A cross-site scripting (XSS) vulnerability exists in serialize-javascript versions 7.0.1 before 7.1.3 due to unescaped </script sequences in function bodies. This flaw could allow injection of malicious scripts when untrusted data is serialized and rendered in a web context.
CVE-2026-115485 is a vulnerability in open-iscsi version 3.0 involving a heap out-of-bounds read and a 1-byte write related to the DHCPv6 vendor option string length in the iscsiuio component. This flaw could potentially lead to memory corruption issues.
Volmarg Personal Management System versions up to 2.1.0 contain an OS command injection vulnerability. Authenticated users can exploit this flaw by creating directories with shell metacharacters in the upload/files path and then moving or copying them, resulting in arbitrary shell command execution as the web server user.
PiWeb Disable payment method / Partial payment for WooCommerce versions before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler. This flaw allows unauthenticated attackers to modify and read other customers' orders by reusing a nonce from their own order-pay page and supplying sequential order_id values. The vulnerability enables attackers to change payment methods, recalculate fees, and disclose order details such as line items and totals.
CVE-2026-118590 is a medium severity vulnerability in the nipy nibabel library versions 5.4.0, 5.4.1, and 5.4.2. It involves uncontrolled memory allocation in the array_from_file function within nibabel/volumeutils.py, which can be triggered remotely. A fix has been proposed but is not yet accepted.
CVE-2026-118586 is a server-side request forgery (SSRF) vulnerability in the dfm feedfinder2 project affecting versions 0.0.1 through 0.0.4. The flaw exists in the find_feeds function of feedfinder2.py, allowing remote attackers to manipulate requests and potentially cause the server to make unintended requests. The vulnerability has a medium severity rating with a CVSS score of 6.9. No patch or vendor response has been reported yet.
CVE-2026-118579 is a critical vulnerability in the D-Link DIR-505 router version 1.10B02. It involves a backdoor in the Web Management CGI component, specifically in the main function of /secmark1524.cgi. This backdoor can be triggered remotely by manipulating certain arguments, allowing unauthorized access. Public exploit code is available, increasing the risk of exploitation.
Tornado HTTP servers prior to version 6.6 are vulnerable to event loop blocking and excessive memory use when processing HTTP/1.1 chunked transfer encoded bodies composed of many small chunks. An attacker can send a request body with millions of 1-byte chunks, causing the server's event loop to block for extended periods (up to a minute for bodies near 100 MB), impacting all connections served by the process. This vulnerability also affects Tornado's SimpleAsyncHTTPClient when reading responses from malicious servers. The issue is fixed in Tornado 6.6, which introduces periodic yielding to the event loop and more efficient chunk handling.
Crass, a CSS tokenizer, incorrectly handles bad URL tokens when a closing parenthesis follows an escaped backslash, causing it to consume more input than browsers do. This flaw can cause CSS sanitizers that rely on Crass to mistakenly allow malicious CSS declarations, style rules, or at-rules such as @import to pass through. The vulnerability affects CSS sanitizers like Sanitize, Loofah, and rails-html-sanitizer, enabling attackers to smuggle CSS that can be used for UI redress, loading attacker-controlled resources, or CSS-based data exfiltration. The issue does not enable script execution in modern browsers. The vulnerability is fixed in Crass version 1.0.8.
A vulnerability in maykinmedia's open-object API versions 2.4.3 to before 2.5.1, 3.0.0 to before 3.6.2, 4.0.0-rc.1 to before 4.0.2, and 4.1.0 to before 4.1.1 allows an API token scoped to read one ObjectType to access full versioned records of objects of other ObjectTypes via the history-detail endpoint. This bypasses authorization checks that normally restrict access, potentially exposing sensitive data such as citizen or case records in government deployments. The issue is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1.
MailWatch for MailScanner versions prior to 1.2.27 contain an authorization bypass vulnerability. Authenticated users with low privileges can release or permanently delete quarantined emails belonging to other users or domains by manipulating the message ID parameter. This occurs because the application does not verify message ownership when processing quarantine actions, despite requiring a valid session and CSRF token. The vulnerability is fixed in version 1.2.27.
CVE-2026-116641 is a vulnerability in MongoDB Database Tools prior to version 100.20.0 caused by improper certificate validation. The tools rely on Golang's TLS implementation, which includes an internal denylist of known-bad CA certificates. Versions compiled with Golang 1.26.8 lack the updated denylist that includes eMudhra certificates, leading to potential trust of revoked or malicious certificates. This issue is fixed in Database Tools version 100.20.0, which uses Golang 1.27.3 with the updated denylist.
CVE-2026-61564 is a critical code injection vulnerability in WWBN AVideo-Encoder versions prior to 8.1.0. The unauthenticated installer endpoint 'install/checkConfiguration.php' improperly interpolates request parameters into PHP string literals without escaping, allowing attackers to inject and execute arbitrary PHP code as the web-server user. Exploitation requires the absence of the 'videos/configuration.php' file, which is typical on fresh deployments or after file removal. The vulnerability also enables arbitrary file read/write and a secondary SQL injection via unsanitized INSERT statements. This issue is fixed in version 8.1.0.
CVE-2026-57448 is a server-side request forgery (SSRF) vulnerability in the mrblomblo blombooru application prior to version 1.40.0. The vulnerability exists in the administrator-only GET /proxy-image endpoint, which fetches URLs server-side without proper validation. This allows an authenticated administrator to access internal network services and cloud instance metadata, potentially exposing sensitive credentials. The issue is fixed in version 1.40.0.
A server-side request forgery (SSRF) vulnerability exists in n8n versions before 1.123.83, 2.41.4, and 2.42.1 in the Slack Trigger webhook. This flaw allows unauthenticated attackers to bypass signature verification when no signing secret is set, enabling them to exfiltrate Slack workspace access tokens by causing the node to send these tokens to an attacker-controlled host.
MONAI versions prior to 1.6.1 have a vulnerability in the check_hash() function where integrity verification is insufficient. Specifically, if the hash value is None, the function silently returns True, and MD5 is used as the default hash type. This flaw allows attackers who can perform man-in-the-middle or registry compromise attacks to substitute bundles, datasets, or model archives downloaded without hashes. Such substitution can lead to malicious file delivery and potential code execution.
MONAI versions from 1.2.0 up to but not including 1.6.1 contain a remote code execution vulnerability in the ConfigWorkflow.__init__ method. This vulnerability arises because the method passes a bundle's configs/logging.conf file to logging.config.fileConfig, which uses eval() on handler class and args fields. An attacker can exploit this by publishing a malicious bundle with a crafted logging.conf that executes arbitrary Python code when the victim loads or runs the bundle.
A vulnerability in n8n Local Gateway desktop app versions before 2.41.4 and 2.42.x before 2.42.1 allows an attacker to silently re-pair the app with a malicious n8n instance via a crafted deep-link. This can cause the app to connect to an attacker-controlled instance without user confirmation, inheriting previously granted permissions and enabling unauthorized actions through the gateway.