CVE-2026-116801 is a vulnerability in parse-community's parse-server affecting versions before 8.6.105 and 9.10.5-alpha.6. It involves improper validation of the owning object reference in $relatedTo relation queries, allowing a client with read access to some objects to infer linked objects it cannot read by bypassing owning-object ACL checks.
CVE-2026-116800 is a local file inclusion vulnerability in WWBN AVideo versions before 29.5.0. It allows unauthenticated attackers to include and execute PHP files outside the intended locale directory by exploiting a path traversal flaw in the Accept-Language header processing. The vulnerability arises from insufficient sanitization of traversal sequences, enabling bypass of single-pass removal in the setLanguage() function. This flaw is fixed in version 29.5.0.
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVE-2026-106282 is a vulnerability in Chromium's WebOTP feature involving UI misrepresentation. Affected versions are those before and including 155.0.4283.48. The issue has been fixed in version 155.0.4283.48.
Fireblocks' mpc-lib library has a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation when the private parent key is missing. This flaw breaks the ancestor isolation property, allowing an attacker with a compromised lower-level signer share and knowledge of the chain code to recover higher-level shares up to the root share. The primary MPC secret-sharing layer still prevents full private key reconstruction from a single share compromise, but the hardened derivation no longer provides defense-in-depth isolation between derivation levels. No vendor fix is currently available, and mitigation involves keeping the chain code secret and auditing derivation paths.
CVE-2026-116556 is a cross-site scripting (XSS) vulnerability in Argilla versions 2.0 through 2.8.0. It arises from improper handling of the 'text' argument in a frontend Vue component, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity score of 4.8 and public exploit code is available. The Argilla project has been notified but has not yet issued a response or patch.
CVE-2026-116555 is a cross-site scripting (XSS) vulnerability in Argilla up to version 2.8.0. It arises from improper handling of the 'template' argument in a component file within the frontend codebase. The vulnerability allows remote attackers to inject malicious scripts. Public exploit code has been disclosed, but no official response or patch has been issued by the project as of the publication date.
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined.
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from_disk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-116515 is a SQL injection vulnerability in itsourcecode Online Book Store version 1.0. The flaw exists in the /book.php file where the bookisbn parameter can be manipulated to execute unauthorized SQL commands. This vulnerability can be exploited remotely without user interaction. Public exploit code has been disclosed. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
CVE-2026-116591 is a high-severity integer overflow vulnerability in the klauspost compress library prior to version 1.20.2. It affects the zstd DecodeAll and streaming decoder paths, where crafted input can cause a panic due to an integer wraparound in the huff0.ReadTable function. This leads to reuse of stale decode-table state and out-of-range indexing, resulting in application crashes. The issue is fixed in version 1.20.2.
Transmission versions 4.0.0 through 4.1.2 have a permissive Cross-Origin Resource Sharing (CORS) vulnerability in the handle_request() function of rpc-server.cc. This flaw exposes the X-Transmission-Session-Id anti-CSRF token to any web origin, allowing malicious web pages to read and reuse the token to perform unauthorized RPC calls. Exploitation can lead to script-torrent-done execution, changes to the download directory, or deletion of torrents and data. The vulnerability is fixed in version 4.1.3.
Kener versions 3.0.0 up to but not including 4.1.10 contain a critical authentication bypass vulnerability due to the use of a hard-coded cryptographic key fallback. If the environment variable KENER_SECRET_KEY is empty or unset, attackers who know an administrator's email can forge session tokens and gain full administrative access or create password-reset tokens. This flaw is fixed in version 4.1.10.
QloApps versions 1.6.0 through 1.7.0 have an authorization bypass vulnerability in the qlohotelreview module's AddReview AJAX action. This flaw allows unauthenticated attackers to submit fake reviews for arbitrary orders by exploiting a publicly exposed review_ajax_token and enumerating order IDs. The vulnerability enables attackers to impersonate other customers by posting unauthorized ratings and reviews.
QloApps versions up to 1.7.0 have an authorization bypass vulnerability in the OrderConfirmationController::init() function. This flaw allows unauthenticated attackers to sequentially guess guest id_cart values to obtain guest order references and emails. Attackers can read redirect headers, view booking details, and convert guest accounts into full accounts with attacker-chosen passwords.
ntop nDPI versions up to 6.0 contain an out-of-bounds read vulnerability in the dissect_softether_host_fqdn() function. This flaw arises because the function compares host_name using the consumed byte count instead of the actual data length. An attacker can exploit this by sending crafted short UDP datagrams on already-classified SoftEther flows, causing the strncmp function to read beyond the packet payload buffer.
CVE-2026-116743 is a double free vulnerability in libyal's libmsiecf library, specifically in the function libmsiecf_url_values_read_data(). This flaw allows attackers to corrupt heap memory by supplying a crafted MSIE cache index.dat file with a partial record containing an oversized unknown_offset. The vulnerability can cause forensic tools processing such files to crash. The CVSS 4.0 base score is 6.8, indicating a medium severity level.
HTSlib versions up to 1.24 contain a heap out-of-bounds read and write vulnerability in the function bgzf_index_load_hfile() due to improper handling of a crafted .gzi index entry count. This numeric truncation error can cause heap corruption or crashes in tools such as samtools and bcftools.
Speex (libspeex) versions up to 1.2.1 contain an out-of-bounds write vulnerability in the speex_bits_read_whole_bytes() function. This flaw occurs due to improper handling of length truncation for non-owned SpeexBits buffers, allowing attackers to stream crafted Speex data to corrupt memory and potentially crash applications.