CVE-2026-116888

SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading

SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical_name. Attackers can save a schema whose canonical_name holds script markup, which GroupFormatter renders unescaped in Special:Browse headings, executing JavaScript in viewers' sessions including administrators.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-116884

SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom, or data-theme attribute to execute JavaScript when viewers, including administrators, hover it.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-116880

Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, causing semantic data loss and resource exhaustion.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-116876

Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-116872

Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filters

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:(...) or has:(...) expressions to Special:Search to exhaust PHP search workers when the extended search engine is enabled.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-116842

DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup

DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Diasurgical

Products

Devilutionx

CVE-2026-116828

YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand

YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-116824

YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-116820

YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-116816

llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer

llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ggml Ggml-org

Products

Llama.cpp Llama.cpp

CVE-2026-116815

OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHouse parse errors that disable the project's Sankey chart endpoint.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116811

OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116807

OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all projects.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116803

DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cure53

Products

Dompurify

CVE-2026-116623

code-projects Simple Content Management System Admin welcome.php authorization

A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Simple Content Management System

CVE-2026-116605

SourceCodester Online Food Ordering System order.php client-side enforcement of server-side security

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument price/title results in client-side enforcement of server-side security. It is possible to launch the attack remotely. The exploit has been made public and could be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Online Food Ordering System

CVE-2026-115346

Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themefusion Wordpress-extensions

Products

Avada | Website Builder For Wordpress & Woocommerce Avada

CVE-2026-57193

Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS 4.0 · 6.9 Medium EPSS 2.0% KEV · Not listed

Vendors

Asterisk

Products

Asterisk Certified Asterisk

CVE-2026-116736

libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array

Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpff_table_read_values_array because a 7c column definition's values_array_size is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Libpff Project Libyal

Products

Libpff Libpff

CVE-2026-116732

libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table

libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Libdwarf Project

Products

Libdwarf