An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
CVE-2026-97023 is a path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment on Red Hat Enterprise Linux 10. A malicious Flatpak app can exploit this flaw to delete files outside the deployment directory, potentially causing system-wide file deletion when installed or upgraded. The deletion occurs with root privileges in system-wide installations. The vulnerability has a CVSS score of 7.1, indicating high severity.
Researchers discovered over 16,000 Supabase databases misconfigured to expose readable tables containing personally identifiable information, passwords, and authentication tokens. The exposed data includes sensitive records from various sectors such as a U.S. valet service, a Canadian immigration service, an India-based adult platform, a Philippines OTP service, and an African government consulate. The root cause is poor security configurations, including missing or ineffective row-level security policies and misuse of public keys, often linked to AI-assisted app development. Supabase users are advised to review security documentation to mitigate exposure risks.
CVE-2026-97686 is a medium severity vulnerability in Wind River VxWorks 7 prior to version 26.09. It involves the IPNET subsystem failing to release allocated kernel memory and system file descriptors when certain system call arguments are used, leading to resource leaks. This issue is fixed in version 26.09.
A reflected cross-site scripting (XSS) vulnerability exists in the ordasoft.com Book Library (Free) extension for Joomla versions 1.0.0 through 6.4.6. The vulnerability occurs because the public book-detail page template directly echoes the raw 'title' request parameter into a double-quoted HTML attribute without any escaping. This allows an attacker to inject arbitrary HTML or JavaScript by including a double quote in the 'title' parameter, potentially leading to script execution in the context of the victim's browser.
A path traversal vulnerability exists in DeepSeek deepseek-harness versions 0.1.7-rc.0, 0.1.7-rc.1, and 0.1.7-rc.2. The issue is in the loadProfile function of the Bundle Patch Handler component, allowing remote attackers to manipulate the dsh.bundle.patch argument to perform path traversal. Exploitation is difficult and requires a high level of complexity. The vendor has not responded to the disclosure, and no patch or fix is currently available. Public exploit code has been released, but no known active exploitation in the wild is reported. The CVSS 4.0 base score is 2.3, indicating low severity.
A reflected cross-site scripting (XSS) vulnerability exists in the Vehicle Manager (Free) extension for Joomla versions 1.0.0 through 6.5.7. The vulnerability occurs because the public vehicle-detail page (task=view) directly inserts the title request parameter into a double-quoted HTML attribute without proper output encoding. This allows an attacker to inject arbitrary HTML or script code by including a double-quote character in the parameter, potentially leading to script execution in the victim's browser.
An unauthenticated SQL Injection vulnerability exists in the ordasoft.com Book Library (Free) extension for Joomla versions 1.0.0 through 6.4.6. The vulnerability arises from improper sanitization of user-supplied 'field' and 'direction' parameters in the books() function, which are concatenated directly into an unquoted ORDER BY clause. This flaw allows attackers to manipulate SQL queries without proper neutralization, potentially leading to high-impact consequences.
A reflected cross-site scripting (XSS) vulnerability exists in the ordasoft.com Real Estate Manager (Free) extension for Joomla versions 1.0.0 through 6.7.8. The issue occurs on the public property-detail page's 'leave a review' form, where the title field is populated directly from user input without proper escaping or filtering. This allows an attacker to inject malicious script code that executes in the browser of anyone who clicks a crafted link.
An unauthenticated SQL injection vulnerability exists in the ordasoft.com Real Estate Manager (Free) extension for Joomla versions 1.0.0 through 6.7.8. The vulnerability arises from improper neutralization of special elements in the order_field parameter used in SQL ORDER BY clauses on the frontend property-listing queries. This allows an attacker to inject arbitrary SQL commands without authentication.
