CVE-2026-111103 is an improper cleanup on thrown exception vulnerability in the HTTP/2 handler of the mtrudel bandit server. It allows unauthenticated remote attackers to bypass per-connection resource limits by sending a single TCP write containing multiple frames, one of which triggers a stream error. This causes the server to roll back certain connection state variables, effectively ignoring some streams and allowing more concurrent streams than intended. The issue affects bandit versions from 1.9.0 up to but not including 1.14.0.
CVE-2026-111101 is a high-severity vulnerability in mtrudel bandit's HTTP/1.1 chunked body reader. It allows unauthenticated remote attackers to exhaust server memory and CPU by sending requests with many small 1-byte chunks. The vulnerability arises because the chunked reader accumulates each chunk without limits, causing excessive memory and CPU usage. This affects bandit versions from 0.1.0 up to but not including 1.14.0. A fix is available in version 1.14.0.
CVE-2026-113436 is an inefficient algorithmic complexity vulnerability in the header integer parser of the mtrudel bandit HTTP server. An unauthenticated remote attacker can exploit this by sending extremely large numeric values in headers such as content-length or Host, causing excessive CPU consumption. This affects versions from 1.0.0-pre.7 up to but not including 1.14.0. The issue is fixed in version 1.14.0.
CVE-2026-110314 is a vulnerability in the mtrudel bandit WebSocket connection handling where client-side enforcement incorrectly allows continued execution of WebSocket handler code after the server has sent a Close frame. This flaw enables a remote client to send data frames that are processed despite the server intending to close the connection, potentially allowing unauthorized actions such as admin-only operations. The issue affects bandit versions from 0.5.1 up to but not including 1.14.0 and is fixed in version 1.14.0.
CVE-2026-114213 is a high-severity resource exhaustion vulnerability in mtrudel bandit's WebSocket fragment reassembly. An unauthenticated remote attacker can send many 1-byte fragmented continuation frames to exhaust server memory. The vulnerability arises because the server keeps each non-final continuation frame as a separate list cell without limiting the number of fragments, causing disproportionate memory use. This affects bandit versions from 1.11.0 up to but not including 1.14.0. The issue is fixed in version 1.14.0.
CVE-2026-114216 is an HTTP Request/Response Smuggling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit. It allows an unauthenticated remote attacker to smuggle a second HTTP request past a front-end proxy by exploiting how chunk extensions with bare LF characters are handled. This affects bandit versions from 1.12.4 up to but not including 1.14.0. The issue arises because the chunked reader improperly parses chunk-size lines, allowing control characters that some proxies interpret differently, leading to request smuggling. Deployments without a proxy in front of bandit are not affected. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity). A fix is available in version 1.14.0.
CVE-2026-115269 is a high-severity vulnerability in mtrudel bandit's HTTP/2 request body reader that allows an unauthenticated remote attacker to cause an infinite loop by sending WINDOW_UPDATE or empty SETTINGS frames. This keeps stream processes open indefinitely, potentially exhausting resources. The issue affects bandit versions from 1.4.0 up to but not including 1.14.0. A fix is available in version 1.14.0.
The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution on PHP servers. After PHP released patches on October 21, 2026, attackers successfully exploited these flaws against honeypots on October 24, launching 35 shells from two IP addresses. The exploitation involved a four-stage HTTP request chain causing memory exhaustion, memory leaks, and ultimately shell command execution. This confirms real-world remote code execution beyond prior crash-only observations. The exploit closely matches a public proof-of-concept and bypasses ASLR protections. While confirmed on a specific PHP configuration, broader exploit reliability remains unmeasured. As of October 26, CISA had not observed confirmed exploitation in the wild or added these vulnerabilities to its KEV catalog.
CVE-2026-108525 is a high-severity vulnerability in the HTTP/2 implementation of mtrudel bandit versions from 0.3.1 up to but not including 1.14.0. It allows an unauthenticated remote attacker to exhaust server memory by sending DATA frames beyond the advertised receive window and withholding WINDOW_UPDATE frames. This causes the stream process to block and queue frames until the server's BEAM node runs out of memory, leading to a denial of service.
