CVE-2026-116577 is a vulnerability in the Tornado Python web framework prior to version 6.6. The HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, leading to quadratic CPU consumption on the IOLoop thread. An unauthenticated client can exploit this by submitting a header block with many line-folding continuations, causing denial of service by blocking other connections. This affects availability only and is fixed in Tornado version 6.6.
CVE-2026-116576 is an OS command injection vulnerability in the systeminformation Node.js library prior to version 5.33.16. The issue arises from improper sanitization of service names used in PowerShell commands on Windows, allowing an attacker to inject arbitrary PowerShell expressions. Exploitation requires local or forwarded attacker-controlled input to the vulnerable services() or getDynamicData() functions. The vulnerability is fixed in version 5.33.16.
CVE-2026-116502 is an out-of-bounds write vulnerability in the turboderp-org ExLlamaV2 software versions 0.3.0, 0.3.1, and 0.3.2. The flaw exists in the QMatrix::make_sequential function within the GPTQ Index Handler component. It can be triggered by manipulating the g_idx argument locally, potentially leading to memory corruption. No patch or vendor response has been reported yet.
CVE-2026-116575 is a vulnerability in mem0, a persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, the session scope key generation improperly concatenates user-controlled identifiers without escaping delimiters, allowing cross-tenant session key collisions. This flaw enables unauthorized access to other tenants' conversation histories, leading to exposure and potential interleaving of sensitive information. The issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.
CVE-2026-116671 is a low-severity vulnerability in Xpdf version 4.06 and earlier. It involves an infinite loop caused by improper input validation of the progression order field in JPEG 2000 images. This flaw can cause the application to hang when processing specially crafted images.
CVE-2026-116482 is a cross-site scripting (XSS) vulnerability in the subhajitkhan online-clinic-management-system affecting the patientregistration.php file. The flaw arises from improper sanitization of the pat_name argument, allowing remote attackers to inject malicious scripts. The vulnerability has been publicly disclosed, and exploit code may be available. The product does not use versioning, so specific affected or fixed versions are not identified.
CVE-2026-70382 is a cross-site scripting (XSS) vulnerability affecting multiple WolfVision Cynap devices. The issue arises because some externally supplied values stored by the device are rendered in the web interface without proper output encoding. An attacker who can influence these stored values may cause script execution in the browser of users who view the affected pages. Exploitation requires both the ability to influence stored values and a user viewing the vulnerable page. The vulnerability has a medium severity rating with a CVSS score of 5.1.
CVE-2026-65630 is a timing side-channel vulnerability in the potatosalad jose library's pure-Erlang X25519 implementation. The vulnerability allows an attacker to recover a long-term X25519 private key by measuring decryption timing variations during scalar multiplication. This affects versions from 1.10.0 up to but not including 1.11.13. The issue is fixed in version 1.11.13.
The jose library versions from 1.0.0 up to but not including 1.11.13 improperly verify ECDSA JWS signatures by accepting signatures of non-canonical length. This signature malleability allows multiple distinct signature byte strings to verify as valid for the same token, defeating security controls that rely on signature uniqueness such as token revocation by hash, replay caches, and deduplication. The underlying cryptographic signature values (r, s) remain unchanged, so forging new payloads or impersonating signers is not possible. A fix is available in version 1.11.13.
CVE-2026-65631 is an inefficient algorithmic complexity vulnerability in the potatosalad jose library versions from 1.7.7 up to but not including 1.11.13. It allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key that triggers expensive factoring operations. The issue is fixed in version 1.11.13.
CVE-2026-65629 is a vulnerability in the potatosalad jose library versions from 1.10.0 up to but not including 1.11.13. It involves the use of a password hash with insufficient computational effort during the export of password-encrypted private keys. The key derivation uses PBKDF2-HMAC-SHA256 with only 2048 iterations and a 64-bit salt, both far below current security recommendations. This weakness allows an attacker who obtains an exported encrypted private key to perform an offline password-cracking attack to recover the private key.