CVE-2026-84894 is a use-after-free vulnerability in Meta Platforms, Inc's moxygen component. The issue occurs before commit 004123dd24c3, where MoQSession::dataStreamReadLoop continues to use a stream read handle after receiving a FIN signal, which invalidates the handle under proxygen's WebTransport API. A remote attacker can trigger this by opening a data stream with an unknown track alias and sending the FIN in the same write. This vulnerability has a high severity with a CVSS score of 7.5 and impacts confidentiality but not integrity or availability.
An unauthenticated SQL Injection vulnerability exists in the Vehicle Manager (Free) extension for Joomla versions 1.0.0 through 6.5.7. The issue arises from improper sanitization of the order_field and order_direction parameters used in an unquoted ORDER BY clause, allowing attackers to inject SQL commands. This vulnerability has a critical severity with a CVSS score of 9.3.
The ip-address JavaScript library prior to version 10.5.1 contains an incorrect comparison vulnerability in its IPv6 link-local address detection. The Address6 isLinkLocal method only recognizes the fe80::/64 range instead of the full fe80::/10 range, causing inconsistent classification of certain link-local addresses. This inconsistency can allow an attacker-controlled address within the broader fe80::/10 range to bypass trust-boundary checks relying on isLinkLocal, potentially reaching on-link hosts outside intended boundaries. The issue is fixed in version 10.5.1.
The ip-address JavaScript library versions prior to 10.7.1 contain a vulnerability in the isInSubnet and isHostInSubnet methods. These methods perform subnet containment checks by comparing masked binary strings without verifying that both addresses belong to the same IP family (IPv4 vs IPv6). This flaw can cause cross-family containment checks to incorrectly classify an IP address as within a subnet when it is not, potentially leading to incorrect allowlist or denylist decisions. The issue is fixed in version 10.7.1.
CVE-2026-101911 is a medium severity vulnerability in the JavaScript ip-address library before version 10.7.1. It involves uncontrolled resource consumption due to unbounded string input in the Address6 constructor, Address6.isValid, and related parsing code. Large attacker-controlled inputs can cause synchronous stalls, high memory usage, invalid string length exceptions, and process termination. The issue is fixed in version 10.7.1.
A Server-Side Request Forgery (SSRF) vulnerability exists in the ip-address JavaScript library versions 10.2.0 through 10.5.0. The issue arises because the Address6 isPrivate classifier does not recognize the NAT64 local-use range 64:ff9b:1::/48, potentially allowing internal IPv4 destinations encoded through this range to be treated as external. This can lead to bypassing network trust boundaries in applications that rely on isPrivate, isLoopback, and isLinkLocal for trust decisions. The vulnerability is fixed in version 10.5.1.
CVE-2026-101102 is a medium severity vulnerability in deepseek-ai deepseek-harness versions 0.1.0-rc.0 through 0.1.0-rc.7. It affects the run_code function in the Code Mode Sandbox component, resulting in a sandbox issue that can be exploited remotely. The vendor explicitly states that the sandbox is for containment only and not a security boundary. There is no vendor response or patch available at this time.
CVE-2026-49994 is a critical vulnerability in dannymcc bluehood prior to version 0.7.1. When authentication is enabled, only HTML page handlers enforced session validation, while API endpoints under /api/* did not check authentication. This allowed a network attacker with access to the dashboard port to read Bluetooth tracking data and modify application state without a session cookie. The issue is fixed in version 0.7.1.
CVE-2026-55160 is a Server-Side Request Forgery (SSRF) vulnerability in the stringer-rss Stringer application, a self-hosted RSS reader. Before a specific patch commit, authenticated users could make the server send arbitrary HTTP/HTTPS requests to internal networks, localhost, and cloud metadata endpoints such as AWS IMDS. This vulnerability allows low-privileged users, especially when self-service signup is enabled, to scan internal services or potentially steal cloud IAM credentials. The issue has been patched in commit 75cb095.
A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-08 is capable of addressing this issue. The identifier of the patch is 30f8c794d5b73df5c610153043db502b2cc106cc. Upgrading the affected component is recommended.