OpenPanel versions prior to 3.0.0 contain an SQL injection vulnerability that allows authenticated users to bypass tenant scoping. This occurs because unescaped profile filter names are injected into a JOIN subquery, enabling attackers to manipulate the query with a crafted filter name and trailing comment. This bypasses the project_id WHERE clause and allows reading events from all projects.
OpenPanel versions before 3.0.0 have an authorization vulnerability in the onboarding.project tRPC mutation. This flaw allows non-admin organization members to create projects and generate write-type ingestion credentials, bypassing intended admin-only restrictions. Exploitation can lead to exposure of plaintext secrets, injection of fake analytics events, distortion of business metrics, and unauthorized consumption of the organization's usage budget. The vulnerability has a medium severity score of 5.3 and is fixed in OpenPanel version 3.0.0.
OpenPanel versions prior to 3.0.0 have an information disclosure vulnerability that allows read-level project members to access argon2id hashes of ingestion credentials via the client.list tRPC query. This exposure enables offline verification of leaked secrets without generating audit trails. The vulnerability is fixed in version 3.0.0.
DOMPurify versions from 3.4.4 up to but not including 3.4.17 contain a vulnerability that allows attackers to bypass the SAFE_FOR_TEMPLATES protection. This flaw enables preservation of template expressions in attached shadow roots when using certain return modes, leading to potential cross-site scripting (XSS) when these expressions are merged and evaluated by downstream template engines.
DOMPurify versions before 3.4.17 contain a cross-site scripting (XSS) vulnerability. This flaw allows attacker-controlled event handlers to remain active when an IN_PLACE hook removes a parent or sibling node during sanitization. As a result, attacker markup in detached subtrees is not properly sanitized, enabling event handlers like img onerror to execute after the sanitize() function completes.
DOMPurify versions before 3.4.17 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to bypass the SMIL attributeName=href guard when parsing application/xhtml+xml content. The vulnerability arises because the transformCaseFunc function does not lowercase attribute names, enabling malicious SVG elements with animate or set tags to execute JavaScript when users click sanitized links. The issue is fixed in version 3.4.17.
CVE-2026-116801 is a vulnerability in parse-community's parse-server affecting versions before 8.6.105 and 9.10.5-alpha.6. It involves improper validation of the owning object reference in $relatedTo relation queries, allowing a client with read access to some objects to infer linked objects it cannot read by bypassing owning-object ACL checks.
CVE-2026-116800 is a local file inclusion vulnerability in WWBN AVideo versions before 29.5.0. It allows unauthenticated attackers to include and execute PHP files outside the intended locale directory by exploiting a path traversal flaw in the Accept-Language header processing. The vulnerability arises from insufficient sanitization of traversal sequences, enabling bypass of single-pass removal in the setLanguage() function. This flaw is fixed in version 29.5.0.
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVE-2026-106282 is a vulnerability in Chromium's WebOTP feature involving UI misrepresentation. Affected versions are those before and including 155.0.4283.48. The issue has been fixed in version 155.0.4283.48.
Fireblocks' mpc-lib library has a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation when the private parent key is missing. This flaw breaks the ancestor isolation property, allowing an attacker with a compromised lower-level signer share and knowledge of the chain code to recover higher-level shares up to the root share. The primary MPC secret-sharing layer still prevents full private key reconstruction from a single share compromise, but the hardened derivation no longer provides defense-in-depth isolation between derivation levels. No vendor fix is currently available, and mitigation involves keeping the chain code secret and auditing derivation paths.
CVE-2026-116556 is a cross-site scripting (XSS) vulnerability in Argilla versions 2.0 through 2.8.0. It arises from improper handling of the 'text' argument in a frontend Vue component, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity score of 4.8 and public exploit code is available. The Argilla project has been notified but has not yet issued a response or patch.
CVE-2026-116555 is a cross-site scripting (XSS) vulnerability in Argilla up to version 2.8.0. It arises from improper handling of the 'template' argument in a component file within the frontend codebase. The vulnerability allows remote attackers to inject malicious scripts. Public exploit code has been disclosed, but no official response or patch has been issued by the project as of the publication date.
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined.
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from_disk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-116515 is a SQL injection vulnerability in itsourcecode Online Book Store version 1.0. The flaw exists in the /book.php file where the bookisbn parameter can be manipulated to execute unauthorized SQL commands. This vulnerability can be exploited remotely without user interaction. Public exploit code has been disclosed. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
CVE-2026-116591 is a high-severity integer overflow vulnerability in the klauspost compress library prior to version 1.20.2. It affects the zstd DecodeAll and streaming decoder paths, where crafted input can cause a panic due to an integer wraparound in the huff0.ReadTable function. This leads to reuse of stale decode-table state and out-of-range indexing, resulting in application crashes. The issue is fixed in version 1.20.2.
Transmission versions 4.0.0 through 4.1.2 have a permissive Cross-Origin Resource Sharing (CORS) vulnerability in the handle_request() function of rpc-server.cc. This flaw exposes the X-Transmission-Session-Id anti-CSRF token to any web origin, allowing malicious web pages to read and reuse the token to perform unauthorized RPC calls. Exploitation can lead to script-torrent-done execution, changes to the download directory, or deletion of torrents and data. The vulnerability is fixed in version 4.1.3.
Kener versions 3.0.0 up to but not including 4.1.10 contain a critical authentication bypass vulnerability due to the use of a hard-coded cryptographic key fallback. If the environment variable KENER_SECRET_KEY is empty or unset, attackers who know an administrator's email can forge session tokens and gain full administrative access or create password-reset tokens. This flaw is fixed in version 4.1.10.