CVE-2026-116873

Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-116843

Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mistral

Products

Mistral-vibe

CVE-2026-116829

llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml_nbytes() and strides, causing out-of-bounds memory access when buffers are sized from wrapped byte counts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ggml Ggml-org

Products

Llama.cpp Llama.cpp

CVE-2026-116825

YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-116821

YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames

YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-116817

OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116812

OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into argMax, cityHash64, or comparison clauses to read other tenants' ClickHouse data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116808

OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116804

DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cure53

Products

Dompurify

CVE-2026-116800

WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-116745

QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Qloapps Webkul

Products

Qloapps Qloapps

CVE-2026-116741

Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes

Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Xiph

Products

Speex

CVE-2026-116737

libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path

libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the process or expose adjacent heap memory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Libyal

Products

Libphdi

CVE-2026-116733

flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the buffer ends at an unmapped page.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Flatcc Project

Products

Flatcc

CVE-2026-116729

libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a

libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read past the heap block buffer.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Libyal

Products

Libfvde

CVE-2026-116725

gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mmitch

Products

Gbsplay

CVE-2026-116639

MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting

A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Md-mafujul-hasan

Products

Online-payroll-management-system

CVE-2026-116608

DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check

A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load_pretrained_model of the file videollama2/model/__init__.py of the component Model Loading. The manipulation of the argument _name_or_path leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Damo Academy

Products

Videollama2

CVE-2026-116603

SourceCodester Online Food Ordering System add_food.php unrestricted upload

A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Online Food Ordering System

CVE-2026-116588

Datadog dd-trace-py: ReDOS in URL query string obfuscation

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Datadog

Products

Dd-trace-py