CVE-2026-129255 is a critical vulnerability in CoolerMaster MASTERPLUS+ version 1.9.6 involving incorrect default permissions in the WinRing0x64.sys device driver component. The flaw arises from improper handling of the PhysicalAddress argument in the sub_11504 function, allowing local attackers to exploit permission issues. The vendor has not responded to disclosure attempts, and no patch or fix information is currently available.
A malicious file identified by the SHA-256 hash ae0e7b77c1e3861661e63f0c615b842232851b8021f24eefd63ce9f88023012d was observed by OffSeq Mirage honeypot sensors on 2026-11-14. This file is associated with CVE-2026-109618 and was detected four times during attacker activity on that date. The observed attack technique is T1105 (Ingress Tool Transfer), indicating the file was likely used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the Netherlands. There is no information on affected software versions or confirmed exploitation in the wild.
CVE-2026-129254 is a medium severity cross-site scripting (XSS) vulnerability in Opixido OCMS affecting an unknown function in admin/TUI/index.php. The vulnerability arises from manipulation of the 'img' argument, allowing remote attackers to execute script code. The product uses continuous delivery with rolling releases, so no specific affected or fixed versions are identified. The vendor did not respond to disclosure attempts, and no patch information is available. Exploit code has been published but no confirmed exploitation in the wild is reported.
CVE-2026-129115 is a use-after-free vulnerability in JSON::XS for Perl versions 3.0 up to but not including 4.05. The flaw occurs when encoding objects with allow_tags enabled, where the FREEZE method's serialization can cause the Perl stack to grow and reallocate, leaving saved pointers referencing freed memory. This can lead to reading freed stack memory and potentially returning undefined values without error during encoding.
JSON::XS versions from 3.04 up to but not including 4.05 for Perl contain an off-by-one error in the incr_parse function. This flaw causes the software to write one byte past the end of a heap buffer when appending a one-byte chunk during incremental parsing. The issue arises because the incremental buffer grows to one and a half times the required length without reserving space for the terminating NUL byte, leading to a heap out-of-bounds write under certain input conditions. The vulnerability is fixed in version 4.05.
CVE-2026-129113 is an integer underflow vulnerability in JSON::XS for Perl versions from 4.0_00 before 4.05. The flaw occurs in the incremental parser's buffer length management when parsing top-level numbers, leading to buffer corruption and potential process termination due to an out-of-memory error.
CVE-2026-124541 is a memory leak vulnerability in JSON::XS for Perl versions before 4.05. The flaw occurs in the decode_str function, where decoded parts of rejected long strings are not freed properly. This leads to retained memory from each rejected string, potentially exhausting process memory over time.
CVE-2026-124540 is a vulnerability in JSON::XS for Perl before version 4.05 that allows stack exhaustion via uncontrolled recursion when decoding nested tagged values with allow_tags enabled. This leads to an uncatchable segmentation fault caused by C stack exhaustion regardless of the max_depth setting.
CVE-2026-124539 is a memory leak vulnerability in JSON::XS for Perl versions before 4.05. The flaw occurs when decoding an object with a missing colon after a key, causing the decoded key scalar to not be freed. This results in a memory leak where each rejected document retains one key in memory, potentially exhausting process memory over time.
CVE-2026-124536 is a vulnerability in JSON::XS for Perl versions before 4.05 that allows memory exhaustion. The flaw arises because the incremental parser buffers input beyond the configured max_size limit when a NUL byte is present, leading to unbounded memory growth. This can cause the process to exhaust available memory when processing crafted input streams.
CVE-2026-129251 is a cross-site scripting (XSS) vulnerability in hrshadhin CloudSchool versions 3.0.0 and 3.0.1. The flaw exists in the Event Description Handler component within the file app/Http/Controllers/Backend/EventController.php. An attacker can remotely exploit this vulnerability by manipulating input data, potentially leading to XSS attacks. Public exploit code is available, but there is no vendor response or patch provided as of the publication date.
CVE-2026-129250 is a critical buffer overflow vulnerability in the Edimax BR6478ACV2 router, version 1.23. The flaw exists in the formPPTPSetup function within the webs file, where improper handling of the pptpUserName argument allows remote attackers to trigger a buffer overflow. Public exploit code has been disclosed, but no vendor response or patch is currently available.
CVE-2026-129427 is a stored cross-site scripting (XSS) vulnerability in CervantesSec cervantes version v1.3-beta. It involves an attacker uploading a malicious avatar that exploits an authentication bypass in the /Attachments endpoint, leading to account takeover (ATO) by executing arbitrary code in another user's browser with elevated privileges.
Apple has detailed its Secure Exclaves architecture designed to isolate camera and microphone data used for ambient sensing from the main operating system on devices such as HomeView and new iPhones. This architecture ensures that sensitive sensor data cannot be accessed or altered by the main OS or apps, with only limited metadata shared under strict conditions. Secure Exclaves run on a formally verified microkernel to enhance security and prevent kernel compromise. The design includes user-visible indicators for sensor activity that the main OS cannot interfere with, enhancing privacy and security.
A numeric range comparison vulnerability exists in Akaunting versions 3.0 through 3.3.0 in the function calculation_to_quantity within helpers.php related to Invoice Item Validation. This flaw allows remote attackers to manipulate the quantity argument without a minimum check, potentially leading to incorrect validation outcomes. The vendor has not responded to the disclosure. The CVSS 4.0 score rates this as a medium severity issue.
CVE-2026-129247 is a path traversal vulnerability in yangzongzhuan RuoYi versions 4.8.0 through 4.8.3. The flaw exists in the VelocityUtils.getFileName function within the Code Generator component. An attacker can remotely manipulate the className argument to perform path traversal, potentially accessing unauthorized files.
The PyPI package 'xrfdc' contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.