An untrusted pointer dereference vulnerability exists in the firmware of certain ASUS motherboards. A user with kernel-level privileges can supply an arbitrary memory address via an I/O command, which may lead to tampering with system information or cause a system crash. The vulnerability has a CVSS score of 6.8, indicating a medium severity level.
A cross-site scripting (XSS) vulnerability exists in the Saruf-Ratul HR-Payroll-Management-System in the chat.php file due to improper handling of the ID argument. This flaw allows remote attackers to execute script code in the context of the affected application. The vulnerability has a low severity score and an exploit has been published. The project uses rolling releases, so specific affected or fixed versions are not available, and no vendor response or patch has been issued yet.
A cross-site scripting (XSS) vulnerability exists in the chat.php file of the MD-MAFUJUL-HASAN Online-Payroll-Management-System up to commit a8902bf64575e325f6d6bf93a55f7bd273ec58cd. The vulnerability arises from manipulation of the ID argument and can be exploited remotely. The project has not yet responded to the issue report, and no fixed versions or patches are currently available. The vulnerability has a low severity score of 3.5 (CVSS 3.1).
Mistral Vibe versions prior to 3.0.3 have a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by defining git filter drivers in an untrusted repository's .git/config file. When the application is started with the --worktree option, git worktree add applies .gitattributes and runs filter commands before verifying the trusted folder, enabling execution of attacker-controlled commands with user privileges.
Fclairamb ftpserverlib versions through 0.32.4 have a vulnerability where file contents and directory listings can be transmitted in cleartext despite mandatory encryption settings. This occurs because the TransferOpen function only checks the transferTLS flag set by the PROT command, not whether the actual data connection uses TLS. An attacker on the network path can read or modify transferred data when a client sends PROT P after PASV or PORT commands.
A high-severity security vulnerability (CVE-2026-116620) exists in Tencent RapidJSON up to version 1.1.0. The flaw is in the GenericStringStream<UTF8<char>>::Take function within the Regex Parser component, causing an out-of-bounds read. This vulnerability can be exploited remotely. Public exploit details have been disclosed, but the vendor has not yet responded or provided a patch.
An out-of-bounds read vulnerability exists in llama.cpp before commit b2731 within the llama_model_loader component. This flaw allows attackers to craft GGUF model files with arbitrary 64-bit tensor offsets that cause the process to read memory outside the mapped model file. Exploitation can lead to process crashes or unintended memory disclosure by loading adjacent process memory as model weights.
A heap-based buffer overflow vulnerability exists in certain Ubiquiti airMAX M, LTU, SolarPoint, and SolarSwitch devices. An attacker with access to the adjacent network could exploit this flaw to execute arbitrary code on the affected device. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability. No specific affected versions or patch information is provided.
A vulnerability in code-projects Simple Content Management System 1.0 allows remote attackers to bypass authorization by manipulating the 'addnews' argument in the /web/admin/welcome.php file. This flaw affects the Admin Interface component and can lead to unauthorized actions. The vulnerability has a high severity score and public exploit code is available.
DevilutionX versions 1.4.0 through 1.5.5 contain an out-of-bounds read vulnerability in the bundled libmpq library. This flaw occurs in the libmpq__file_number_from_hash function, allowing attackers to read heap memory by supplying unchecked block_table_index values. Exploitation requires placing a crafted .mpq archive, such as a mod, in the game's data path, which can cause the game to read beyond intended memory bounds and crash.
CVE-2026-116838 is a Cross-Site Request Forgery (CSRF) vulnerability affecting airMAX M devices. An attacker can lure an authenticated user to a malicious page to exploit this flaw and execute command injection on the device. The vulnerability has a high severity score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.
CVE-2026-116839 is a Cross-Site Request Forgery (CSRF) vulnerability in airMAX M devices that allows a malicious actor to trick an authenticated user into visiting a malicious page, leading to unauthorized changes and potential Denial of Service (DoS) attacks on the device.
DevilutionX versions 1.4.0 through 1.5.5 contain a heap buffer overflow vulnerability in the bundled libmpq library. The flaw occurs in the libmpq__archive_dup routine when opening specially crafted MPQ archives with a block table count exceeding the hash table count. This causes a heap overflow via memcpy during game startup, leading to a crash.
A medium-severity vulnerability (CVE-2026-116605) exists in SourceCodester Online Food Ordering System 1.0 in the order.php file. The issue involves manipulation of the price or title arguments, leading to client-side enforcement of what should be server-side security controls. This vulnerability can be exploited remotely. Public exploit code is available.
A security vulnerability exists in DAMO Academy VideoLLaMA2 versions up to 1.1 in the load_pretrained_model function. The issue involves improper validation of an integrity check value due to manipulation of the _name_or_path argument. Remote exploitation is possible, and public exploit details have been disclosed. The project has been informed but has not yet responded or issued a fix.
An out-of-bounds read vulnerability exists in llama.cpp versions before commit b3701 in the functions llama_decode_internal and llama_encode_internal. This flaw allows remote unauthenticated attackers to read memory or crash the process by sending crafted integer-array prompts with token IDs outside the valid range to the llama-server /completion endpoint.
CVE-2026-116836 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability affecting airMAX M devices. An attacker with access to the adjacent network could exploit this vulnerability under certain conditions to escalate privileges on the device. The vulnerability allows for execution of malicious scripts that can compromise confidentiality, integrity, and availability of the affected device.
An integer overflow vulnerability exists in llama.cpp versions from b5854 up to but not including b11275 in the function gguf_init_from_reader. This flaw allows crafted GGUF files with tensor sizes padded near SIZE_MAX to bypass size checks, resulting in undersized data blobs and out-of-bounds reads. The vulnerability has a medium severity rating with a CVSS score of 6.1.
A heap out-of-bounds read vulnerability exists in llama.cpp before commit b5649 within the function llama_vocab::impl::print_info(). This flaw allows attackers to crash the model loading process by supplying a specially crafted GGUF model with an undersized tokenizer.ggml.tokens array, causing out-of-bounds access and application crash.
A heap out-of-bounds write vulnerability exists in llama.cpp versions from b5899 up to but not including b10261 in the function llm_tokenizer_plamo2::build. This flaw allows attackers to corrupt heap memory by supplying crafted GGUF models containing BYTE-typed token text with negative parsed values. The vulnerability can cause application crashes and may lead to potential code execution during model loading.