CVE-2026-116048 is a SQL injection vulnerability in the krupalshah EmployeeRecruitmentSystem affecting the mysql_query function in /source/registerform1.php. The vulnerability allows remote attackers to manipulate multiple input parameters leading to SQL injection. The product uses a rolling release model, so no specific affected or fixed versions are available. The vendor did not respond to disclosure and the affected product is no longer supported. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity).
CVE-2026-116047 is a cross-site scripting (XSS) vulnerability in Privoce Vocechat version 0.9.121. The flaw exists in the processing of the 'welcome' query parameter within the widget.html component. This vulnerability can be exploited remotely and requires user interaction. The vendor has not responded to the disclosure, and no patch or remediation information is currently available.
The noelc-css-blender npm package contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software or backdoors introduced by this package.
The npm package tailwindcss-theme-kit contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package 'tailwind-base-buttons' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as full control of the computer may have been given to an attacker.
CVE-2026-115981 is a cross-site scripting (XSS) vulnerability in phpIPAM versions 1.8.0 through 1.8.3. It involves manipulation of the REQUEST_URI argument in the upgrade/index.php file, allowing remote attackers to execute script code. The vulnerability has a medium severity rating with a CVSS score of 4.8. Public exploit code has been disclosed, but no known active exploitation in the wild is reported. The vendor was notified early about this issue.
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."
A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."
A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116004 is a cross-site scripting (XSS) vulnerability in the onyx-dot-app Onyx product, specifically affecting version 5.0.0. The vulnerability exists in an unknown function within the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The flaw allows remote attackers to execute XSS attacks. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a fix. The CVSS 4.0 score rates this as a medium severity issue.
The npm package '@eforms/forms-api' version 2.0.0-SNAPSHOT has been identified as malicious. The package is flagged because it communicates with a domain linked to malicious activity. There is no CVSS score available, and no known exploits in the wild have been reported. No patch or remediation information is provided.
A Cross-Site Scripting (XSS) vulnerability exists in the Contact Form by Supsystic WordPress plugin versions before 1.8.0. The plugin fails to properly sanitize and escape the form name, allowing users with form editor access to inject arbitrary scripts. On multisite WordPress installations, this vulnerability can be exploited to cross privilege boundaries when administrators lack the unfiltered_html capability.
A vulnerability in YunaiV/zhijiantianya ruoyi-vue-pro up to version 2026.09 affects the SMS Code Verification component, specifically the SmsCodeServiceImpl.validateSmsCode0 function. This flaw allows improper restriction of excessive authentication attempts, potentially enabling attackers to bypass rate limiting on SMS code validation. The attack requires high complexity and no privileges, with no user interaction needed. Exploit code has been published, but exploitation is considered difficult. The vendor has not responded to the disclosure. The CVSS score is 3.7, indicating low severity.
CVE-2026-116044 is a medium severity vulnerability in prasathmani TinyFileManager up to version 2.6. It involves an unrestricted file upload issue in the Remote URL File Upload Module within tinyfilemanager.php. This vulnerability allows remote attackers to upload files without restrictions. The exploit has been publicly disclosed, but there is no indication of active exploitation in the wild. The vendor has not responded to the disclosure, and no patch or official fix is currently available.
A vulnerability in YunaiV/zhijiantianya ruoyi-vue-pro up to version 2026.09 affects the SMS Code Verification component in the AuthController.java file. Improper handling of the mobile/code arguments leads to improper authentication, allowing remote attackers to exploit this flaw. The vulnerability has a CVSS score of 7.3, indicating a medium severity. The vendor has not responded to disclosure requests, and no patch or remediation guidance is currently available. Public exploit code exists but there are no confirmed reports of exploitation in the wild.
CVE-2026-116046 is a path traversal vulnerability in the eventcatalog sdk affecting versions up to 2.29.0. The flaw exists in the Custom Documentation Helpers component, specifically in the functions getCustomDoc, writeCustomDoc, and rmCustomDoc. It allows manipulation of the options.path argument to traverse directories on the local host. The issue is resolved by upgrading to version 2.30.0.
A security researcher discovered a method to bypass the AWS MCP Python sandbox restrictions in the aws___run_script tool, which executes user-supplied Python code in a restricted AWS Lambda environment. The sandbox uses AST validation and runtime proxy objects to block dangerous operations, including attribute access and imports. However, the researcher found that Python's structural pattern matching (match/case) can implicitly read attributes listed in __match_args__, bypassing the sandbox's attribute access restrictions. By assigning __match_args__ to sensitive dunder attributes and constructing attribute names at runtime, the researcher achieved sandbox escape and system command execution within the Lambda environment.
CVE-2026-116045 is a path traversal vulnerability in 1999AZZAR designer-mcp up to version 2.1.0. It affects the get_reference function in the MCP Interface component, allowing remote attackers to manipulate the argument Name to perform path traversal. The vulnerability has a medium severity with a CVSS score of 5.3. A patch identified by commit c8c2951dcbed9b1710a745993f028317f10a3f10 is available and applying it is advised.