A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined.
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from_disk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-116515 is a SQL injection vulnerability in itsourcecode Online Book Store version 1.0. The flaw exists in the /book.php file where the bookisbn parameter can be manipulated to execute unauthorized SQL commands. This vulnerability can be exploited remotely without user interaction. Public exploit code has been disclosed. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
CVE-2026-116591 is a high-severity integer overflow vulnerability in the klauspost compress library prior to version 1.20.2. It affects the zstd DecodeAll and streaming decoder paths, where crafted input can cause a panic due to an integer wraparound in the huff0.ReadTable function. This leads to reuse of stale decode-table state and out-of-range indexing, resulting in application crashes. The issue is fixed in version 1.20.2.
Transmission versions 4.0.0 through 4.1.2 have a permissive Cross-Origin Resource Sharing (CORS) vulnerability in the handle_request() function of rpc-server.cc. This flaw exposes the X-Transmission-Session-Id anti-CSRF token to any web origin, allowing malicious web pages to read and reuse the token to perform unauthorized RPC calls. Exploitation can lead to script-torrent-done execution, changes to the download directory, or deletion of torrents and data. The vulnerability is fixed in version 4.1.3.
Kener versions 3.0.0 up to but not including 4.1.10 contain a critical authentication bypass vulnerability due to the use of a hard-coded cryptographic key fallback. If the environment variable KENER_SECRET_KEY is empty or unset, attackers who know an administrator's email can forge session tokens and gain full administrative access or create password-reset tokens. This flaw is fixed in version 4.1.10.
QloApps versions 1.6.0 through 1.7.0 have an authorization bypass vulnerability in the qlohotelreview module's AddReview AJAX action. This flaw allows unauthenticated attackers to submit fake reviews for arbitrary orders by exploiting a publicly exposed review_ajax_token and enumerating order IDs. The vulnerability enables attackers to impersonate other customers by posting unauthorized ratings and reviews.
QloApps versions up to 1.7.0 have an authorization bypass vulnerability in the OrderConfirmationController::init() function. This flaw allows unauthenticated attackers to sequentially guess guest id_cart values to obtain guest order references and emails. Attackers can read redirect headers, view booking details, and convert guest accounts into full accounts with attacker-chosen passwords.
ntop nDPI versions up to 6.0 contain an out-of-bounds read vulnerability in the dissect_softether_host_fqdn() function. This flaw arises because the function compares host_name using the consumed byte count instead of the actual data length. An attacker can exploit this by sending crafted short UDP datagrams on already-classified SoftEther flows, causing the strncmp function to read beyond the packet payload buffer.
CVE-2026-116743 is a double free vulnerability in libyal's libmsiecf library, specifically in the function libmsiecf_url_values_read_data(). This flaw allows attackers to corrupt heap memory by supplying a crafted MSIE cache index.dat file with a partial record containing an oversized unknown_offset. The vulnerability can cause forensic tools processing such files to crash. The CVSS 4.0 base score is 6.8, indicating a medium severity level.
HTSlib versions up to 1.24 contain a heap out-of-bounds read and write vulnerability in the function bgzf_index_load_hfile() due to improper handling of a crafted .gzi index entry count. This numeric truncation error can cause heap corruption or crashes in tools such as samtools and bcftools.
Speex (libspeex) versions up to 1.2.1 contain an out-of-bounds write vulnerability in the speex_bits_read_whole_bytes() function. This flaw occurs due to improper handling of length truncation for non-owned SpeexBits buffers, allowing attackers to stream crafted Speex data to corrupt memory and potentially crash applications.
A NULL pointer dereference vulnerability exists in libcss up to version 0.9.2 within the netsurf-browser project. This flaw occurs in the mq_parse_media_query() function when processing media lists that end with a trailing comma. An attacker can exploit this by serving a stylesheet with an @media or @import media list ending in a comma, causing the parser to crash.
VMime versions up to 0.9.2 have an information disclosure vulnerability in the uuEncoder::decode function. This flaw causes uninitialized stack memory to be written into decoded output when processing over-long lines in uuencoded MIME parts. An attacker can exploit this by sending crafted uuencode or x-uuencode MIME parts with large line length bytes, potentially leaking up to 15 bytes of stack memory per line in decoded attachments.
VMime versions up to 0.9.2 contain a stack-based buffer overflow vulnerability in the uuEncoder::decode function. This flaw arises from an integer underflow triggered by crafted uuencoded MIME parts in emails. An attacker can send a specially crafted email with a uuencoded line whose length character is 'b' but is not a 'begin' line, leading to stack memory corruption. This can cause the application to crash or potentially allow remote code execution.
CVE-2026-116737 is a heap out-of-bounds read vulnerability in libphdi, a component of libyal. The flaw occurs in the function libphdi_data_files_get_extent_data_file_path, which incorrectly calculates buffer size by using the directory prefix length instead of the basename length. This can be triggered by a crafted Parallels disk image descriptor with a long directory prefix and a short basename, potentially causing a process crash or exposure of adjacent heap memory.
CVE-2026-116736 is a heap out-of-bounds read vulnerability in libpff up to version 20260926. The flaw occurs in the libpff_table_read_values_array function due to improper validation of a 7c column definition's values_array_size against the remaining buffer bytes. An attacker can exploit this by supplying a crafted PST, OST, or PAB file, causing applications to read adjacent heap memory or crash.
CVE-2026-116735 is an off-by-one bounds check vulnerability in libpff through version 20260926. It occurs in the function libpff_table_read_6c_record_entries and allows attackers to trigger a heap out-of-bounds read by supplying crafted PST, OST, or PAB files. This can lead to reading adjacent heap memory or application crashes in tools like pffexport or pypff.
flatcc versions up to 0.6.4 have an integer overflow vulnerability in the check_header function of the FlatBuffers verifier. On 32-bit builds, this flaw allows crafted buffer offsets to bypass bounds checks, leading to out-of-bounds reads before the buffer and potential process crashes.