CVE-2026-65628 is a vulnerability in the potatosalad jose library versions 1.5.0 up to but not including 1.11.13. It involves uncontrolled recursion in the function jose_jwk:shared_secret/2 when deriving an ECDH shared secret from two JSON Web Keys (JWKs) of differing key types. An attacker can supply a crafted JWK with a mismatched key type to cause an infinite tail-recursive loop, resulting in 100% CPU usage on an Erlang scheduler and potential denial of service due to resource exhaustion.
CVE-2026-65627 is a vulnerability in potatosalad jose (erlang-jose) versions from 1.0.0 up to but not including 1.11.13. It involves improper handling of highly compressed data during decompression of JWE tokens, allowing a remote attacker to exhaust node memory by sending a crafted small JWE token. The decompression function does not limit output size, enabling data amplification that can crash the BEAM virtual machine and cause denial of service.
CVE-2026-57184 is an out-of-bounds read vulnerability in the Asterisk telephony toolkit's chan_ooh323 addon channel driver. This flaw exists in the Q.931 information-element parser due to insufficient bounds checking. An unauthenticated attacker can exploit this by sending crafted setup packets to cause a crash. The vulnerability affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. The chan_ooh323 driver is not enabled by default and requires explicit compilation and a publicly reachable port. Fixes are available in the stated versions.
CVE-2026-65626 is a Bleichenbacher padding oracle vulnerability in the pure-Erlang RSAES-PKCS1-v1_5 decryption implementation of the jose_jwa_pkcs1 module in potatosalad jose. The vulnerability arises because the decryption function returns distinct error messages depending on padding validity and does not implement countermeasures to mask these differences. An attacker with access to the public RSA key and the ability to submit ciphertexts to a decryption endpoint can exploit this to recover plaintext or forge signatures through adaptive chosen-ciphertext attacks. This affects versions from 1.3.0 up to but not including 1.11.13. The issue is fixed in version 1.11.13.
CVE-2026-65625 is a vulnerability in the potatosalad jose library affecting versions from 1.2.0 up to but not including 1.11.13. The issue arises in the pure-Erlang AES-GCM fallback implementation where the authentication tag length is derived from attacker-supplied data without proper validation. This allows an attacker controlling a JWE token to truncate the authentication tag to as little as 8 bits, drastically reducing forgery resistance and enabling reliable forgery within 256 attempts. Supplying an overly long tag causes a crash. The vulnerability is fixed in version 1.11.13.
CVE-2026-70381 is an authentication bypass vulnerability in the web server configuration of WolfVision Cynap series devices. It allows unauthenticated remote attackers with network access to the web interface to access certain on-device resources intended only for local use. These accessible resources do not include credentials or administrative functions but may expose non-public device content such as screen-saver files or web interface assets. The vulnerability affects multiple Cynap product variants prior to fixed versions.
CVE-2026-57193 is a vulnerability in the Asterisk telephony toolkit's LDAP realtime driver (res_config_ldap) that allows LDAP filter injection via a crafted SIP username. This can enable an unauthenticated attacker to perform arbitrary LDAP queries and potentially disclose information. The vulnerability affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. The res_config_ldap module must be enabled and configured to access an LDAP server for the issue to be exploitable. Fixed versions are available.
CVE-2026-70380 is a denial-of-service vulnerability in the Miracast over Infrastructure Connection Establishment (MICE) service of WolfVision Cynap devices. An unauthenticated attacker with network access to MICE can exhaust connection capacity, blocking legitimate Miracast connections. Miracast P2P is unaffected, and MICE is disabled by default, requiring explicit customer enablement. Some devices may experience complete Miracast disruption when WLAN is in Infrastructure mode. Fixed versions are 1.78a, 2.00d, and 1.72e.
CVE-2026-116479 is a vulnerability in a2aproject a2a-java up to version 1.2.0.Final affecting the JSON-RPC Error Handler's getMessage function. This flaw allows remote attackers to cause information exposure through error messages. The issue is resolved by upgrading to version 1.3.0.Final.