CVE-2026-65631 is an inefficient algorithmic complexity vulnerability in the potatosalad jose library versions from 1.7.7 up to but not including 1.11.13. It allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key that triggers expensive factoring operations. The issue is fixed in version 1.11.13.
CVE-2026-65629 is a vulnerability in the potatosalad jose library versions from 1.10.0 up to but not including 1.11.13. It involves the use of a password hash with insufficient computational effort during the export of password-encrypted private keys. The key derivation uses PBKDF2-HMAC-SHA256 with only 2048 iterations and a 64-bit salt, both far below current security recommendations. This weakness allows an attacker who obtains an exported encrypted private key to perform an offline password-cracking attack to recover the private key.
CVE-2026-65628 is a vulnerability in the potatosalad jose library versions 1.5.0 up to but not including 1.11.13. It involves uncontrolled recursion in the function jose_jwk:shared_secret/2 when deriving an ECDH shared secret from two JSON Web Keys (JWKs) of differing key types. An attacker can supply a crafted JWK with a mismatched key type to cause an infinite tail-recursive loop, resulting in 100% CPU usage on an Erlang scheduler and potential denial of service due to resource exhaustion.
CVE-2026-65627 is a vulnerability in potatosalad jose (erlang-jose) versions from 1.0.0 up to but not including 1.11.13. It involves improper handling of highly compressed data during decompression of JWE tokens, allowing a remote attacker to exhaust node memory by sending a crafted small JWE token. The decompression function does not limit output size, enabling data amplification that can crash the BEAM virtual machine and cause denial of service.
CVE-2026-57184 is an out-of-bounds read vulnerability in the Asterisk telephony toolkit's chan_ooh323 addon channel driver. This flaw exists in the Q.931 information-element parser due to insufficient bounds checking. An unauthenticated attacker can exploit this by sending crafted setup packets to cause a crash. The vulnerability affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. The chan_ooh323 driver is not enabled by default and requires explicit compilation and a publicly reachable port. Fixes are available in the stated versions.
CVE-2026-65626 is a Bleichenbacher padding oracle vulnerability in the pure-Erlang RSAES-PKCS1-v1_5 decryption implementation of the jose_jwa_pkcs1 module in potatosalad jose. The vulnerability arises because the decryption function returns distinct error messages depending on padding validity and does not implement countermeasures to mask these differences. An attacker with access to the public RSA key and the ability to submit ciphertexts to a decryption endpoint can exploit this to recover plaintext or forge signatures through adaptive chosen-ciphertext attacks. This affects versions from 1.3.0 up to but not including 1.11.13. The issue is fixed in version 1.11.13.
CVE-2026-65625 is a vulnerability in the potatosalad jose library affecting versions from 1.2.0 up to but not including 1.11.13. The issue arises in the pure-Erlang AES-GCM fallback implementation where the authentication tag length is derived from attacker-supplied data without proper validation. This allows an attacker controlling a JWE token to truncate the authentication tag to as little as 8 bits, drastically reducing forgery resistance and enabling reliable forgery within 256 attempts. Supplying an overly long tag causes a crash. The vulnerability is fixed in version 1.11.13.
CVE-2026-70381 is an authentication bypass vulnerability in the web server configuration of WolfVision Cynap series devices. It allows unauthenticated remote attackers with network access to the web interface to access certain on-device resources intended only for local use. These accessible resources do not include credentials or administrative functions but may expose non-public device content such as screen-saver files or web interface assets. The vulnerability affects multiple Cynap product variants prior to fixed versions.
The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affect PHP, which runs on over 70% of websites. These vulnerabilities pose a critical risk, especially for unsupported legacy PHP versions that no longer receive upstream support. Organizations are urged to quickly identify affected PHP deployments and update to fixed versions. Tenable provides solutions to discover vulnerable PHP assets across external attack surfaces, cloud workloads, and web applications, and assists in prioritizing and accelerating remediation efforts.
CVE-2026-57193 is a vulnerability in the Asterisk telephony toolkit's LDAP realtime driver (res_config_ldap) that allows LDAP filter injection via a crafted SIP username. This can enable an unauthenticated attacker to perform arbitrary LDAP queries and potentially disclose information. The vulnerability affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. The res_config_ldap module must be enabled and configured to access an LDAP server for the issue to be exploitable. Fixed versions are available.
CVE-2026-70380 is a denial-of-service vulnerability in the Miracast over Infrastructure Connection Establishment (MICE) service of WolfVision Cynap devices. An unauthenticated attacker with network access to MICE can exhaust connection capacity, blocking legitimate Miracast connections. Miracast P2P is unaffected, and MICE is disabled by default, requiring explicit customer enablement. Some devices may experience complete Miracast disruption when WLAN is in Infrastructure mode. Fixed versions are 1.78a, 2.00d, and 1.72e.
CVE-2026-116479 is a vulnerability in a2aproject a2a-java up to version 1.2.0.Final affecting the JSON-RPC Error Handler's getMessage function. This flaw allows remote attackers to cause information exposure through error messages. The issue is resolved by upgrading to version 1.3.0.Final.
The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in `phone provisioning HTTP error pages` to retrieve an authorized user's `AMI session cookie` and impersonate that user when `res_phoneprov` is enabled. The Asterisk HTTP web server, Asterisk Manager Interface (AMI), and AMI access via HTTP must all be enabled; each is disabled by default. The attacker must be able to connect to the HTTP server, which binds only to `127.0.0.1` by default even when enabled, and must convince the authorized user to click a malicious link. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sam_model through rembg/commands/s_command.py to rembg/sessions/sam.py, where it is interpolated into SAM filenames and GitHub download URLs passed to pooch.retrieve() without a pinned hash. An unauthenticated attacker can supply a sam_model value combining path traversal with URL fragment syntax to exploit the HTTP request discarding the fragment while the local POSIX path retains it. The first request primes the attacker-selected path tree, and an identical repeated request downloads malicious ONNX encoder and decoder files beside a readable target file. The graphs can load the target through ONNX external data and encode its bytes into the returned PNG mask, disclosing complete files accessible to the rembg process and allowing arbitrary ONNX computation. This issue is fixed in version 2.0.82.
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. Upgrading to version 1.0.0-preview3 is sufficient to resolve this issue. The identifier of the patch is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Upgrading the affected component is recommended.
vsomeip, an open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability in versions 3.7.3 and below. The vulnerability allows a remote, unauthenticated peer to cause excessive memory allocation by declaring a large message size on a reliable (TCP) endpoint before the actual message bytes are received. This can lead to denial of service by exhausting host memory. The issue was fixed in version 3.7.4 by introducing a default maximum message size limit of 10 MiB.