CVE-2026-116164 is a vulnerability in parse-community's parse-server that affects versions before 8.6.100 and 9.0.0 before 9.10.4-alpha.3. It allows clients to write or clear reserved internal fields in objects due to improper input validation. This can cause read failures on MongoDB queries for all users or enable attackers to bypass account lockout and password policies by clearing their own lockout state and password history.
Parse Server versions before 8.6.102 and versions from 9.0.0 up to but excluding 9.10.5-alpha.2 contain an authentication bypass vulnerability. This occurs because certain validation methods in custom authentication adapters are never called, causing the system to use a default method that accepts any authentication data. Attackers can exploit this to sign up, link identities, log in as existing users, or bypass additional authentication factors without proper verification.
Parse Server versions before 8.6.104 and versions from 9.0.0 up to but not including 9.10.5-alpha.5 have an improper privilege management vulnerability. When issuing an SMS multi-factor authentication verification code, the server saves the entire login request with master privileges. This allows an SMS MFA-enrolled user to modify master-key-restricted fields on their own account, such as the email-verification flag or values protected by beforeSave triggers.
Parse Server versions before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 have an information disclosure vulnerability in the LiveQuery feature. The vulnerability arises because the subscription hash does not include constraints adjacent to a $or operator, such as the _Session owner filter and beforeSubscribe constraints. This causes distinct subscriptions to be grouped together, allowing authenticated clients using $or queries to receive events intended for other users, including session tokens that could be used for impersonation.
WWBN AVideo versions 26.0 through 29.3.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated commenters can inject JavaScript code via specially crafted comments that include an img tag with an onerror event handler. This occurs because the markDownToHTML() function preserves event-handler attributes in leading HTML blocks, bypassing the inline sanitizer. The injected script executes in the browsers of viewers under the application's origin.
A cross-site request forgery (CSRF) vulnerability exists in LinkStackOrg LinkStack versions 4.8.0 through 4.8.8. The flaw involves an unknown function that can be manipulated remotely without authentication, potentially allowing an attacker to perform unauthorized actions on behalf of a user. The vendor has not responded to disclosure attempts, and no patch or official fix is currently available.
CVE-2026-116137 is a medium severity vulnerability in the adm-zip library (version 0 to 0.6.1) by cthackers. It involves a duplicate-entry validation bypass where attackers use canonically equivalent entry names to evade integrity checks. This allows malicious ZIP archives to pass validation checks while extracting harmful content to the same file path.
Leon before commit 50df142 has a path traversal vulnerability in the getModelFileNameFromURL() function. This flaw allows attackers to write files outside the intended models directory by using percent-encoded '../' sequences in a crafted URL. Exploitation requires tricking a user into running a '/download model' command with the malicious URL. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.
Infinity for Reddit versions up to and including 8.3.4 contain a login cross-site request forgery (CSRF) vulnerability. This flaw allows attackers to log victims into attacker-controlled Reddit accounts by exploiting a hardcoded OAuth state value in the LoginChromeCustomTabActivity redirect handler. An attacker can authorize the app with their own Reddit account and then trick victims into using that account, causing their posts, messages, and browsing activity to be performed under the attacker's identity.
Docker-Proxy versions up to 5.1.9 have a missing authentication vulnerability in the hubcmdui routes/config.js component. This flaw allows unauthenticated attackers to read and overwrite configuration data via the /api/config endpoint. Sensitive information such as the WeChat webhook URL and Telegram bot token can be exposed, and attackers can modify menuItems links, proxyDomain, and monitoring webhook destinations.
NiubiGEO versions before 0.3.2 have an unauthenticated server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to make the server perform HTTP requests to internal or private network addresses by sending a crafted domain value to the POST /audit-plan endpoint. Exploitation can lead to disclosure of internal network resources or cloud metadata via the plan's siteEvidence JSON response.
Paisa versions before 0.7.8 have a path traversal vulnerability in several handlers that allows unauthenticated attackers to read arbitrary files and delete backup files outside intended directories by using crafted file names with ../ sequences.
Mave is a Tel Aviv-based startup founded by former Unit 8200 officers that uses AI agents to automate and enhance security operations by investigating alerts across existing security stacks. The company aims to address the challenge of overwhelming data and slow response times in enterprise security teams by leveraging AI to keep pace with AI-assisted attackers. Mave's solution integrates with existing security tools to provide near real-time context-based reasoning, reducing alert fatigue and improving operational efficiency. The startup emphasizes controlled AI autonomy with approval gates and audit trails to mitigate risks associated with automated actions. Currently, Mave does not offer full automation but focuses on augmenting human decision-making in security operations. The company recently raised $34 million to accelerate AI research and expand its product offerings and global presence.
CVE-2026-116050 is a SQL injection vulnerability in the krupalshah Employee Recruitment System affecting the /source/registerform3.php file's pemail parameter. The vulnerability allows remote attackers to manipulate SQL queries. The product uses continuous delivery with rolling releases, so no specific affected or fixed versions are available. The vendor did not respond to the disclosure and the affected product is no longer supported. The vulnerability has a medium severity score of 6.9 and public exploit details have been disclosed.
CVE-2026-116049 is a SQL injection vulnerability in the krupalshah EmployeeRecruitmentSystem affecting the mysql_query function in /source/registerform2.php. The vulnerability allows remote attackers to manipulate several input parameters, potentially leading to SQL injection. The product uses rolling releases, so specific affected or fixed versions are not available. The vendor did not respond to disclosure and no patch or remediation is currently known. This vulnerability affects unsupported versions of the product.
A malicious file identified by the SHA-256 hash a151d3f4f2422531f30a843ffb35479596c86722bb103bdf8591105687f9b125 was observed by OffSeq Mirage honeypot sensors on 2026-10-25. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The activity was seen originating from attacker infrastructure in KP. No known exploits in the wild or specific affected software versions are reported.
CVE-2026-116048 is a SQL injection vulnerability in the krupalshah EmployeeRecruitmentSystem affecting the mysql_query function in /source/registerform1.php. The vulnerability allows remote attackers to manipulate multiple input parameters leading to SQL injection. The product uses a rolling release model, so no specific affected or fixed versions are available. The vendor did not respond to disclosure and the affected product is no longer supported. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity).
CVE-2026-116047 is a cross-site scripting (XSS) vulnerability in Privoce Vocechat version 0.9.121. The flaw exists in the processing of the 'welcome' query parameter within the widget.html component. This vulnerability can be exploited remotely and requires user interaction. The vendor has not responded to the disclosure, and no patch or remediation information is currently available.
A security researcher discovered a method to bypass the AWS MCP Python sandbox restrictions in the aws___run_script tool, which executes user-supplied Python code in a restricted AWS Lambda environment. The sandbox uses AST validation and runtime proxy objects to block dangerous operations, including attribute access and imports. However, the researcher found that Python's structural pattern matching (match/case) can implicitly read attributes listed in __match_args__, bypassing the sandbox's attribute access restrictions. By assigning __match_args__ to sensitive dunder attributes and constructing attribute names at runtime, the researcher achieved sandbox escape and system command execution within the Lambda environment.
CVE-2026-116046 is a path traversal vulnerability in the eventcatalog sdk affecting versions up to 2.29.0. The flaw exists in the Custom Documentation Helpers component, specifically in the functions getCustomDoc, writeCustomDoc, and rmCustomDoc. It allows manipulation of the options.path argument to traverse directories on the local host. The issue is resolved by upgrading to version 2.30.0.