Threats affecting pkg:npm/@byondreal/accessor

Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails.

When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.

When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.

Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs into a stack overflow and exits when a payload item with too much metadata is discarded at once. This only affects users that make their HTTP or RTR server available to untrusted networks.

CVE-2026-116384 is an improper authorization vulnerability in Bdtask Garage 24 Garage Management Software version 1.0. The flaw exists in the backend component and can be exploited remotely without user interaction. Public exploit code is available, but the vendor has not responded or issued a fix. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

vLLM versions prior to 0.32.0 contain a resource allocation vulnerability in the Phi-4 multimodal audio encoder. The default use of eager attention causes large attention matrices to be fully materialized in GPU memory when processing long audio clips, leading to quadratic memory consumption. This can result in out-of-memory conditions that terminate the EngineCore process, affecting all users. The issue is resolved in version 0.32.0.

CVE-2026-115912 is a deserialization vulnerability in vllm versions prior to 0.32.0. An authenticated user can supply crafted shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, this leads to arbitrary Python code execution via pickle.loads(). The issue is fixed in version 0.32.0.

A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.

CVE-2026-115911 is a vulnerability in vllm, an inference and serving engine for large language models, affecting versions from 0.19.0 up to but not including 0.32.0. Authenticated users can supply a chat template that is compiled and rendered without limits on execution time, output size, or iterations. This can cause a nonterminating render that blocks server responses or an output-expanding render that exhausts server memory. Harmony models are not affected. The issue is fixed in version 0.32.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0.

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

CVE-2026-115910 is a vulnerability in python-social-auth's social-core component prior to version 6.2.0. It involves insufficient verification of the OpenID Connect nonce, which is stored globally rather than being bound to the initiating browser session and OAuth state. This flaw allows an attacker who obtains a victim's unused authorization code to reuse it with a valid state from a separate login, bypassing nonce validation and potentially logging in as the victim if PKCE is disabled. The issue is fixed in version 6.2.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12.

SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords. To remediate this issue, users should upgrade to version 2.274.0-alpha.0 or later and review existing table grants to PUBLIC.

CVE-2026-115909 is a denial of service vulnerability in the zip-rs zip2 library affecting versions from 1.3.0 up to but not including 9.0.0. The vulnerability arises because the library allocates memory based on an attacker-controlled ZIP64 uncompressed_size field before validating the entry data, which can cause the process to abort due to an impossible allocation request. This issue is fixed in version 9.0.0.

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1.