Kameleo versions 5.3.0 and 5.3.1 contain an information disclosure vulnerability in the CookieController.ListCookies function. This flaw arises from improper handling of the 'guid' argument, allowing remote attackers to access sensitive information. The vendor has not responded to disclosure attempts, and no patch or fix is currently available. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-59106 is a critical OS command injection vulnerability in the WolfProt interface of WolfVision Cynap Pure (Next Gen) and Cynap Bridge devices. An unauthenticated attacker with network access can exploit insufficient input neutralization to execute arbitrary operating system commands with the privileges of the affected application service. The vulnerability affects versions prior to 2.00c for Cynap Pure (Next Gen) and prior to 1.78a and 1.72e for Cynap Bridge. Fixed versions are available.
NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain a heap-based buffer overflow vulnerability in the host audio, video, and CDC class drivers. This flaw arises because the drivers trust device-supplied bNumEndpoints and bLength values, allowing a malicious USB device to supply crafted descriptors that overflow the fixed-size epList array. This can lead to heap memory corruption, potentially enabling code execution or denial of service.
NXP MCUXpresso SDK USB middleware versions prior to 2.13.0 contain an out-of-bounds read vulnerability in the USB_DeviceCdcRndisSetCommand() function. This flaw arises from trusting a host-supplied informationBufferOffset, allowing a malicious USB host to send crafted RNDIS SET messages with out-of-range offsets. Exploitation can lead to disclosure of device memory. The issue is fixed in version 2.13.0.
Objenesis versions before 3.6 have a type confusion vulnerability due to instantiator caching keyed on class name, which causes collisions when classes share the same name across different class loaders. This can result in newInstance() returning objects of the wrong class and ClassCastException errors.
danmu_api versions before 1.21.7 have an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configurations if the default TOKEN is used and ADMIN_TOKEN is unset. This enables attackers to set ADMIN_TOKEN, lock out legitimate operators, redirect server URLs potentially causing SSRF, and trigger redeployment.
Dolibarr ERP CRM versions before 24.0.0 have an OS command injection vulnerability in the htdocs/admin/tools/export.php script. This flaw allows authenticated administrators to bypass the restrict_os_commands allowlist by submitting specially crafted mysqldump values that chain commands using & characters. Successful exploitation enables execution of arbitrary operating system commands with the web server user's privileges. The vulnerability is fixed in version 24.0.0.
Dolibarr ERP CRM versions 19.0.0 up to but not including 23.0.4 contain an SQL injection vulnerability in the third-party bankaccounts REST endpoint. Authenticated API users with societe/creer permission can exploit this flaw by injecting SQL via the type field, potentially reading sensitive data such as password hashes and API keys through time-based blind subqueries. The vulnerability is fixed in version 23.0.4.
RosarioSIS versions before 12.9.2 have a reflected cross-site scripting (XSS) vulnerability in the MenuReports.php module. This flaw allows unauthenticated attackers to inject malicious attributes via the menu_id and modname parameters. By tricking a logged-in administrator into clicking a crafted link, attackers can execute JavaScript that steals session and CSRF tokens, enabling them to act with the administrator's privileges.
MacCMS v10 through version 2026.1000.4056 has a mass assignment vulnerability in the index/Comment::saveData() function. This flaw allows unauthenticated attackers to manipulate arbitrary mac_comment database columns, including user_id. By exploiting this, attackers can post anonymous comments that appear attributed to any registered user, showing that user's avatar and impersonating them.
MacCMS versions up to 2026.1000.4056 have a race condition vulnerability in the Card::useData() function. Authenticated users can exploit this flaw by sending concurrent requests to redeem a recharge card multiple times before it is marked as used. This allows inflation of user points, enabling unauthorized purchases of VIP upgrades and paid content. The vulnerability has a low CVSS score of 2.3 and does not have known exploits in the wild.