CVE-2026-103227 is a buffer overflow vulnerability in the GPAC software, specifically in the gf_dash_resolve_url function of the DASH Client component. This flaw affects GPAC version 26.07 and can be exploited remotely. The vulnerability can lead to memory corruption due to improper handling of URL resolution. Upgrading to version abi-16.26 addresses this issue.
This is an open-source tool named log-generator that creates realistic synthetic SIEM logs simulating multi-stage cyberattacks. It is designed for security professionals to test detection capabilities and security stacks without requiring real breaches or exposing sensitive data. The tool supports multiple log formats and integrates easily with common SIEM platforms. It does not represent an actual vulnerability or active threat but rather a resource for defensive testing.
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection.
This issue affects Trex MES: through 2026-09-29.
CVE-2026-103226 is a stack-based buffer overflow vulnerability in Artifex Ghostscript affecting the function type1_callsubr in the Pdfwrite component. It affects versions 10.07 and 10.09. The vulnerability allows remote exploitation and public exploit code exists. Upgrading to version 10.08.0 addresses the issue.
Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass.
This issue affects Trex MES: through 2026-09-29.
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4.
CVE-2026-101295 is a path traversal vulnerability in Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2. It occurs in oc-mirror's operator catalog image extraction process, where tar entries from catalog image layers are extracted without validating that file paths remain within the intended destination directory. This can lead to arbitrary file writes outside the target directory.
Google Threat Intelligence Group (GTIG) reports that AI is significantly accelerating the discovery and exploitation of software vulnerabilities, with AI-discovered flaws more likely to enable remote code execution. The volume of disclosed vulnerabilities doubled in 2026, with a notable increase in high-risk and exploited vulnerabilities. AI-discovered vulnerabilities tend to have higher impact, with 50% enabling remote code execution compared to 26% for non-AI discoveries. Exploitation of known vulnerabilities (n-days) is rising, possibly due to AI-assisted automation in weaponizing these flaws. AI-related vulnerabilities in AI systems themselves are also increasing, though zero-day exploitation in AI infrastructure has not yet been observed. The trend suggests continued growth in vulnerability discovery and exploitation driven by AI capabilities.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS.
This issue affects User Submitted Posts: from n/a through 20260810.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
The npm package com.epi.e2e_test version 1.2.2 contains malicious code that executes automatically during installation. A preinstall script runs an index.js file which collects host-specific identifiers such as the home directory, hostname, username, DNS servers, current working directory, and the package.json contents. This data is then sent via HTTPS to a hardcoded external server (meta.brs.cx) without user consent. This behavior is indicative of reconnaissance activity commonly associated with dependency confusion or internal name attacks.
CVE-2026-103118 is a medium severity vulnerability in GraphicsMagick up to version 1.3.47. It affects the ExtractPostscript function in the WPG File Handler component, causing uncontrolled recursion when manipulated. This flaw can be triggered remotely and may lead to denial of service or resource exhaustion. A patch has been released promptly by the vendor to address this issue.
Microsoft will enhance the security of its Entra ID authentication system starting mid-October 2026 by enforcing a Content Security Policy (CSP) that blocks external script injection attacks. This CSP will restrict scripts to only those hosted on trusted Microsoft CDN domains during browser-based sign-ins, mitigating risks such as cross-site scripting (XSS). The change is enabled by default and does not require tenant configuration. Microsoft advises customers to stop using browser extensions or tools that inject scripts into sign-in pages before the enforcement begins and to test sign-in flows for compatibility. API-based authentication flows and Microsoft Authentication Library (MSAL) are not affected by this change. This update is part of Microsoft's Secure Future Initiative, which aims to improve security following previous breaches.
Multiple high-severity vulnerabilities affecting TeamViewer Full Client and Host on Windows, Linux, and macOS have been addressed in version 15.82. These include local privilege escalations via path traversal and race conditions, a heap-based buffer overflow leading to potential remote code execution, and an access control bypass allowing unauthorized remote actions. The vulnerabilities impact versions prior to 15.82 and some legacy versions. TeamViewer strongly recommends updating to version 15.82 or later to mitigate these issues. No active exploitation or public disclosure is currently known.
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection.
This issue affects SOPLOG: before Soplog 2026.9.4.1.
CVE-2026-92899 is a medium severity vulnerability in Apache WSS4J where the Nonce value in UsernameTokens is stored as raw base64 text, but authentication uses decoded bytes. This allows an attacker who captures an authenticated request to modify the Nonce by adding a space, bypassing the replay cache and reusing the token until it expires. The issue affects deployments with a nonce replay cache configured and tokens using password digest. Fixed versions are 4.0.2, 3.0.6, and 2.4.4.
CVE-2026-92121 is a vulnerability in Apache WSS4J's streaming (StAX) code where a signature reference using the WS-Security STR-Transform causes an internal flag to remain set incorrectly. This leads the WS-SecurityPolicy enforcer to stop verifying signed parts for the remainder of the message, allowing a policy requiring the SOAP Body to be signed to be falsely satisfied even if the Body is unsigned. The DOM code is not affected. Versions 4.0.2, 3.0.6, and 2.4.4 include fixes for this issue.
CVE-2026-89238 is a critical vulnerability in Apache WSS4J that allows an attacker to exploit EncryptedHeader child confusion. This flaw can cause an attacker-controlled plaintext element to be treated as the decrypted header, resulting in incorrect confidentiality coverage and potential policy bypass. The vulnerability affects multiple versions and has been fixed in Apache WSS4J versions 4.0.2, 3.0.6, and 2.4.4.