vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0.
A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.
CVE-2026-115911 is a vulnerability in vllm, an inference and serving engine for large language models, affecting versions from 0.19.0 up to but not including 0.32.0. Authenticated users can supply a chat template that is compiled and rendered without limits on execution time, output size, or iterations. This can cause a nonterminating render that blocks server responses or an output-expanding render that exhausts server memory. Harmony models are not affected. The issue is fixed in version 0.32.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0.
CVE-2026-115910 is a vulnerability in python-social-auth's social-core component prior to version 6.2.0. It involves insufficient verification of the OpenID Connect nonce, which is stored globally rather than being bound to the initiating browser session and OAuth state. This flaw allows an attacker who obtains a victim's unused authorization code to reuse it with a valid state from a separate login, bypassing nonce validation and potentially logging in as the victim if PKCE is disabled. The issue is fixed in version 6.2.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12.
SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords.
To remediate this issue, users should upgrade to version 2.274.0-alpha.0 or later and review existing table grants to PUBLIC.
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.
CVE-2026-115907 is a high-severity vulnerability in the zip-rs zip2 library for Rust, affecting versions from 5.1.0 up to but not including 9.0.0. The issue involves uncontrolled resource consumption due to unbounded preallocation of output capacity based on attacker-controlled ZIP64 uncompressed sizes before validating the compressed stream. This can cause a panic due to capacity overflow in certain decoder paths, potentially terminating an archive-processing service. The vulnerability is fixed in version 9.0.0.
A vulnerability in the zip-rs zip2 Rust library versions from 0.6.0 up to but not including 9.0.0 allows improper validation of the AES entry reader's HMAC authentication tag. Under certain conditions, such as when the encrypted entry has no payload or the data counter does not reach zero before the end of the archive, the reader may return a clean end of stream without verifying the authentication tag. This can cause applications using certain decryption methods to accept modified plaintext without detecting authentication errors. The issue is fixed in version 9.0.0.
A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (cce0282c2e8975376db9fdb7a69afc7ed77c0e7649178967496467e09d7ba328)
The package self-labels as a 'temporary placeholder stub' in package.json and README but ships active install-time dropper artifacts: a 93-byte index.js that loads a native addon (addon.node ELF for Linux, addon_win.node PE for Windows), an 8 MB opaque.napi_cache blob, and a postinstall script that calls addon.init() during npm install. The native addon decodes the shipped.napi_cache blob, writes it to a hidden temp path (/tmp/.<pid> on Linux,.nc<n>.js on Windows), chmods it executable, and detaches it via fork + setsid + execlp so it continues to run after npm install completes. Before executing the dropped payload, the addon checks for CI environment variables (GITHUB_ACTIONS, GITLAB_CI, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID, APPVEYOR, SEMAPHORE, TEAMCITY_VERSION, BITBUCKET_BUILD_NUMBER, NOW_GITHUB_DEPLOYMENT, CF_BUILD_ID, SCREWDRIVER), inspects /proc/1/cgroup and /proc/1/cmdline for containerd/dockerinit markers, reads /proc/self/status for TracerPid, and probes /proc/self/maps and /proc/meminfo to detect analysis sandboxes and debuggers, gating execution on a non-CI, non-container, non-instrumented host. The payload bytes are opaque and attacker-controlled, delivered through the native addon rather than inspectable JavaScript. Installing this package on a developer workstation causes attacker-controlled code to execute detached from the install process.
## Source: ghsa-malware (6e5799fe2d2da1697418d26bfa3ed7bfde41e3e8f3d07003b04c3237950f91b1)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (64a028e4ea3039755f4b18b003e2d9722722ca96c51652674dd1bb27f375e4d0)
The package self-describes as a 'Temporary package placeholder for staged publishing' (package.json stub:true, README 'Temporary Holding Version') but ships a Linux addon.node, a Windows.node, and a 6,052,359-byte opaque.napi_cache blob containing no printable strings. package.json defines a postinstall that executes `node -e "require('./addon.node').init()"`, and index.js requires and invokes the same init(). On invocation the native addon reads the sibling.napi_cache file (format string '%s/.napi_cache'), writes the bytes to a PID-named hidden file under /tmp (format '/tmp/.%u'), chmods it executable, and detaches a child via fork+setsid+execlp, so the opaque payload runs under the installer's user on npm install and on every require() of the package. Before executing the dropped file the addon enumerates CI and sandbox indicators (GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, SANDBOX, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID, APPVEYOR, SEMAPHORE, TEAMCITY_VERSION, BITBUCKET_BUILD_NUMBER, NETLIFY, VERCEL, CF_BUILD_ID, SCREWDRIVER), reads /proc/1/cgroup and /proc/1/cmdline for container markers (docker, containerd, kubepod, sandbox, podman), and inspects /proc/self/status for TracerPid, gating execution to non-analysis hosts. The payload bytes themselves are packed/encrypted and not inspectable from the tarball. A placeholder stub has no legitimate reason to ship a native dropper, detach a hidden /tmp child, and evade sandboxes.
## Source: ghsa-malware (910dd2c3846dd989ee98147187c379760a3d055ffe413f85d36def235d6a7cf7)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.