CVE-2026-94002 is a high-severity vulnerability in Apache MINA SSHD's sshd-sftp component affecting versions from 0.9.0 up to but not including 2.20.0, and 3.0.0-M1 up to but not including 3.0.0-M6. The issue arises because the SFTP client does not verify that replies correspond to requests it sent, allowing a malicious server to send unsolicited replies that accumulate in memory, potentially exhausting client resources. Upgrading to versions 2.20.0 or 3.0.0-M6 or later mitigates this issue.
CVE-2026-94029 is a server-side memory exhaustion vulnerability in Apache MINA SSHD affecting versions from 1.0.0 up to but not including 2.20.0 and from 3.0.0-M1 up to but not including 3.0.0-M6. The flaw exists in the sshd-sftp component during the SFTP v6 check-file-name/check-file-handle extension. Using a very small block size on a large file causes the server to accumulate a large reply message fully in memory, potentially exhausting server memory and causing a denial of service. The issue is fixed in versions 2.20.0 and 3.0.0-M6 by imposing a maximum limit on the size of the reply message.
Cisco Talos identified a China-nexus cyber espionage campaign named UAT-11587 targeting government and policy organizations across Asia, including Taiwan, India, the Philippines, and Cambodia. The campaign uses spear-phishing emails with tailored decoy documents to deliver a Rust-compiled Windows backdoor called Antino. Antino supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading, and persistence. Its command-and-control communication uniquely operates through Microsoft 365 applications using Microsoft Graph to interact with Outlook and OneDrive. The campaign has affected at least 16 institutional environments across eight Asian countries with approximately 350 compromised endpoints. Talos assesses this activity as an intelligence gathering operation with moderate to high confidence. No patch or remediation guidance is provided in the report.
CVE-2026-79625 is a race condition vulnerability in CODESYS Control RTE (SL) affecting versions >=3.0.0.0 <3.5.22.40 and >=3.5.0.0 <4.23.0.0. The issue arises from improper synchronization of monitoring functionality when multiple clients send concurrent requests. An authenticated remote attacker with monitoring access can exploit this to cause incorrect data processing or denial-of-service.
Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism.
In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.
Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.
Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.
Apache MINA SSHD is a Java library for client-side and server-side SSH.
The optional sshd-ldap component provides support for integrating
password and publickey authentication on the server side with an LDAP
server.
sshd-ldap is an optional component. SSH servers implemented with Apache
MINA SSHD are affected only if they use sshd-ldap and do configure it to be used for password of public key authentication.
Other Apache MINA SSHD servers are not affected.
Lack of escaping LDAP filter metacharacters enabled successful authentication with username "*" and password "*".
Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue by properly escaping filter parameters according to RFC 4515.
A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks.
Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server.
sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd-core is _not_ affected by this vulnerability, which concerns only LdapPasswordAuthenticator.
Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue.
A vulnerability in Moodle allows authorized users with manager privileges to bypass visibility restrictions on user profile fields when filtering user lists. This flaw enables such users to infer information from profile attributes they are not directly permitted to view, leading to unauthorized information disclosure. The issue does not affect system availability or integrity and has a low severity rating.
The Real Estate Manager plugin for WordPress suffers from a stored cross-site scripting (XSS) vulnerability via the 'before_price_text' parameter in all versions up to and including 7.3. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises due to insufficient input sanitization and output escaping, lack of capability, nonce, or ownership checks on the AJAX handler, and the use of update_post_meta which bypasses typical filtering mechanisms.
A vulnerability in Moodle's XML grade import feature allows unauthorized grade modification due to missing CSRF token validation. An attacker can exploit this by tricking an authenticated user with grade management permissions into visiting a malicious webpage, causing unauthorized grade changes.
A vulnerability in Moodle's AI editor placement image generation web service allows authenticated users to invoke the feature without the required capability. This incorrect capability check permits unauthorized use of the AI image generation functionality. The issue has a low severity score and does not impact confidentiality or availability but may allow limited unauthorized actions.
A vulnerability in Moodle allows a low-privileged authenticated user to trigger the recalculation of grade penalties without the necessary permissions. This flaw arises from a missing capability check and can lead to unauthorized modification of grade penalty records, potentially affecting student assessment scores. The issue has a medium severity rating with a CVSS score of 4.3.
A vulnerability in Moodle allows an authenticated user with teacher privileges to enroll users into groups that do not belong to the course. This occurs because the application does not verify group membership during enrollment. The flaw could lead to unauthorized group assignments within courses.
Apache PLC4X Java implementation versions 0.10.0 through before 1.0.0 contain multiple memory allocation and recursion flaws. These include excessive memory allocation based on unverified size values, uncontrolled recursion depth, and lack of limits on resource allocation during protocol parsing. The OPC UA driver is vulnerable before authentication, allowing an attacker impersonating a server to cause denial of service by exhausting memory or stack resources. Users are advised to upgrade to version 1.0.0, which addresses these issues.
A vulnerability in Moodle allows an authenticated remote user to bypass host-blocking restrictions in the URL downloader due to incorrect handling of IPv4-mapped IPv6 addresses. This flaw enables Server-Side Request Forgery (SSRF) by making the server request restricted destinations via crafted URLs. The issue has a medium severity rating with a CVSS score of 4.3. No affected versions or patch information are provided.
A vulnerability in Moodle's grade web service allows authenticated students to bypass capability checks and access profile information of other students enrolled in the same course. This results in unauthorized disclosure of personal information. The issue has a medium severity rating with a CVSS score of 4.3. No specific affected versions or patch information is provided.
A vulnerability in the ADS discovery mechanism of Apache PLC4X's Go implementation (PLC4Go) and Java implementation (PLC4J) allows an attacker who can send UDP datagrams to the discovering host to redirect connections to arbitrary addresses. The issue arises because the connection address is derived from the claimed AmsNetId in the response body rather than the actual source address of the datagram. This can lead to an attacker inserting malicious inventory entries and intercepting ADS sessions with route credentials. Additionally, malformed datagrams can disrupt discovery listeners, causing them to stop or consume excessive CPU resources. The vulnerability affects versions prior to 1.0.0 and is fixed in version 1.0.0, which correctly derives connection addresses from the datagram source and logs warnings on mismatches.
CVE-2026-92867 is an out-of-bounds write vulnerability in Pgpool-II that allows an authenticated attacker to cause abnormal process termination or potentially execute arbitrary code. The vulnerability has a high severity with a CVSS score of 8.8. No specific affected versions or patch information are provided.
The Bold Page Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'caption' parameter of its bt_bb_image shortcode. This vulnerability affects all versions up to and including 5.7.2. It allows authenticated users with Contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.
A stack-based buffer overflow vulnerability in Pgpool-II can allow an unauthenticated attacker to cause abnormal process termination, leading to denial of service. The vulnerability does not impact confidentiality or integrity but affects availability.
