CVE-2026-116110 is a medium severity vulnerability in GiantappMan LiveWallPaper version 2.6.8.0 for Windows. It involves missing authentication in the SignalR Hub component when processing the /LiveWallpaper/UploadFile endpoint. This flaw allows remote attackers to manipulate the component without authentication. Public exploit code exists. A patch identified by commit b62f878899adbfc2968e3345442f3a3df91b774d is available to address the issue.
CVE-2026-116109 is an OS command injection vulnerability in continuedev Continue version 2.0.0. It affects the MCPManagerSingleton.setConnections function within the MCP Server Transport component. The vulnerability allows remote attackers to execute arbitrary OS commands. Public exploit code has been disclosed. The vendor has not responded or provided a fix.
CVE-2026-116108 is a medium severity vulnerability in openbq-org OpenBB versions 4.7.0, 4.7.1, 4.7.2, and 5.0.0. It involves improper access controls in the Local API Server component, specifically in the file openbb_platform/core/openbb_core/app/model/api_settings.py. The flaw allows remote attackers to exploit the access control weakness without privileges or user interaction. Exploit code has been published, but no vendor response or patch is currently available.
CVE-2026-116107 is a medium severity vulnerability in the Datafeedr Product Sets Plugin for WordPress, affecting versions 1.3.0 through 1.3.19. It involves missing authorization in the AJAX handler function dfrps_ajax_delete_saved_search, allowing remote attackers to perform unauthorized actions. Public exploit code is available. Upgrading to version 1.3.25 resolves the issue.
A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can lead to cleartext transmission of sensitive information. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116104 is a code injection vulnerability in Sony Neural Network Libraries up to version 1.39.0, specifically in the function func_set_nnabla_version_decorate within the NNP Converter component. The flaw allows remote attackers to manipulate the argument function.type, leading to code injection. Exploit code has been publicly released. The affected products are no longer supported by the vendor.
CVE-2026-116103 is a code injection vulnerability in Sony Neural Network Libraries up to version 1.39.0, specifically in the load_param_in_txt function of the Encode Param Command Handler component. This vulnerability allows remote attackers to inject code by manipulating input parameters. Exploit code is publicly available. The affected products are no longer supported by the vendor, and no vendor response or patch has been provided. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
CVE-2026-116102 is an OS command injection vulnerability in QuantGeekDev docker-mcp versions 0.1.0 and 0.2.0. The flaw exists in the _build_windows_command function within docker_executor.py, where improper handling of the project_name argument allows remote attackers to execute arbitrary OS commands. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.3.
CVE-2026-116101 is a medium severity SQL injection vulnerability in itsourcecode Online Cake Ordering System version 1.0. The flaw exists in an unknown function within the /deletetransac.php file, where manipulation of the ID parameter allows an attacker to perform SQL injection remotely. Public exploit code is available for this vulnerability.
CVE-2026-116100 is a cross-site scripting (XSS) vulnerability in gougucms versions 4.08.0 through 4.08.18. It affects the Add function in the app/admin/controller/Level.php file, specifically the User Level Handler component. The vulnerability arises from improper handling of the Title argument, allowing remote attackers to inject malicious scripts. Public exploit code has been disclosed, but the vendor has not responded or issued a fix. The CVSS 4.0 score rates this as a medium severity vulnerability.
A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipulation can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3R is capable of addressing this issue. It is recommended to upgrade the affected component.
CVE-2026-116098 is a medium severity vulnerability in SteelRaven7 Ravenfield affecting the cacheCoverPoints function of the RFL Custom Map Handler component. It involves deserialization that can be triggered remotely without privileges or user interaction. A patch named EA39 Security Patch is recommended to fix the issue.
CVE-2026-116097 is a medium severity cross-site scripting (XSS) vulnerability in the CloudClassroom-PHP-Project affecting the addnewstudent.php file. The vulnerability arises from improper handling of the 'fname' argument, allowing remote attackers to inject malicious scripts. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vendor did not respond to disclosure attempts, and public exploit details exist, but no confirmed exploitation in the wild is reported.
CVE-2026-116096 is a medium severity vulnerability in ggml-org's llama.cpp affecting the Pocket-TTS component. It involves an out-of-bounds write in the function list_pockettts_state_slots caused by manipulation of the mmproj argument. The issue requires local access to exploit and has publicly available exploit code. The vulnerability is addressed in version b11796, where the out-of-bounds write triggers an assertion and aborts rather than silently corrupting memory. A more comprehensive fix is pending in a pull request to prevent out-of-bounds accesses by design.
CVE-2026-116095 is a medium severity vulnerability in smg-project smg versions 1.7.0 through 1.10.1. It involves uncontrolled memory allocation in the jpeg_turbo::decode_jpeg_rgb function within the llm-multimodal component. The flaw can be exploited remotely without authentication. A public exploit exists. Upgrading to version 1.11.0 addresses the issue.
EyouCMS versions 1.8.0 through 1.8.3 contain a server-side request forgery (SSRF) vulnerability in the remote_file_to_local function within application/function.php. This vulnerability allows remote attackers to manipulate server requests, potentially leading to unauthorized internal resource access. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). Public exploit code exists, but no vendor response or patch has been provided as of the publication date.
The nebulallm package on PyPI version 1.4.3 is a malicious typosquatting package that executes harmful code during installation. It overrides the install command in setup.py to download and run a JScript script, which subsequently downloads a malicious DLL. This behavior clearly indicates malware intent.
YARA-X version 1.22.0 was released on October 25, 2026, introducing 11 improvements and 9 bug fixes. Among the enhancements is the addition of built-in functions to read 64-bit integers in various formats. There is no indication of security vulnerabilities or threats associated with this release.
CVE-2026-115627 is an incorrect authorization vulnerability in the ash-project's ash_postgres library affecting versions from 0.38.0 up to but not including 2.15.2. The flaw allows a user to access destination records linked to a source record through another tenant's join rows due to improper enforcement of attribute multitenancy during lateral join queries. This results in unauthorized data exposure across tenants. The issue is fixed in version 2.15.2.