vsomeip, an open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability in versions 3.7.3 and below. The vulnerability allows a remote, unauthenticated peer to cause excessive memory allocation by declaring a large message size on a reliable (TCP) endpoint before the actual message bytes are received. This can lead to denial of service by exhausting host memory. The issue was fixed in version 3.7.4 by introducing a default maximum message size limit of 10 MiB.
CVE-2026-116476 is a medium severity race condition vulnerability in the a2aproject a2a-dotnet software, specifically affecting version 1.0.0-preview3. The flaw exists in the TaskProjection.ApplyStatus function of the TaskProjection component. This vulnerability can be exploited remotely without user interaction and requires low privileges. A fix has been proposed via a pull request but has not yet been accepted or released.
CVE-2026-110720 is a critical authorization bypass vulnerability in HashiCorp's consul-k8s component affecting versions 0.42.0 and later up to but not including 1.8.18. The flaw allows attackers to bypass cross-namespace ACL binding rules, potentially gaining elevated Consul privileges. This vulnerability is fixed in consul-k8s versions 1.8.18 and 2.0.4.
A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1.
A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.
A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The project was informed of the problem early through a pull request but has not reacted yet.
HashiCorp Consul and Consul Enterprise have an authorization bypass vulnerability in health check registration that allows an authenticated user to modify health checks of another service on the same node. This issue is tracked as CVE-2026-115804 and is fixed in Consul Community Edition 2.1.0 and Consul Enterprise versions 2.1.0 and 1.21.19.
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
CVE-2026-50096 is a reflected cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 up to but not including 12.1. This flaw allows a remote, unauthenticated attacker to craft a malicious link that, when clicked by a victim, could execute arbitrary JavaScript in the victim's browser. A patch is available starting with version 12.1, which addresses this vulnerability. Versions prior to 11.1 or those in mature or retired status are not patch eligible, and users are advised to upgrade to a supported version and apply the patch.
CVE-2026-50095 is a stored cross-site scripting (XSS) vulnerability affecting Esri ArcGIS Server versions 11.1 up to but not including 12.1 on Windows and Linux. This vulnerability allows a remote unauthenticated attacker to store malicious code that may execute in the context of a victim's browser under certain configurations. A patch is available starting from version 12.1. Versions prior to 11.1 and those in mature or retired status are not eligible for patches, and users are advised to upgrade to a supported version and apply the patch.
CVE-2026-33522 is an improper authorization vulnerability in Esri ArcGIS Server versions 11.3 up to but not including 12.0. It allows a remote, unauthenticated attacker to update service metadata. A patch is available in version 12.0, which addresses this issue. Versions 11.3, 11.5, and 12.0 are supported and patched, while older versions are not eligible for patches. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-33521 is a denial of service vulnerability in Esri ArcGIS Server versions 11.1 up to but not including 12.0. A remote, unauthenticated attacker can send crafted requests that may exhaust all available worker threads, causing service denial. A patch is available in version 12.0 and later. Versions prior to 11.1 or those in mature or retired status are not patch eligible, and users are advised to upgrade to supported versions and apply the patch.
CVE-2026-33520 is a reflected cross-site scripting (XSS) vulnerability in Esri Portal for ArcGIS Server versions 11.1 up to but not including 12.1. This flaw allows a remote, unauthenticated attacker to craft a malicious link that, when clicked by a victim, could execute arbitrary JavaScript in the victim's browser. A patch is available starting with version 12.1. Versions prior to 12.1 that are still under General Availability or Extended support, including 11.5, are eligible for patching. Older versions in mature or retired status are not patch eligible, and users are advised to upgrade to a supported version and apply the patch.
CVE-2026-10757 is a critical SQL injection vulnerability affecting Esri ArcGIS Server versions 11.1 up to but not including 12.1 on Windows and Linux. This flaw allows a remote attacker with access privileges to the service, potentially including anonymous users if the service is publicly accessible, to execute unauthorized database-specific functions. A patch addressing this vulnerability is available starting with version 12.1 and for other supported versions including 12.0, 11.5, 11.3, and 11.1. Users of unsupported versions are advised to upgrade to a supported version and apply the patch.
HashiCorp Consul and Consul Enterprise contain a denial of service vulnerability in the HTTP API that allows unauthenticated attackers to exhaust memory on a Consul agent. This issue is due to allocation of resources without limits or throttling (CWE-770). The vulnerability is fixed in Consul Community Edition 2.1.0 and Consul Enterprise versions 2.1.0 and 1.21.19.
CVE-2026-116463 is an out-of-bounds read vulnerability in FastStone Image Viewer versions 8.0 through 8.5. The flaw exists in the Box-Average Downsampler Engine component, specifically in the function FUN_0062d96c. This vulnerability can be triggered remotely and may lead to information disclosure or application instability. The vendor has not responded to the disclosure, and no patch or mitigation guidance is currently available.
CVE-2026-115923 is a path traversal vulnerability in Backstage's DefaultCatalogRulesEnforcer component of the @backstage/plugin-catalog-backend. Authenticated users with catalog.location.create permission can exploit percent-encoded path segments to bypass URL pattern checks, causing untrusted URLs to be treated as trusted. This flaw affects Backstage versions prior to 3.9.2 and versions from 4.0.0 up to but not including 4.0.2. The issue is resolved in versions 3.9.2 and 4.0.2.
HashiCorp Consul and Consul Enterprise have a vulnerability (CVE-2026-105608) involving improper handling of case sensitivity that allows an authorization bypass in service mesh proxy registration. This flaw permits a user with service write permission to apply Envoy escape-hatch configuration without needing mesh write permission. The issue is fixed in Consul Community Edition 2.1.0 and Consul Enterprise versions 1.21.19 and 2.1.0.
When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP stream to hosts on the same network segment. The stream is not encrypted, which may allow an unauthenticated host to view or capture presentation content where network access is not otherwise restricted. This vulnerability only affects devices with the vSolution Matrix feature enabled.