endpoint via the CSS class name argument. The rating is medium, but public exploit information exists. The available sources do not show confirmed active exploitation or an official vendor fix.

CVE-2026-12201 affects IObit Malware Fighter versions 13.0 through 13.2.0. A local, already-authenticated user may abuse DLL handling permission weaknesses to impact confidentiality, integrity, and availability at a limited level. Public exploit material is referenced, but the source bundle does not show confirmed active exploitation.