CVE-2026-116889

SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property

SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders unescaped on Special:Browse, executing JavaScript in viewers' sessions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-116885

Semantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id Parameter

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inject markup through the unescaped id parameter. Attackers can lure an smw-admin administrator into opening a crafted lookup link, bypassing the auto-satisfied edit-token check, to execute script and perform privileged actions in the administrator's session.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-116881

Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query, jquery.autocomplete.js concatenates the raw PValueLookup API value into HTML via container.html(), altering the dropdown and potentially executing script.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-116877

Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-116873

Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-116843

Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mistral

Products

Mistral-vibe

CVE-2026-116829

llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml_nbytes() and strides, causing out-of-bounds memory access when buffers are sized from wrapped byte counts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ggml Ggml-org

Products

Llama.cpp Llama.cpp

CVE-2026-116825

YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-116821

YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames

YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-116817

OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116812

OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into argMax, cityHash64, or comparison clauses to read other tenants' ClickHouse data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116808

OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116804

DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cure53

Products

Dompurify

CVE-2026-116800

WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-116745

QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Qloapps Webkul

Products

Qloapps Qloapps

CVE-2026-116741

Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes

Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Xiph

Products

Speex

CVE-2026-116737

libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path

libphdi through 20260902 contains a heap out-of-bounds read vulnerability in libphdi_data_files_get_extent_data_file_path that uses the directory prefix length instead of the basename length. Attackers can supply a crafted Parallels disk image descriptor with a long directory prefix and short basename to crash the process or expose adjacent heap memory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Libyal

Products

Libphdi

CVE-2026-116733

flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the buffer ends at an unmapped page.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Flatcc Project

Products

Flatcc

CVE-2026-116729

libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a

libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read past the heap block buffer.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Libyal

Products

Libfvde

CVE-2026-116725

gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mmitch

Products

Gbsplay