CVE-2026-115892 is a medium severity vulnerability in the Wasmtime runtime for WebAssembly. It involves a type confusion issue where a host-created component-model stream or future can omit a required payload-type check after passing through guest code. This can cause the host to panic when a type-erased value is passed to a guest expecting a different payload type. The issue affects Wasmtime versions from 46.0.0 up to but not including 48.0.7, and from 49.0.0 up to but not including 49.0.4. The vulnerability is fixed in versions 48.0.7 and 49.0.4.
A numeric truncation error in the Cranelift compiler backend of Wasmtime prior to versions 36.0.19 and 43.0.0 can cause silent overflow when compiling large or specially crafted WebAssembly functions. This overflow leads to incorrect intermediate representation references, resulting in arbitrary miscompilation, type confusion, and potentially attacker-controlled effects that may break out of the Wasm sandbox. The issue is fixed in versions 36.0.19 and 43.0.0.
A high-severity vulnerability (CVE-2026-115887) exists in the graphql-scalars library used by graphql-hive, specifically in the GraphQLPhoneNumber scalar between versions 1.24.1 and before 2.0.1. The issue is caused by inefficient regular expression complexity leading to exponential backtracking when parsing certain phone number inputs. This can block the Node.js event loop and stall the server, resulting in a denial of service. The vulnerability affects parseLiteral, parseValue, and serialize functions. It is fixed in version 2.0.1.
A vulnerability in langgraph CLI versions from 0.4.15 up to but not including 0.4.32 causes sensitive temporary registry push tokens to be logged in verbose mode. This token exposure allows anyone with access to CI logs or terminal recordings to pull or push images to the deployment's image repository within the token's 12-hour validity. The issue does not affect deployments without verbose mode or remote image builds and does not allow updating deployments to execute pushed images. The vulnerability is fixed in version 0.4.32.
CVE-2026-115883 is an improper input validation vulnerability in langchain-ai's langgraph checkpoint savers that use Postgres and SQLite for state persistence. Versions prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2 allow unvalidated dotted namespace labels in certain operations, enabling cross-namespace access including reads, overwrites, or deletions. This issue does not affect InMemoryStore. The vulnerability has a medium severity with a CVSS 4.0 score of 6. A fix is available in the specified versions.
CVE-2026-113951 is a vulnerability in Apple's Container product prior to version 1.5.0. It allows an attacker with write access to the filesystem of a Kubernetes cluster container to plant an exec credential plugin in the cluster's admin.conf file. When the kubeconfig is pulled onto a macOS host and kubectl is run, the malicious plugin executes with the host user's privileges, enabling arbitrary command execution on the host. This vulnerability is fixed in Container version 1.5.0.
The abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, contained a critical remote code execution (RCE) vulnerability in its updater mechanism. The updater contacted an abandoned domain over unencrypted HTTP and accepted unsigned executables, allowing anyone controlling the domain to execute code with SYSTEM/root privileges on millions of Windows and macOS devices. Researchers mitigated the risk by registering the domain and remotely disabling the updater through a remediation payload. However, Android users remain exposed, and the app's outdated embedded Chrome engine presents additional risks. Users are advised to uninstall the software entirely.
OpenReception appointment booking software versions 2.1.0 and earlier contain an authorization vulnerability allowing unauthenticated attackers to inject arbitrary encryption public keys into any tenant's staff recipient directory. This breaks the product's end-to-end encryption guarantee by enabling persistent unauthorized access to appointment encryption keys. No patches are publicly available at this time.
CVE-2026-115800 is a path traversal vulnerability in the UbiquitousLearning mllm software up to version 2.0.2. It affects the load_model function in the pymllm/mobile/convertor/__init__.py file. The vulnerability arises from improper handling of the shard_file argument, allowing local attackers to perform path traversal. Exploit code is publicly available, but exploitation requires local access. The vendor has been informed but has not yet responded or issued a fix.
A time-of-check to time-of-use (TOCTOU) race condition vulnerability exists in OpenReception's appointment booking software prior to version 2.2.2. This flaw allows an attacker to overbook an agent by placing multiple appointments into a single time slot that should be exclusive. The issue arises because the booking token is consumed after insertion, but concurrent requests can still cause overlapping bookings. The vulnerability compromises the integrity of the booking calendar and can deny availability to other clients. It has been patched in version 2.2.2.
