New CVEs.

An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges.

Published Oct 26, 2026 by mitre · NVD · Advisory

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.

Published Oct 26, 2026 by mitre · NVD · Advisory

qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders.

Published Oct 26, 2026 by mitre · NVD · Advisory

libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c. This allows a remote attacker to obtain sensitive information.

Published Oct 26, 2026 by mitre · NVD · Advisory

libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information.

Published Oct 26, 2026 by mitre · NVD · Advisory

libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.

Published Oct 26, 2026 by mitre · NVD · Advisory

libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.

Published Oct 26, 2026 by mitre · NVD · Advisory

osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker to cause a denial of service.

Published Oct 26, 2026 by mitre · NVD · Advisory

libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allows a remote attacker to cause a denial of service.

Published Oct 26, 2026 by mitre · NVD · Advisory

libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. This allows a remote attacker to cause a denial of service.

Published Oct 26, 2026 by mitre · NVD · Advisory

Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write

A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipulation can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3R is capable of addressing this issue. It is recommended to upgrade th…

Published Oct 25, 2026 by VulDB · CVSS 4.0 · CWE-787, CWE-119 · NVD · Advisory

SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization

A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue.

Published Oct 25, 2026 by VulDB · CVSS 4.0 · CWE-502, CWE-20 · NVD · Advisory

CloudClassroom-PHP-Project addnewstudent.php cross site scripting

A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an unknown part of the file addnewstudent.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version detai…

Published Oct 25, 2026 by VulDB · CVSS 4.0 · CWE-79, CWE-94 · NVD · Advisory

ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write

A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolv…

Published Oct 25, 2026 by VulDB · CVSS 4.0 · CWE-787, CWE-119 · NVD · Advisory

smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation

A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this i…

Published Oct 25, 2026 by VulDB · CVSS 4.0 · CWE-789, CWE-400 · NVD · Advisory

EyouCMS function.php remote_file_to_local server-side request forgery

A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Published Oct 25, 2026 by VulDB · CVSS 4.0 · CWE-918 · NVD · Advisory

AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path,…

Published Oct 25, 2026 by EEF · CVSS 4.0 · CWE-863 · NVD · Advisory

AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upser…

Published Oct 25, 2026 by EEF · CVSS 4.0 · CWE-863 · NVD · Advisory

Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that r…

Published Oct 25, 2026 by EEF · CVSS 4.0 · CWE-863 · NVD · Advisory

DedeCMS update_guide.php require_once code injection

A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Published Oct 25, 2026 by VulDB · CVSS 4.0 · CWE-94, CWE-74 · NVD · Advisory

SourceCodester Performance Indicator System save_profile.php sql injection

A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the argument Contact results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

Published Oct 25, 2026 by VulDB · CVSS 4.0 · CWE-89, CWE-74 · NVD · Advisory

SourceCodester Performance Indicator System edit_dealer.php sql injection

A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

Published Oct 25, 2026 by VulDB · CVSS 4.0 · CWE-89, CWE-74 · NVD · Advisory

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Co…

Published Oct 25, 2026 by CPANSec · CWE-789 · NVD · Advisory

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps send…

Published Oct 25, 2026 by CPANSec · CWE-770 · NVD · Advisory

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as…

Published Oct 25, 2026 by CPANSec · CWE-444 · NVD · Advisory

Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\015\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time …

Published Oct 25, 2026 by CPANSec · CWE-1333 · NVD · Advisory

Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers

Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects. A remote attacker can take every worker with a few such connections…

Published Oct 25, 2026 by CPANSec · CWE-770 · NVD · Advisory

SourceCodester Performance Indicator System adddealer.php sql injection

A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Published Oct 25, 2026 by VulDB · CVSS 4.0 · CWE-89, CWE-74 · NVD · Advisory

Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection

A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the file JuelScriptEngine.java. Performing a manipulation results in code injection. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Published Oct 25, 2026 by VulDB · CVSS 4.0 · CWE-94, CWE-74 · NVD · Advisory

KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload

A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of the argument path/filestr leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was con…

Published Oct 25, 2026 by VulDB · CVSS 4.0 · CWE-434, CWE-284 · NVD · Advisory