Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
FLTK versions through 1.4.5 have a stack-based buffer overflow vulnerability in the Fl_BMP_Image::load_bmp_() function. This flaw occurs when an attacker supplies a BMP or ICO file with a colors_used field value exceeding 256, overflowing a 768-byte colormap array. The vulnerability can lead to application crashes or potentially allow code execution.
A weakness has been identified in itsourcecode Airline Reservation System 1.0. This affects an unknown part of the file /book_flight.php. Executing a manipulation of the argument max can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.php. The manipulation of the argument bookisbn leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
A critical stack-based buffer overflow vulnerability exists in the TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104, specifically in the sub_402340 function of the infostat.cgi Device-Information CGI component. The flaw can be remotely exploited by manipulating the CONTENT_LENGTH argument, potentially leading to complete system compromise. Public exploit code is available, increasing the risk of attacks.
CVE-2026-116836 is a Stored Cross-Site Scripting (XSS) vulnerability in Ubiquiti Inc airMAX M devices that can be exploited by an attacker with access to the adjacent network. Successful exploitation could allow privilege escalation on the affected device. The vulnerability affects airMAX M versions prior to 6.3.26. A fix is available in version 6.3.26.
CVE-2026-116620 is a medium severity vulnerability in Tencent RapidJSON versions 1.0 and 1.1.0. It involves an out-of-bounds read in the GenericStringStream<UTF8<char>>::Take function within the Regex Parser component. This flaw can be triggered remotely and has been publicly disclosed. No patch or vendor response is currently available.
CVE-2026-116608 is a medium severity vulnerability in DAMO Academy VideoLLaMA2 versions 1.0 and 1.1. It involves improper validation of an integrity check value in the load_pretrained_model function, which can be triggered by manipulating the _name_or_path argument. Remote exploitation is possible, and public exploit details have been disclosed. The vendor has not yet responded or issued a fix.
CVE-2026-116605 is a vulnerability in SourceCodester Online Food Ordering System version 1.0. It involves client-side enforcement of security controls that should be enforced server-side in the order.php file, specifically through manipulation of the price/title argument. The vulnerability can be exploited remotely and public exploit code is available. The CVSS 4.0 score is 6.9, indicating a medium severity level.
CVE-2026-116604 is a vulnerability in SourceCodester Online Food Ordering System version 1.0. It involves missing authentication in the admin/delete_admin.php file, allowing remote attackers to manipulate the ID argument without proper authentication. This vulnerability has a medium severity score of 6.9 and has been publicly disclosed with available exploit information.
CVE-2026-116603 is a medium severity vulnerability in SourceCodester Online Food Ordering System version 1.0. It involves an unrestricted file upload flaw in the admin/add_food.php script, where manipulation of the 'image' argument allows remote attackers with high privileges to upload files without restriction. Exploit code has been published, but there is no indication of active exploitation in the wild. No patch or official fix information is currently available.
In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed on the remote SSH host. In a Dag that passes trigger-time input such as `params` or `dag_run.conf` into `environment`, a user who can trigger that Dag but cannot author Dags could run arbitrary commands on the remote host as the SSH connection's user. Users are advised to upgrade apache-airflow-providers-ssh to 7.0.1 or later.
YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory.
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.
YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions.
YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue() falls back to unsanitized $_REQUEST values rendered via Twig |raw templates, performing same-origin authenticated actions in victims' sessions.
YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link.
YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.