CVE-2026-116841

DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpqfilenumberfromhash function that allows attackers to read heap memory via unchecked blocktableindex values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, t...

CVE-2026-116840

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in ggufinitfromreader that bypasses the CVE-2025-53630 size check when padding near-SIZEMAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and...

CVE-2026-116829

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in ggufinitfromreader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggmlnbytes and...

CVE-2026-116816

llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llmtokenizerplamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like whose negative parsed value writes token ids before the bytes buffer...

CVE-2024-58400

llama.cpp before b3701 contains an out-of-bounds read vulnerability in llamadecodeinternal and llamaencodeinternal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send integer-array prompts to the llama-server /completion endpoint with...

CVE-2025-71439

llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llamavocab::impl::printinfo that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-serve...

CVE-2024-58399

llama.cpp before b2731 contains an out-of-bounds read vulnerability in llamamodelloader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash the...

CVE-2026-116620

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

CVE-2026-116608

A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function loadpretrainedmodel of the file videollama2/model/init.py of the component Model Loading. The manipulation of the argument nameorpath leads to improper validation of integrity...

CVE-2026-111422

In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated "environment" parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as "$..." in a value was executed on the remote SSH host. In a Dag that...

CVE-2026-116828

YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes...

CVE-2026-116827

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension chec...

CVE-2026-116826

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/tag/duplicate, storing local...

CVE-2026-116825

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature, which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/formId/actor/inbox endpoint can replay it later to re-execute Delete, Update,...

CVE-2026-116824

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrerssites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing...

CVE-2026-116823

YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue falls back to unsanitized $REQUEST values...

CVE-2026-116822

YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste...

CVE-2026-116821

YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the and % wildcards. Self-registered attackers can use usernames such as or %%% that over-match ACL tokens, reading pages and Bazar entries...

CVE-2026-116820

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL...

CVE-2026-116804

DOMPurify from 3.4.4 before 3.4.17 contains a SAFEFORTEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURNDOM, RETURNDOMFRAGMENT, or INPLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which mer...

CVE-2026-116803

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

CVE-2026-116802

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

CVE-2026-116800

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in...

CVE-2026-116801

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning clas...

CVE-2026-116556

A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue. The manipulation of the argument text results in cross site scripting. The attack can be executed remotely. The...

CVE-2026-116555

A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site scripting. Remote exploitation of the...

CVE-2026-2270

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...

CVE-2026-76654

An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubel...

CVE-2026-116554

A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.fromdisk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting...

CVE-2026-116591

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable ...

CVE-2026-116748

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handlerequest in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enablin...

CVE-2026-116747

Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMYSECRET fallback key. When KENERSECRETKEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to...

CVE-2026-116746

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed reviewajaxtoken and enumerate sequential idorder...

CVE-2026-116745

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init that allows unauthenticated attackers to obtain guest order references and emails by supplying guest idcart values. Attackers can iterate sequential idcart values, read the Location redirec...

CVE-2026-116743

libyal libmsiecf through 20260525 contains a double free vulnerability in libmsiecfurlvaluesreaddata that allows attackers to corrupt heap memory via crafted partial URL records. Attackers can supply a crafted MSIE cache index.dat file whose recovered partial record has an oversized unknownoffset...

CVE-2026-116744

ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissectsoftetherhostfqdn in softether.c that compares hostname using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp t...

CVE-2026-116742

HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzfindexloadhfile in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc0 buffer and an...

CVE-2026-116741

Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer or speexbitssetbitbuffer...

CVE-2026-116740

libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mqparsemediaquery that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or othe...

CVE-2026-116739

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes...

CVE-2026-116737

libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdidatafilesgetextentdatafilepath that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename t...

CVE-2026-116738

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line,...

CVE-2026-116736

Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpfftablereadvaluesarray because a 7c column definition's valuesarraysize is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory...

CVE-2026-116735

libpff through 20260926 contains an off-by-one bounds check in libpfftableread6crecordentries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applications like pffexport or pypff to read adjacent...

CVE-2026-116734

flatcc through 0.6.4 contains an integer overflow vulnerability in the checkheader function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the...

CVE-2026-116733

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in flatccjsonparsernumber that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing...

CVE-2026-116732

libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarfdebugaddrtable that omits the table starting offset when validating .debugaddr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarfdebugaddrbyindex to read past the heap...

CVE-2026-116731

Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past t...

CVE-2026-116730

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count...

CVE-2026-116729

libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvdeencryptedmetadatareadtype0x001a caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plist data, causing libfvdevolumeopen to read pas...