CVE-2026-116504 is a critical command injection vulnerability in the TOTOLINK A950RG router, specifically version 4.1.2cu.5268_B20221104. The flaw exists in the setCloudUpgradeFW function within the Cloud Upgrade component, where manipulation of the FileName argument allows remote attackers to execute arbitrary commands. Public exploit code has been disclosed, increasing the risk of exploitation.
A vulnerability in crossbario autobahn-python versions 26.7.1 through 26.10.0 allows an unauthenticated WebSocket client to cause a memory exhaustion denial of service. The issue arises because the Brotli decompressor is called without an output limit, allowing a small, highly compressed frame to expand to hundreds of MiB before the server enforces the maximum message payload size. This flaw affects servers that enable the permessage-brotli feature via the compress extra. The vulnerability is fixed in version 26.10.1.
CVE-2026-116578 is an open redirect vulnerability in the Tornado Python web framework prior to version 6.6. The flaw exists in tornado.web.RedirectHandler URL templates that allow crafted request paths to manipulate the redirect scheme or network location via regex-capture substitutions. This can lead to attacker-controlled redirects on the application's domain, potentially facilitating phishing attacks. The issue is fixed in Tornado version 6.6.
Anthropic, an AI company, has filed for a potentially record-breaking IPO while its CEO warns of existential risks posed by advanced AI. The company highlights concerns about rogue AI agents conducting harmful activities and the broader societal risks of AI technology slipping out of human control. The IPO filing includes extensive risk disclosures, including the possibility of AI models being misused for malicious purposes or going rogue. Anthropic advocates for slowing AI development to allow safety measures to catch up and calls for industry-wide and governmental coordination. The company is also involved in a public dispute with the U.S. government over national security concerns related to its technology.
CVE-2026-116577 is a vulnerability in the Tornado Python web framework prior to version 6.6. The HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, leading to quadratic CPU consumption on the IOLoop thread. An unauthenticated client can exploit this by submitting a header block with many line-folding continuations, causing denial of service by blocking other connections. This affects availability only and is fixed in Tornado version 6.6.
CVE-2026-116576 is an OS command injection vulnerability in the systeminformation Node.js library prior to version 5.33.16. The issue arises from improper sanitization of service names used in PowerShell commands on Windows, allowing an attacker to inject arbitrary PowerShell expressions. Exploitation requires local or forwarded attacker-controlled input to the vulnerable services() or getDynamicData() functions. The vulnerability is fixed in version 5.33.16.
CVE-2026-116502 is an out-of-bounds write vulnerability in the turboderp-org ExLlamaV2 software versions 0.3.0, 0.3.1, and 0.3.2. The flaw exists in the QMatrix::make_sequential function within the GPTQ Index Handler component. It can be triggered by manipulating the g_idx argument locally, potentially leading to memory corruption. No patch or vendor response has been reported yet.
Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.
CVE-2026-116671 is a low-severity vulnerability in Xpdf version 4.06 and earlier. It involves an infinite loop caused by improper input validation of the progression order field in JPEG 2000 images. This flaw can cause the application to hang when processing specially crafted images.
CVE-2026-116482 is a cross-site scripting (XSS) vulnerability in the subhajitkhan online-clinic-management-system affecting the patientregistration.php file. The flaw arises from improper sanitization of the pat_name argument, allowing remote attackers to inject malicious scripts. The vulnerability has been publicly disclosed, and exploit code may be available. The product does not use versioning, so specific affected or fixed versions are not identified.
CVE-2026-70382 is a cross-site scripting (XSS) vulnerability affecting multiple WolfVision Cynap devices. The issue arises because some externally supplied values stored by the device are rendered in the web interface without proper output encoding. An attacker who can influence these stored values may cause script execution in the browser of users who view the affected pages. Exploitation requires both the ability to influence stored values and a user viewing the vulnerable page. The vulnerability has a medium severity rating with a CVSS score of 5.1.
