Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames.
Bandit.WebSocket.Connection checks max_fragmented_message_size against the payload bytes received, but keeps every non-final continuation frame as a new list cell around its own binary, and nothing limits the number of fragments. A 1-byte fragment costs 7 bytes on the wire but about 150 to 170 bytes of server memory, so one connection can hold about 150 times the configured limit, roughly 1.2 to 1.4 GB at the default 8 MB. Ping frames between fragments keep the connection alive past the idle timeout.
This issue affects bandit: from 1.11.0 before 1.14.0.
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF.
The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected.
This issue affects bandit: from 1.12.4 before 1.14.0.
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body.
Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes.
This issue affects bandit: from 1.4.0 before 1.14.0.
The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution on PHP servers. After PHP released patches on October 21, 2026, attackers successfully exploited these flaws against honeypots on October 24, launching 35 shells from two IP addresses. The exploitation involved a four-stage HTTP request chain causing memory exhaustion, memory leaks, and ultimately shell command execution. This confirms real-world remote code execution beyond prior crash-only observations. The exploit closely matches a public proof-of-concept and bypasses ASLR protections. While confirmed on a specific PHP configuration, broader exploit reliability remains unmeasured. As of October 26, CISA had not observed confirmed exploitation in the wild or added these vulnerabilities to its KEV catalog.
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory.
Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.
This issue affects bandit: from 0.3.1 before 1.14.0.
Kameleo versions 5.3.0 and 5.3.1 contain an information disclosure vulnerability in the CookieController.ListCookies function. This flaw arises from improper handling of the 'guid' argument, allowing remote attackers to access sensitive information. The vendor has not responded to disclosure attempts, and no patch or fix is currently available. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.
NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain a heap-based buffer overflow vulnerability in the host audio, video, and CDC class drivers. This flaw arises because the drivers trust device-supplied bNumEndpoints and bLength values, allowing a malicious USB device to supply crafted descriptors that overflow the fixed-size epList array. This can lead to heap memory corruption, potentially enabling code execution or denial of service.
NXP MCUXpresso SDK USB middleware versions prior to 2.13.0 contain an out-of-bounds read vulnerability in the USB_DeviceCdcRndisSetCommand() function. This flaw arises from trusting a host-supplied informationBufferOffset, allowing a malicious USB host to send crafted RNDIS SET messages with out-of-range offsets. Exploitation can lead to disclosure of device memory. The issue is fixed in version 2.13.0.
Objenesis versions before 3.6 have a type confusion vulnerability due to instantiator caching keyed on class name, which causes collisions when classes share the same name across different class loaders. This can result in newInstance() returning objects of the wrong class and ClassCastException errors.
danmu_api versions before 1.21.7 have an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configurations if the default TOKEN is used and ADMIN_TOKEN is unset. This enables attackers to set ADMIN_TOKEN, lock out legitimate operators, redirect server URLs potentially causing SSRF, and trigger redeployment.
Dolibarr ERP CRM versions before 24.0.0 have an OS command injection vulnerability in the htdocs/admin/tools/export.php script. This flaw allows authenticated administrators to bypass the restrict_os_commands allowlist by submitting specially crafted mysqldump values that chain commands using & characters. Successful exploitation enables execution of arbitrary operating system commands with the web server user's privileges. The vulnerability is fixed in version 24.0.0.
Dolibarr ERP CRM versions 19.0.0 up to but not including 23.0.4 contain an SQL injection vulnerability in the third-party bankaccounts REST endpoint. Authenticated API users with societe/creer permission can exploit this flaw by injecting SQL via the type field, potentially reading sensitive data such as password hashes and API keys through time-based blind subqueries. The vulnerability is fixed in version 23.0.4.
RosarioSIS versions before 12.9.2 have a reflected cross-site scripting (XSS) vulnerability in the MenuReports.php module. This flaw allows unauthenticated attackers to inject malicious attributes via the menu_id and modname parameters. By tricking a logged-in administrator into clicking a crafted link, attackers can execute JavaScript that steals session and CSRF tokens, enabling them to act with the administrator's privileges.
MacCMS v10 through version 2026.1000.4056 has a mass assignment vulnerability in the index/Comment::saveData() function. This flaw allows unauthenticated attackers to manipulate arbitrary mac_comment database columns, including user_id. By exploiting this, attackers can post anonymous comments that appear attributed to any registered user, showing that user's avatar and impersonating them.
MacCMS versions up to 2026.1000.4056 have a race condition vulnerability in the Card::useData() function. Authenticated users can exploit this flaw by sending concurrent requests to redeem a recharge card multiple times before it is marked as used. This allows inflation of user points, enabling unauthorized purchases of VIP upgrades and paid content. The vulnerability has a low CVSS score of 2.3 and does not have known exploits in the wild.
MacCMS v10 versions before 2026.1000.4054 have an authentication bypass vulnerability in the password recovery mechanism. The function check_msg() does not properly verify the recipient of the recovery code, allowing attackers to reset any user's password by submitting a recovery code sent to their own mailbox but associating it with the victim's email or phone number. This flaw enables account takeover without authentication.
CVE-2026-116213 is an arbitrary file read vulnerability in Webasyst Framework versions up to 4.4.0. It arises from improper validation of symbolic link targets when authenticated users with theme management rights upload themes containing symlinks. This flaw allows reading sensitive files such as wa-config/db.php or /etc/passwd via the public theme path.
CVE-2026-116212 is a stored cross-site scripting (XSS) vulnerability in the Webasyst Framework up to version 4.4.0, specifically in the Photos app. Authenticated backend users with album edit rights can inject malicious JavaScript via the album url parameter, which is not properly escaped in the DialogAlbumSettings.html file. This allows execution of arbitrary JavaScript in administrator backend sessions.
CVE-2026-116210 is a cross-site request forgery (CSRF) vulnerability in the Webasyst Framework's Photos app up to version 4.4.0. The vulnerability arises because the Photos app does not enable the framework's opt-in CSRF protection, allowing attackers to trick logged-in users into submitting forged POST requests. These requests can delete photos or modify access rights without user consent.