OpenReception's appointment booking software versions 2.1.0 and earlier contain a vulnerability that allows brute-forcing of a client's six-digit booking PIN. Successful brute force yields the client's booking access token, enabling access to their encrypted appointment data and the ability to act on their behalf within the appointment tunnel. The vulnerability involves improper restriction of excessive authentication attempts and includes a cross-tenant bypass that removes authentication protections across tenant boundaries. No patches are publicly available at this time.
OpenReception's appointment booking software prior to version 2.2.1 contains an authentication bypass vulnerability. An attacker who captures a pending invite token can replay it to register their own passkey on the invited account, gaining control of that account. If the invite is for a staff or tenant-admin, the attacker gains access to the tenant context associated with that account. This vulnerability has been patched in version 2.2.1.
OpenReception's appointment booking software versions prior to 2.0.0 contain a vulnerability in the password recovery mechanism where the account-confirmation link in emails is constructed from the unvalidated Host header. This allows an attacker to send a confirmation email with a malicious link that, if clicked by the invitee, enables the attacker to take over the account by confirming it and registering a passkey. The issue is patched in version 2.0.0.
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.
_language_match interpolates each Accept-Language range into the pattern `/^$range\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.
A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.
The php2shell vulnerability involves complex exploitation steps requiring specific memory conditions and environment setups. Proofs of concept (PoCs) published so far rely on artificial conditions such as low memory limits and single-worker configurations, which are uncommon in real-world deployments. The exploit involves leaking memory addresses to defeat ASLR and modifying function pointers to execute commands, but command size is limited. Disabling session.upload_progress is recommended as a mitigation until an official fix is available.
CVE-2026-115797 is a vulnerability in the Tenda F6 router's Web Management Interface version 12.02.01.73. It involves cleartext transmission of sensitive information due to manipulation of the ecos_pw argument. The vulnerability can be exploited remotely but requires high complexity and is considered difficult to exploit. No patch information is provided. The CVSS score is 6.3, indicating a medium severity risk.
CVE-2026-79982 is a high-severity vulnerability in the Zephyr project's Bluetooth HCI USB transport class. It involves a buffer overflow caused by copying oversized HCI packets into a fixed-size USB transfer buffer without proper length checks. This can lead to memory corruption or denial of service. The flaw affects Zephyr versions from 3.3.0 through 4.4.2. An attacker within Bluetooth range can exploit this by sending oversized packets, potentially causing arbitrary code execution on systems without memory protection or triggering a panic on others.
CVE-2026-79981 is a medium severity vulnerability in the Zephyr project's DNS stub resolver. The resolver binds a single UDP socket with a fixed ephemeral source port for all DNS queries to a configured server, violating RFC 5452's requirement that both source port and transaction ID vary. This allows an off-path attacker with UDP reachability to the device to guess the source port easily and flood forged DNS responses, potentially causing the application to resolve attacker-chosen addresses. The vulnerability affects Zephyr versions from 1.8.0 up to but not including 4.5.0. A patch is available that randomizes the source port per query, increasing the guessing space and mitigating the risk.
CVE-2026-79980 is a medium severity vulnerability in the DHCPv4 client of the Zephyr project. The client used a predictable transaction identifier that was incremented or reused rather than randomized per transaction as required by RFC 2131. This allowed an attacker who observed one identifier to predict future identifiers and forge DHCP replies. Such forged replies could redirect network traffic by changing the device's default gateway and DNS resolvers or disrupt network configuration by sending forged DHCPACK or DHCPNAK messages. A patch is available that ensures a fresh random transaction identifier is generated for each DHCP transaction phase.
CVE-2026-79979 is a use-after-free vulnerability in the Zephyr project affecting arm64 builds with CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled. The issue arises from improper TLB invalidation that only targets ASID 0, allowing stale translations for other ASIDs to persist. This flaw enables unprivileged user threads to access and modify kernel or other domain memory, breaking memory isolation and potentially leading to full system compromise. The vulnerability affects Zephyr versions from 4.3.0 up to but not including 4.5.0. A fix has been implemented to correct the TLB invalidation to cover all ASIDs and preserve proper memory domain permissions.