WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Fireblocks' mpc-lib library has a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation when the private parent key is missing. This flaw breaks the ancestor isolation property, allowing an attacker with a compromised lower-level signer share and knowledge of the chain code to recover higher-level shares up to the root share. The primary MPC secret-sharing layer still prevents full private key reconstruction from a single share compromise, but the hardened derivation no longer provides defense-in-depth isolation between derivation levels. No vendor fix is currently available, and mitigation involves keeping the chain code secret and auditing derivation paths.
CVE-2026-116556 is a cross-site scripting (XSS) vulnerability in Argilla versions 2.0 through 2.8.0. It arises from improper handling of the 'text' argument in a frontend Vue component, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity score of 4.8 and public exploit code is available. The Argilla project has been notified but has not yet issued a response or patch.
CVE-2026-116555 is a cross-site scripting (XSS) vulnerability in Argilla up to version 2.8.0. It arises from improper handling of the 'template' argument in a component file within the frontend codebase. The vulnerability allows remote attackers to inject malicious scripts. Public exploit code has been disclosed, but no official response or patch has been issued by the project as of the publication date.
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined.
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from_disk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-116515 is a SQL injection vulnerability in itsourcecode Online Book Store version 1.0. The flaw exists in the /book.php file where the bookisbn parameter can be manipulated to execute unauthorized SQL commands. This vulnerability can be exploited remotely without user interaction. Public exploit code has been disclosed. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
CVE-2026-116591 is a high-severity integer overflow vulnerability in the klauspost compress library prior to version 1.20.2. It affects the zstd DecodeAll and streaming decoder paths, where crafted input can cause a panic due to an integer wraparound in the huff0.ReadTable function. This leads to reuse of stale decode-table state and out-of-range indexing, resulting in application crashes. The issue is fixed in version 1.20.2.
Transmission versions 4.0.0 through 4.1.2 have a permissive Cross-Origin Resource Sharing (CORS) vulnerability in the handle_request() function of rpc-server.cc. This flaw exposes the X-Transmission-Session-Id anti-CSRF token to any web origin, allowing malicious web pages to read and reuse the token to perform unauthorized RPC calls. Exploitation can lead to script-torrent-done execution, changes to the download directory, or deletion of torrents and data. The vulnerability is fixed in version 4.1.3.
Kener versions 3.0.0 up to but not including 4.1.10 contain a critical authentication bypass vulnerability due to the use of a hard-coded cryptographic key fallback. If the environment variable KENER_SECRET_KEY is empty or unset, attackers who know an administrator's email can forge session tokens and gain full administrative access or create password-reset tokens. This flaw is fixed in version 4.1.10.
QloApps versions 1.6.0 through 1.7.0 have an authorization bypass vulnerability in the qlohotelreview module's AddReview AJAX action. This flaw allows unauthenticated attackers to submit fake reviews for arbitrary orders by exploiting a publicly exposed review_ajax_token and enumerating order IDs. The vulnerability enables attackers to impersonate other customers by posting unauthorized ratings and reviews.
QloApps versions up to 1.7.0 have an authorization bypass vulnerability in the OrderConfirmationController::init() function. This flaw allows unauthenticated attackers to sequentially guess guest id_cart values to obtain guest order references and emails. Attackers can read redirect headers, view booking details, and convert guest accounts into full accounts with attacker-chosen passwords.
ntop nDPI versions up to 6.0 contain an out-of-bounds read vulnerability in the dissect_softether_host_fqdn() function. This flaw arises because the function compares host_name using the consumed byte count instead of the actual data length. An attacker can exploit this by sending crafted short UDP datagrams on already-classified SoftEther flows, causing the strncmp function to read beyond the packet payload buffer.
CVE-2026-116743 is a double free vulnerability in libyal's libmsiecf library, specifically in the function libmsiecf_url_values_read_data(). This flaw allows attackers to corrupt heap memory by supplying a crafted MSIE cache index.dat file with a partial record containing an oversized unknown_offset. The vulnerability can cause forensic tools processing such files to crash. The CVSS 4.0 base score is 6.8, indicating a medium severity level.
HTSlib versions up to 1.24 contain a heap out-of-bounds read and write vulnerability in the function bgzf_index_load_hfile() due to improper handling of a crafted .gzi index entry count. This numeric truncation error can cause heap corruption or crashes in tools such as samtools and bcftools.
Speex (libspeex) versions up to 1.2.1 contain an out-of-bounds write vulnerability in the speex_bits_read_whole_bytes() function. This flaw occurs due to improper handling of length truncation for non-owned SpeexBits buffers, allowing attackers to stream crafted Speex data to corrupt memory and potentially crash applications.
A NULL pointer dereference vulnerability exists in libcss up to version 0.9.2 within the netsurf-browser project. This flaw occurs in the mq_parse_media_query() function when processing media lists that end with a trailing comma. An attacker can exploit this by serving a stylesheet with an @media or @import media list ending in a comma, causing the parser to crash.
VMime versions up to 0.9.2 have an information disclosure vulnerability in the uuEncoder::decode function. This flaw causes uninitialized stack memory to be written into decoded output when processing over-long lines in uuencoded MIME parts. An attacker can exploit this by sending crafted uuencode or x-uuencode MIME parts with large line length bytes, potentially leaking up to 15 bytes of stack memory per line in decoded attachments.