An out-of-bounds write vulnerability exists in llama.cpp versions before b11865 in the ggml-rpc RDMA transport's rdma_recv() function. This flaw allows unauthenticated peers advertising RDMA capabilities to overflow a 1-byte stack variable by sending up to 256 KiB of data, potentially crashing the server or enabling code execution.
LibreSSL versions up to 4.4.0 contain a memory exhaustion vulnerability in the ocspcheck component. This flaw allows malicious OCSP responders to send unbounded HTTP responses, causing the client to consume excessive memory. Attackers who control the OCSP responder or can intercept unencrypted HTTP AIA OCSP traffic can exploit this by streaming endless headers or body data, resulting in denial of certificate status checks.
CVE-2026-118373 is a vulnerability in LibreSSL's ocspcheck component up to version 4.4.0 that causes cleartext transmission of sensitive OCSP request data. The issue arises because the function url2host() removes the OCSP URL scheme, and http_alloc() only uses TLS for port 443. As a result, OCSP requests sent to HTTPS responder URLs on non-443 ports are transmitted without encryption, exposing certificate serial numbers, issuer hashes, and nonces to on-path attackers.
LibreSSL versions up to 4.4.0 contain a CRLF injection vulnerability in the ocspcheck utility. This flaw allows attackers to inject HTTP headers by embedding carriage return and line feed sequences in a certificate's AIA OCSP URI path. The vulnerability arises because the url2host() function copies the path without filtering control characters, and http_open() includes this path in the POST request line, enabling header injection or request splitting to the OCSP responder.
LibreSSL versions up to 4.4.0 have a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions. This flaw allows attackers to inject carriage return and line feed characters into the OCSP request line by embedding them in a certificate's Authority Information Access OCSP URI. This can lead to HTTP header injection or request splitting when communicating with OCSP responders or proxies.
CVE-2026-118370 is a high-severity vulnerability in libexpat up to version 2.9.0 involving a signed integer overflow in the storeAtts() function. This flaw allows attackers to cause out-of-bounds writes by supplying a document with an extremely large number of attributes, potentially crashing applications or corrupting heap memory.
CVE-2026-117610 is a high-severity vulnerability in libexpat up to version 2.9.0 involving a NULL pointer dereference in the externalEntityInitProcessor2() function. This flaw occurs when the function mishandles the XML_TOK_NONE token from empty input, allowing attackers who control stream chunking to cause a crash by forcing an empty non-final first parse on an external entity subparser.
rtl_433 versions 21.12 through 25.12 contain a stack-based buffer overflow vulnerability in the proflame2_mc() function. This flaw allows attackers within radio range to send more than seven valid Manchester-coded words, overflowing a 7-byte stack buffer. Exploitation can crash rtl_433 and corrupt stack memory, potentially enabling control-flow hijacking on builds lacking stack canaries.
An integer overflow vulnerability exists in assimp through version 6.0.5 in the MD2Importer::ValidateHeader() function. This flaw allows attackers to craft malicious .md2 files with manipulated numFrames and numVertices fields that bypass frame table bounds checks. Exploitation can lead to heap out-of-bounds reads, causing application crashes or potential exposure of adjacent heap memory.
Xerte Online Toolkits versions up to 3.15.5 have a remote code execution vulnerability that allows authenticated users with system permissions to execute arbitrary PHP code by importing a specially crafted language pack ZIP file containing a .inc file. This file can then be accessed via the language parameter to trigger code execution on the server.
NexoPOS versions up to 6.3.0 have an authorization bypass vulnerability that allows authenticated cashiers with the default permission nexopos.use.registers to manipulate other cashiers' register sessions. This occurs because the CashRegistersService does not verify that the user performing actions on a register session is the session owner. Attackers can submit POST requests to the cash register API endpoints to force-close sessions or alter cash balances without proper authorization.
nopCommerce versions before 5.00.0 have an authorization bypass vulnerability in certain admin product handlers. Authenticated vendors can exploit this flaw by submitting another vendor's product ID to inject their products into the victim's related, cross-sell, and grouped product listings. This issue is fixed in version 5.00.0.
CVE-2026-118272 is a medium severity vulnerability in a2ui-project's a2ui component up to version 0.10.6. It involves the DataContext.dispatchExpressionError function in the Error Handler component, where manipulation can cause information exposure through error messages. The vulnerability can be exploited remotely. A patch identified by commit 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01 is available to address this issue.
The Jupiter X Core WordPress plugin up to version 4.61.0 contains an authentication bypass vulnerability in its Twitter/X social login handler. The flaw arises because the plugin fails to update the OAuth token after exchanging the oauth_verifier, causing the Twitter API call to authenticate as the site owner rather than the visitor. This allows attackers to gain authenticated access as the WordPress user linked to the Twitter app owner, typically the site administrator.
CVE-2026-118271 is a medium severity vulnerability in a2ui-project a2ui versions 0.10.0 through 0.10.6. It involves resource consumption caused by manipulation of an unknown function in the data-context Resolver component. The vulnerability can be exploited remotely without user interaction or privileges. Public exploit code has been disclosed. A patch identified by commit eb314e14fabd29cfb4a74e1202afc4fe2081efa2 is available to remediate the issue.
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in improper authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688. It is recommended to apply a patch to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.