CVE-2026-70381 is an authentication bypass vulnerability in the web server configuration of WolfVision Cynap series devices. It allows unauthenticated remote attackers with network access to the web interface to access certain on-device resources intended only for local use. These accessible resources do not include credentials or administrative functions but may expose non-public device content such as screen-saver files or web interface assets. The vulnerability affects multiple Cynap product variants prior to fixed versions.
The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affect PHP, which runs on over 70% of websites. These vulnerabilities pose a critical risk, especially for unsupported legacy PHP versions that no longer receive upstream support. Organizations are urged to quickly identify affected PHP deployments and update to fixed versions. Tenable provides solutions to discover vulnerable PHP assets across external attack surfaces, cloud workloads, and web applications, and assists in prioritizing and accelerating remediation efforts.
CVE-2026-57193 is a vulnerability in the Asterisk telephony toolkit's LDAP realtime driver (res_config_ldap) that allows LDAP filter injection via a crafted SIP username. This can enable an unauthenticated attacker to perform arbitrary LDAP queries and potentially disclose information. The vulnerability affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. The res_config_ldap module must be enabled and configured to access an LDAP server for the issue to be exploitable. Fixed versions are available.
CVE-2026-70380 is a denial-of-service vulnerability in the Miracast over Infrastructure Connection Establishment (MICE) service of WolfVision Cynap devices. An unauthenticated attacker with network access to MICE can exhaust connection capacity, blocking legitimate Miracast connections. Miracast P2P is unaffected, and MICE is disabled by default, requiring explicit customer enablement. Some devices may experience complete Miracast disruption when WLAN is in Infrastructure mode. Fixed versions are 1.78a, 2.00d, and 1.72e.
A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. Patch name: bbee3369f3825d0fba2373d821f6dc6d4fc82ec0. Upgrading the affected component is advised.
The Hugging Face LeRobot library versions 0.4.0 through 0.6.1 are vulnerable to arbitrary code execution due to unsafe dynamic class instantiation in the from_pretrained() method. This occurs when loading a policy's processor configuration from a repository, where the library uses the class field in JSON configuration to dynamically import and instantiate Python classes without proper validation.
CVE-2026-115927 is a medium severity vulnerability in the Tornado Python web framework prior to version 6.6.0. It involves uncontrolled resource consumption due to inefficient handling of HTTP/1.1 chunked transfer encoding. A remote unauthenticated attacker can send many small chunks to monopolize the event loop, stalling other connections and causing denial of service. The issue is fixed in Tornado 6.6.0.
CVE-2026-57187 is a heap-use-after-free vulnerability in Asterisk's PJSIP TCP/SDP handling. It affects multiple versions prior to the fixed releases and requires an authenticated attacker to send a SIP INVITE over a connection-oriented transport and disconnect before a 200 OK response. The issue has been reproduced only with Address Sanitizer, a development tool not used in production. Fixed versions are available.
CVE-2026-116478 is a medium severity vulnerability in a2aproject a2a-go up to version 2.4.0. It affects the CreateExecutor function in the Push Notification Handler component, causing information exposure through error messages. The vulnerability can be exploited remotely. Upgrading to version 2.5.0 mitigates the issue.
CVE-2026-57196 is a reflected cross-site scripting (XSS) vulnerability in Asterisk's phone provisioning HTTP error pages. It affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. An unauthenticated attacker can exploit this vulnerability to steal an authorized user's AMI session cookie and impersonate that user, but only if the HTTP server, AMI, and AMI HTTP access are enabled and the attacker can convince the user to click a malicious link. By default, the HTTP server binds to 127.0.0.1, limiting exposure. The issue is fixed in the stated versions.
CVE-2026-115924 is a path traversal vulnerability in rembg versions prior to 2.0.82. The vulnerability exists in the /api/remove endpoint, where an attacker can supply a crafted sam_model parameter that leads to downloading malicious ONNX files and reading arbitrary files accessible to the rembg process. This can result in disclosure of sensitive files and arbitrary ONNX computation. The issue is fixed in version 2.0.82.
CVE-2026-116477 is an information exposure vulnerability in the a2aproject a2a-dotnet component, specifically in the A2AJsonRpcProcessor.ProcessRequestAsync function. The flaw allows remote attackers to gain information through error messages. This issue affects version 1.0.0-preview2 and is resolved by upgrading to version 1.0.0-preview3.
vsomeip, an open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability in versions 3.7.3 and below. The vulnerability allows a remote, unauthenticated peer to cause excessive memory allocation by declaring a large message size on a reliable (TCP) endpoint before the actual message bytes are received. This can lead to denial of service by exhausting host memory. The issue was fixed in version 3.7.4 by introducing a default maximum message size limit of 10 MiB.
CVE-2026-116476 is a medium severity race condition vulnerability in the a2aproject a2a-dotnet software, specifically affecting version 1.0.0-preview3. The flaw exists in the TaskProjection.ApplyStatus function of the TaskProjection component. This vulnerability can be exploited remotely without user interaction and requires low privileges. A fix has been proposed via a pull request but has not yet been accepted or released.
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server.
This only affects users that make their HTTP or RTR server available to untrusted networks.
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.
Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails.
When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.