CVE-2026-120xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
2 records · Page 1 of 1
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.
Updated- CVE-2026-120007: NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid 6.9 Medium
NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions.
Updated