CVE-2026-116098 is a medium severity vulnerability in SteelRaven7 Ravenfield affecting the cacheCoverPoints function of the RFL Custom Map Handler component. It involves deserialization that can be triggered remotely without privileges or user interaction. A patch named EA39 Security Patch is recommended to fix the issue.
CVE-2026-116097 is a medium severity cross-site scripting (XSS) vulnerability in the CloudClassroom-PHP-Project affecting the addnewstudent.php file. The vulnerability arises from improper handling of the 'fname' argument, allowing remote attackers to inject malicious scripts. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vendor did not respond to disclosure attempts, and public exploit details exist, but no confirmed exploitation in the wild is reported.
CVE-2026-116096 is a medium severity vulnerability in ggml-org's llama.cpp affecting the Pocket-TTS component. It involves an out-of-bounds write in the function list_pockettts_state_slots caused by manipulation of the mmproj argument. The issue requires local access to exploit and has publicly available exploit code. The vulnerability is addressed in version b11796, where the out-of-bounds write triggers an assertion and aborts rather than silently corrupting memory. A more comprehensive fix is pending in a pull request to prevent out-of-bounds accesses by design.
CVE-2026-116095 is a medium severity vulnerability in smg-project smg versions 1.7.0 through 1.10.1. It involves uncontrolled memory allocation in the jpeg_turbo::decode_jpeg_rgb function within the llm-multimodal component. The flaw can be exploited remotely without authentication. A public exploit exists. Upgrading to version 1.11.0 addresses the issue.
EyouCMS versions 1.8.0 through 1.8.3 contain a server-side request forgery (SSRF) vulnerability in the remote_file_to_local function within application/function.php. This vulnerability allows remote attackers to manipulate server requests, potentially leading to unauthorized internal resource access. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). Public exploit code exists, but no vendor response or patch has been provided as of the publication date.
The nebulallm package on PyPI version 1.4.3 is a malicious typosquatting package that executes harmful code during installation. It overrides the install command in setup.py to download and run a JScript script, which subsequently downloads a malicious DLL. This behavior clearly indicates malware intent.
YARA-X version 1.22.0 was released on October 25, 2026, introducing 11 improvements and 9 bug fixes. Among the enhancements is the addition of built-in functions to read 64-bit integers in various formats. There is no indication of security vulnerabilities or threats associated with this release.
CVE-2026-115627 is an incorrect authorization vulnerability in the ash-project's ash_postgres library affecting versions from 0.38.0 up to but not including 2.15.2. The flaw allows a user to access destination records linked to a source record through another tenant's join rows due to improper enforcement of attribute multitenancy during lateral join queries. This results in unauthorized data exposure across tenants. The issue is fixed in version 2.15.2.
CVE-2026-115635 is an incorrect authorization vulnerability in ash-project's ash_postgres component. It allows a user to read another tenant's record due to a skipped upsert operation that does not enforce multitenancy attribute checks. This affects versions from 2.6.22 up to but not including 2.15.2. The issue is fixed in version 2.15.2.
CVE-2026-114214 is an incorrect authorization vulnerability in the ash-project ash framework affecting versions from 3.24.0 up to but not including 3.37.1. The flaw allows a client to read destination records unrelated to the source record when querying certain has_many or has_one through relationships with a limit of 1. This occurs because the code path reads destination records without properly filtering them by the source, potentially exposing records that should be inaccessible through that relationship. The issue is fixed in version 3.37.1.
The PyPI package 'zagents-message-bus' contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in its setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The npm package '@capsense/core-ui' version 99.99.100 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain associated with malicious activity. There is no CVSS score available, and no known exploits in the wild have been reported. No patch or remediation information is provided.
CVE-2026-111497, known as Node2Shell, HTTP2Shell, or Broccoli2Shell, is a remote code execution vulnerability in the Brotli decoder used by official, unmodified Node.js builds. A malformed Brotli compressed request body can trigger an out-of-bounds write, resulting in a shell on the target system. This has been reproduced on x86-64 systems against multiple Node.js targets including plain node:http, official slim images, Express 5.3.0, and Koa 3. The vulnerability arises from improper handling of block switches in Brotli streams, leading to memory corruption and arbitrary code execution. A public scanner is actively mapping Brotli-capable hosts, indicating reconnaissance activity preceding exploitation.
The npm package '@capsense/ccx-welcome-page' version 99.99.100 has been identified as malicious due to its communication with a domain linked to malicious activity. This behavior classifies the package as a security threat.
CVE-2026-116063 is a code injection vulnerability in DedeCMS version 5.7.118. The flaw exists in the require_once function within the dede/update_guide.php file, where manipulation of the 'vtime' argument allows injection of arbitrary code. This vulnerability can be exploited remotely without user interaction but requires high privileges. The CVSS 4.0 score rates it as medium severity. Public exploit code is available, but no known active exploitation has been reported. No patch or remediation details are provided in the source data.
CVE-2026-116062 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in the processing of the Contact argument in the /opils/staff/save_profile.php file, allowing remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code is available, but no known active exploitation in the wild has been reported. No patch or official remediation has been documented yet.
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.
The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares.
A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.