CVE-2026-114213 is a high-severity resource exhaustion vulnerability in mtrudel bandit's WebSocket fragment reassembly. An unauthenticated remote attacker can send many 1-byte fragmented continuation frames to exhaust server memory. The vulnerability arises because the server keeps each non-final continuation frame as a separate list cell without limiting the number of fragments, causing disproportionate memory use. This affects bandit versions from 1.11.0 up to but not including 1.14.0. The issue is fixed in version 1.14.0.
CVE-2026-114216 is an HTTP Request/Response Smuggling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit. It allows an unauthenticated remote attacker to smuggle a second HTTP request past a front-end proxy by exploiting how chunk extensions with bare LF characters are handled. This affects bandit versions from 1.12.4 up to but not including 1.14.0. The issue arises because the chunked reader improperly parses chunk-size lines, allowing control characters that some proxies interpret differently, leading to request smuggling. Deployments without a proxy in front of bandit are not affected. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity). A fix is available in version 1.14.0.
CVE-2026-115269 is a high-severity vulnerability in mtrudel bandit's HTTP/2 request body reader that allows an unauthenticated remote attacker to cause an infinite loop by sending WINDOW_UPDATE or empty SETTINGS frames. This keeps stream processes open indefinitely, potentially exhausting resources. The issue affects bandit versions from 1.4.0 up to but not including 1.14.0. A fix is available in version 1.14.0.
The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution on PHP servers. After PHP released patches on October 21, 2026, attackers successfully exploited these flaws against honeypots on October 24, launching 35 shells from two IP addresses. The exploitation involved a four-stage HTTP request chain causing memory exhaustion, memory leaks, and ultimately shell command execution. This confirms real-world remote code execution beyond prior crash-only observations. The exploit closely matches a public proof-of-concept and bypasses ASLR protections. While confirmed on a specific PHP configuration, broader exploit reliability remains unmeasured. As of October 26, CISA had not observed confirmed exploitation in the wild or added these vulnerabilities to its KEV catalog.
CVE-2026-108525 is a high-severity vulnerability in the HTTP/2 implementation of mtrudel bandit versions from 0.3.1 up to but not including 1.14.0. It allows an unauthenticated remote attacker to exhaust server memory by sending DATA frames beyond the advertised receive window and withholding WINDOW_UPDATE frames. This causes the stream process to block and queue frames until the server's BEAM node runs out of memory, leading to a denial of service.
Kameleo versions 5.3.0 and 5.3.1 contain an information disclosure vulnerability in the CookieController.ListCookies function. This flaw arises from improper handling of the 'guid' argument, allowing remote attackers to access sensitive information. The vendor has not responded to disclosure attempts, and no patch or fix is currently available. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-59106 is a critical OS command injection vulnerability in the WolfProt interface of WolfVision Cynap Pure (Next Gen) and Cynap Bridge devices. An unauthenticated attacker with network access can exploit insufficient input neutralization to execute arbitrary operating system commands with the privileges of the affected application service. The vulnerability affects versions prior to 2.00c for Cynap Pure (Next Gen) and prior to 1.78a and 1.72e for Cynap Bridge. Fixed versions are available.
NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain a heap-based buffer overflow vulnerability in the host audio, video, and CDC class drivers. This flaw arises because the drivers trust device-supplied bNumEndpoints and bLength values, allowing a malicious USB device to supply crafted descriptors that overflow the fixed-size epList array. This can lead to heap memory corruption, potentially enabling code execution or denial of service.
NXP MCUXpresso SDK USB middleware versions prior to 2.13.0 contain an out-of-bounds read vulnerability in the USB_DeviceCdcRndisSetCommand() function. This flaw arises from trusting a host-supplied informationBufferOffset, allowing a malicious USB host to send crafted RNDIS SET messages with out-of-range offsets. Exploitation can lead to disclosure of device memory. The issue is fixed in version 2.13.0.
Objenesis versions before 3.6 have a type confusion vulnerability due to instantiator caching keyed on class name, which causes collisions when classes share the same name across different class loaders. This can result in newInstance() returning objects of the wrong class and ClassCastException errors.
danmu_api versions before 1.21.7 have an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configurations if the default TOKEN is used and ADMIN_TOKEN is unset. This enables attackers to set ADMIN_TOKEN, lock out legitimate operators, redirect server URLs potentially causing SSRF, and trigger redeployment.
Dolibarr ERP CRM versions before 24.0.0 have an OS command injection vulnerability in the htdocs/admin/tools/export.php script. This flaw allows authenticated administrators to bypass the restrict_os_commands allowlist by submitting specially crafted mysqldump values that chain commands using & characters. Successful exploitation enables execution of arbitrary operating system commands with the web server user's privileges. The vulnerability is fixed in version 24.0.0.
Dolibarr ERP CRM versions 19.0.0 up to but not including 23.0.4 contain an SQL injection vulnerability in the third-party bankaccounts REST endpoint. Authenticated API users with societe/creer permission can exploit this flaw by injecting SQL via the type field, potentially reading sensitive data such as password hashes and API keys through time-based blind subqueries. The vulnerability is fixed in version 23.0.4.
RosarioSIS versions before 12.9.2 have a reflected cross-site scripting (XSS) vulnerability in the MenuReports.php module. This flaw allows unauthenticated attackers to inject malicious attributes via the menu_id and modname parameters. By tricking a logged-in administrator into clicking a crafted link, attackers can execute JavaScript that steals session and CSRF tokens, enabling them to act with the administrator's privileges.
MacCMS v10 through version 2026.1000.4056 has a mass assignment vulnerability in the index/Comment::saveData() function. This flaw allows unauthenticated attackers to manipulate arbitrary mac_comment database columns, including user_id. By exploiting this, attackers can post anonymous comments that appear attributed to any registered user, showing that user's avatar and impersonating them.
MacCMS versions up to 2026.1000.4056 have a race condition vulnerability in the Card::useData() function. Authenticated users can exploit this flaw by sending concurrent requests to redeem a recharge card multiple times before it is marked as used. This allows inflation of user points, enabling unauthorized purchases of VIP upgrades and paid content. The vulnerability has a low CVSS score of 2.3 and does not have known exploits in the wild.
MacCMS v10 versions before 2026.1000.4054 have an authentication bypass vulnerability in the password recovery mechanism. The function check_msg() does not properly verify the recipient of the recovery code, allowing attackers to reset any user's password by submitting a recovery code sent to their own mailbox but associating it with the victim's email or phone number. This flaw enables account takeover without authentication.
CVE-2026-116213 is an arbitrary file read vulnerability in Webasyst Framework versions up to 4.4.0. It arises from improper validation of symbolic link targets when authenticated users with theme management rights upload themes containing symlinks. This flaw allows reading sensitive files such as wa-config/db.php or /etc/passwd via the public theme path.
CVE-2026-116212 is a stored cross-site scripting (XSS) vulnerability in the Webasyst Framework up to version 4.4.0, specifically in the Photos app. Authenticated backend users with album edit rights can inject malicious JavaScript via the album url parameter, which is not properly escaped in the DialogAlbumSettings.html file. This allows execution of arbitrary JavaScript in administrator backend sessions.
CVE-2026-116210 is a cross-site request forgery (CSRF) vulnerability in the Webasyst Framework's Photos app up to version 4.4.0. The vulnerability arises because the Photos app does not enable the framework's opt-in CSRF protection, allowing attackers to trick logged-in users into submitting forged POST requests. These requests can delete photos or modify access rights without user consent.