CVE-2026-65630 is a timing side-channel vulnerability in the potatosalad jose library's pure-Erlang X25519 implementation. The vulnerability allows an attacker to recover a long-term X25519 private key by measuring decryption timing variations during scalar multiplication. This affects versions from 1.10.0 up to but not including 1.11.13. The issue is fixed in version 1.11.13.
The jose library versions from 1.0.0 up to but not including 1.11.13 improperly verify ECDSA JWS signatures by accepting signatures of non-canonical length. This signature malleability allows multiple distinct signature byte strings to verify as valid for the same token, defeating security controls that rely on signature uniqueness such as token revocation by hash, replay caches, and deduplication. The underlying cryptographic signature values (r, s) remain unchanged, so forging new payloads or impersonating signers is not possible. A fix is available in version 1.11.13.
CVE-2026-65631 is an inefficient algorithmic complexity vulnerability in the potatosalad jose library versions from 1.7.7 up to but not including 1.11.13. It allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key that triggers expensive factoring operations. The issue is fixed in version 1.11.13.
CVE-2026-65629 is a vulnerability in the potatosalad jose library versions from 1.10.0 up to but not including 1.11.13. It involves the use of a password hash with insufficient computational effort during the export of password-encrypted private keys. The key derivation uses PBKDF2-HMAC-SHA256 with only 2048 iterations and a 64-bit salt, both far below current security recommendations. This weakness allows an attacker who obtains an exported encrypted private key to perform an offline password-cracking attack to recover the private key.
CVE-2026-65628 is a vulnerability in the potatosalad jose library versions 1.5.0 up to but not including 1.11.13. It involves uncontrolled recursion in the function jose_jwk:shared_secret/2 when deriving an ECDH shared secret from two JSON Web Keys (JWKs) of differing key types. An attacker can supply a crafted JWK with a mismatched key type to cause an infinite tail-recursive loop, resulting in 100% CPU usage on an Erlang scheduler and potential denial of service due to resource exhaustion.
CVE-2026-65627 is a vulnerability in potatosalad jose (erlang-jose) versions from 1.0.0 up to but not including 1.11.13. It involves improper handling of highly compressed data during decompression of JWE tokens, allowing a remote attacker to exhaust node memory by sending a crafted small JWE token. The decompression function does not limit output size, enabling data amplification that can crash the BEAM virtual machine and cause denial of service.
CVE-2026-57184 is an out-of-bounds read vulnerability in the Asterisk telephony toolkit's chan_ooh323 addon channel driver. This flaw exists in the Q.931 information-element parser due to insufficient bounds checking. An unauthenticated attacker can exploit this by sending crafted setup packets to cause a crash. The vulnerability affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. The chan_ooh323 driver is not enabled by default and requires explicit compilation and a publicly reachable port. Fixes are available in the stated versions.
CVE-2026-65626 is a Bleichenbacher padding oracle vulnerability in the pure-Erlang RSAES-PKCS1-v1_5 decryption implementation of the jose_jwa_pkcs1 module in potatosalad jose. The vulnerability arises because the decryption function returns distinct error messages depending on padding validity and does not implement countermeasures to mask these differences. An attacker with access to the public RSA key and the ability to submit ciphertexts to a decryption endpoint can exploit this to recover plaintext or forge signatures through adaptive chosen-ciphertext attacks. This affects versions from 1.3.0 up to but not including 1.11.13. The issue is fixed in version 1.11.13.
CVE-2026-65625 is a vulnerability in the potatosalad jose library affecting versions from 1.2.0 up to but not including 1.11.13. The issue arises in the pure-Erlang AES-GCM fallback implementation where the authentication tag length is derived from attacker-supplied data without proper validation. This allows an attacker controlling a JWE token to truncate the authentication tag to as little as 8 bits, drastically reducing forgery resistance and enabling reliable forgery within 256 attempts. Supplying an overly long tag causes a crash. The vulnerability is fixed in version 1.11.13.