CVE-2026-116808

OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116804

DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cure53

Products

Dompurify

CVE-2026-116800

WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-116745

QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Qloapps Webkul

Products

Qloapps Qloapps

CVE-2026-116741

Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes

Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Xiph

Products

Speex

CVE-2026-116737

libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path

libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the process or expose adjacent heap memory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Libyal

Products

Libphdi

CVE-2026-116733

flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the buffer ends at an unmapped page.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Flatcc Project

Products

Flatcc

CVE-2026-116729

libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a

libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read past the heap block buffer.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Libyal

Products

Libfvde

CVE-2026-116725

gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mmitch

Products

Gbsplay

CVE-2026-116639

MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting

A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Md-mafujul-hasan

Products

Online-payroll-management-system

CVE-2026-116608

DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check

A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load_pretrained_model of the file videollama2/model/__init__.py of the component Model Loading. The manipulation of the argument _name_or_path leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Damo Academy

Products

Videollama2

CVE-2026-116603

SourceCodester Online Food Ordering System add_food.php unrestricted upload

A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Online Food Ordering System

CVE-2026-116588

Datadog dd-trace-py: ReDOS in URL query string obfuscation

Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Datadog

Products

Dd-trace-py

CVE-2026-116584

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. This issue is a residual bypass of the remediation for CVE-2026-23957. This issue is fixed in version 1.6.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Lxsmnsyc

Products

Seroval

CVE-2026-116580

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted Seroval input and an application plugin that returns a callable value or an object exposing an on method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value. This is an incomplete-fix variant of CVE-2026-59940. The resulting confidentiality, integrity, or availability impact depends on the behavior exposed by the application plugin. This issue is fixed in version 1.6.8.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Lxsmnsyc

Products

Seroval

CVE-2026-116576

systeminformation: Windows command injection in services() through Unicode quotation marks

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Sebhildebrandt

Products

Systeminformation

CVE-2026-116555

Argilla Sandbox.vue cross site scripting

A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Argilla

Products

Argilla

CVE-2026-116514

itsourcecode Airline Reservation System book_flight.php cross site scripting

A weakness has been identified in itsourcecode Airline Reservation System 1.0. This affects an unknown part of the file /book_flight.php. Executing a manipulation of the argument max can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Airline Reservation System

CVE-2026-116506

TOTOLINK A950RG firewall.so apmib_set command injection

A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 9.4 Critical EPSS 1.9% KEV · Not listed

Vendors

Totolink

Products

A950rg A950rg Firmware

CVE-2026-116502

turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write

A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g_idx can lead to out-of-bounds write. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Turboderp-org

Products

Exllamav2