Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body.
Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes.
This issue affects bandit: from 1.4.0 before 1.14.0.
The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution on PHP servers. After PHP released patches on October 21, 2026, attackers successfully exploited these flaws against honeypots on October 24, launching 35 shells from two IP addresses. The exploitation involved a four-stage HTTP request chain causing memory exhaustion, memory leaks, and ultimately shell command execution. This confirms real-world remote code execution beyond prior crash-only observations. The exploit closely matches a public proof-of-concept and bypasses ASLR protections. While confirmed on a specific PHP configuration, broader exploit reliability remains unmeasured. As of October 26, CISA had not observed confirmed exploitation in the wild or added these vulnerabilities to its KEV catalog.
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory.
Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.
This issue affects bandit: from 0.3.1 before 1.14.0.
Kameleo versions 5.3.0 and 5.3.1 contain an information disclosure vulnerability in the CookieController.ListCookies function. This flaw arises from improper handling of the 'guid' argument, allowing remote attackers to access sensitive information. The vendor has not responded to disclosure attempts, and no patch or fix is currently available. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-59106 is a critical OS command injection vulnerability in the WolfProt interface of WolfVision Cynap Pure (Next Gen) and Cynap Bridge devices. An unauthenticated attacker with network access can exploit insufficient input neutralization to execute arbitrary operating system commands with the privileges of the affected application service. The vulnerability affects versions prior to 2.00c for Cynap Pure (Next Gen) and prior to 1.78a and 1.72e for Cynap Bridge. Fixed versions are available.
NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain a heap-based buffer overflow vulnerability in the host audio, video, and CDC class drivers. This flaw arises because the drivers trust device-supplied bNumEndpoints and bLength values, allowing a malicious USB device to supply crafted descriptors that overflow the fixed-size epList array. This can lead to heap memory corruption, potentially enabling code execution or denial of service.
NXP MCUXpresso SDK USB middleware versions prior to 2.13.0 contain an out-of-bounds read vulnerability in the USB_DeviceCdcRndisSetCommand() function. This flaw arises from trusting a host-supplied informationBufferOffset, allowing a malicious USB host to send crafted RNDIS SET messages with out-of-range offsets. Exploitation can lead to disclosure of device memory. The issue is fixed in version 2.13.0.
Objenesis versions before 3.6 have a type confusion vulnerability due to instantiator caching keyed on class name, which causes collisions when classes share the same name across different class loaders. This can result in newInstance() returning objects of the wrong class and ClassCastException errors.
danmu_api versions before 1.21.7 have an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configurations if the default TOKEN is used and ADMIN_TOKEN is unset. This enables attackers to set ADMIN_TOKEN, lock out legitimate operators, redirect server URLs potentially causing SSRF, and trigger redeployment.
Dolibarr ERP CRM versions before 24.0.0 have an OS command injection vulnerability in the htdocs/admin/tools/export.php script. This flaw allows authenticated administrators to bypass the restrict_os_commands allowlist by submitting specially crafted mysqldump values that chain commands using & characters. Successful exploitation enables execution of arbitrary operating system commands with the web server user's privileges. The vulnerability is fixed in version 24.0.0.
Dolibarr ERP CRM versions 19.0.0 up to but not including 23.0.4 contain an SQL injection vulnerability in the third-party bankaccounts REST endpoint. Authenticated API users with societe/creer permission can exploit this flaw by injecting SQL via the type field, potentially reading sensitive data such as password hashes and API keys through time-based blind subqueries. The vulnerability is fixed in version 23.0.4.
RosarioSIS versions before 12.9.2 have a reflected cross-site scripting (XSS) vulnerability in the MenuReports.php module. This flaw allows unauthenticated attackers to inject malicious attributes via the menu_id and modname parameters. By tricking a logged-in administrator into clicking a crafted link, attackers can execute JavaScript that steals session and CSRF tokens, enabling them to act with the administrator's privileges.
MacCMS v10 through version 2026.1000.4056 has a mass assignment vulnerability in the index/Comment::saveData() function. This flaw allows unauthenticated attackers to manipulate arbitrary mac_comment database columns, including user_id. By exploiting this, attackers can post anonymous comments that appear attributed to any registered user, showing that user's avatar and impersonating them.
MacCMS versions up to 2026.1000.4056 have a race condition vulnerability in the Card::useData() function. Authenticated users can exploit this flaw by sending concurrent requests to redeem a recharge card multiple times before it is marked as used. This allows inflation of user points, enabling unauthorized purchases of VIP upgrades and paid content. The vulnerability has a low CVSS score of 2.3 and does not have known exploits in the wild.
MacCMS v10 versions before 2026.1000.4054 have an authentication bypass vulnerability in the password recovery mechanism. The function check_msg() does not properly verify the recipient of the recovery code, allowing attackers to reset any user's password by submitting a recovery code sent to their own mailbox but associating it with the victim's email or phone number. This flaw enables account takeover without authentication.
CVE-2026-116213 is an arbitrary file read vulnerability in Webasyst Framework versions up to 4.4.0. It arises from improper validation of symbolic link targets when authenticated users with theme management rights upload themes containing symlinks. This flaw allows reading sensitive files such as wa-config/db.php or /etc/passwd via the public theme path.
CVE-2026-116212 is a stored cross-site scripting (XSS) vulnerability in the Webasyst Framework up to version 4.4.0, specifically in the Photos app. Authenticated backend users with album edit rights can inject malicious JavaScript via the album url parameter, which is not properly escaped in the DialogAlbumSettings.html file. This allows execution of arbitrary JavaScript in administrator backend sessions.
Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.
CVE-2026-116281 is an information disclosure vulnerability in Kameleo versions 5.0.1.0 through 5.0.1.19 affecting the ListProfiles function in the Profile Controller component. The vulnerability allows local attackers to access sensitive information. This issue is resolved by upgrading to version 5.2.0.