PyJWT versions 2.11.0 through 2.13.0 contain a vulnerability where the decode() and decode_complete() functions mutate a caller-supplied options dictionary when signature verification is disabled. This mutation can cause subsequent calls that enable signature verification to inherit disabled claim checks such as expiration, audience, issuer, and subject verification, allowing acceptance of tokens with invalid claims without raising exceptions. This is a claims verification bypass, not a signature verification bypass. The issue is a regression introduced in March 2025 by a refactor that removed a shallow copy of the options dictionary. The vulnerability requires the application to reuse the same mutable options dictionary across decode calls with different verification intents.
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS).
This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43.
iperf3 version 3.21 contains a critical remote, unauthenticated heap use-after-free vulnerability. The issue arises because the server's per-test watchdog function frees streams without properly cancelling or joining their associated worker threads, leading to a use-after-free condition when a blocked worker thread dereferences a freed iperf_stream. This vulnerability is fixed in version 3.22.
This content is a podcast episode discussing a hospital ransomware incident where staff could not trust patient records, highlighting challenges in incident response and the importance of rehearsal for CISOs. It includes insights on rapid exploitation enabled by AI and the complexity of layered defenses. The episode also emphasizes the need for incident response exercises to consider scenarios where data and logs may be unreliable.
The Russian state-sponsored threat actor Star Blizzard has developed a new malware delivery technique called RedFlick to deploy its CosmicPulse backdoor. This method automates the infection chain by using a password-protected archive containing a virtual disk with a malicious shortcut file, which when opened, triggers hidden commands to download and install malware components via scheduled tasks. These tasks perform distinct roles to evade detection and ultimately deliver the CosmicPulse backdoor, capable of executing attacker-supplied Python code. The campaigns primarily target Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments, and financial organizations supporting Ukraine. Microsoft recommends phishing-resistant authentication, Conditional Access policies, email protection, and endpoint detection and response solutions to mitigate these attacks.
CVE-2026-92172 is a high-severity vulnerability in Meta Horizon OS prior to version 66.0.0.733.524. The flaw involves improper restriction of communication channels, allowing an application to receive a privileged PendingIntent with a com.oculus.horizon CallerIdentity via a broadcast receiver. This enables the application to impersonate the com.oculus.horizon package to any endpoint within the OS that relies on CallerIdentity authentication.
CVE-2026-92173 is a critical vulnerability in Meta Horizon OS prior to version 74.0.0.878.1682. It involves improper restriction of communication channels, allowing an arbitrary application with NotificationListenerService to receive a privileged PendingIntent containing a CallerIdentity from com.oculus.vrshell. This enables impersonation of the com.oculus.vrshell package and other packages signed with the same key for authentication within the OS.
Kiteworks Email Protection Gateway versions prior to 9.5.0 contain a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows a remote, unauthenticated attacker to cause the gateway to send crafted requests to internal or unintended network destinations when rendering message content with external resource references. Exploitation could lead to disclosure of sensitive internal information or unintended actions on internal systems.
CVE-2026-102106 is an improper authentication vulnerability in the Kiteworks Email Protection Gateway administrative service. The service fails to consistently enforce administrator authentication, allowing attackers referencing a valid administrator account to bypass password checks. This flaw enables unauthorized creation, modification, or deletion of internal users and managed domains, as well as changes to security configurations. Deleting a managed domain can remove its user accounts and potentially lock out legitimate administrators.
CVE-2026-102107 is a medium severity vulnerability in Kiteworks Core involving an authorization bypass in the file-request feature. An authenticated user can send a request that appears to originate from another user because the server does not verify authorization properly. Exploitation requires the feature to be enabled for the attacker and the targeted recipient to act on the request. This flaw could allow solicitation of files or information under a trusted identity.
CVE-2024-58387 is a high-severity vulnerability in Inspur Haiyue HCM Cloud that allows unauthenticated remote attackers to read arbitrary files on the server via a path traversal flaw in the /api/model_report/file/download endpoint. Attackers can manipulate the index and ext parameters to traverse the filesystem and access sensitive files such as /etc/passwd and application database files. This vulnerability was publicly observed in exploitation attempts by the Shadowserver Foundation on November 4, 2024.
CVE-2026-102108 is a high-severity vulnerability in Kiteworks Email Protection Gateway where an authenticated administrator with specific queue-management privileges can submit a crafted serialized object to a cluster management interface. This object is deserialized without sufficient validation, potentially allowing arbitrary code execution under the gateway service account. The vulnerability affects versions prior to 9.5.0.
CVE-2026-102109 is a SQL injection vulnerability in Kiteworks Secure Data Forms. It occurs when a value derived from an authenticated user's stored account data is used in a database query without proper sanitization. Exploitation requires an authenticated session and only affects deployments using a specific optional feature. The vulnerability affects versions prior to 9.5.1.
CVE-2026-102110 is a medium severity vulnerability in Kiteworks Core where an endpoint used during initial appliance setup lacks authentication and does not enforce its intended state precondition. This allows an unauthenticated network attacker to repeatedly trigger the privileged activation process during the initial activation window, potentially disrupting setup and leaving the appliance incompletely configured. The vulnerability is only exploitable during the first-time activation of the appliance and is not accessible afterward.
CVE-2026-102111 is a vulnerability in Kiteworks Core where the software does not enforce the maximum allowed value for a configurable security-policy setting. An authenticated administrator can set this value beyond its intended range, causing the associated security control to never activate. Despite this, the control appears enabled in the administrative interface and audit logs, effectively rendering it silently ineffective.
CVE-2026-102112 is a privilege escalation vulnerability in Kiteworks Core that allows an attacker with existing code execution as an unprivileged backend service account to escalate privileges to root and execute arbitrary commands with highest privileges. Exploitation requires local access to the service account. The vulnerability is due to improper neutralization of special elements used in OS commands (CWE-78).
CVE-2026-102113 is a privilege escalation vulnerability in Kiteworks Core that allows an attacker with local access as an unprivileged backend service account to escalate privileges to root. The issue arises from improper handling of filesystem paths by a privileged routine, enabling arbitrary command execution with root privileges. Exploitation requires prior code execution under the lower-privileged service account. The vulnerability affects Kiteworks Core versions prior to 9.5.0.
CVE-2026-102114 is a command injection vulnerability in Kiteworks Core that allows a high-privileged authenticated administrator to execute arbitrary OS commands as root on the appliance node. Exploitation requires an administrative account with elevated privileges. The vulnerability affects versions prior to 9.5.0. The CVSS score is 7.2, indicating high severity.
Kiteworks Core contains a critical vulnerability in its password reset workflow that allows an unauthenticated attacker to reset a user's password without access to the reset email link. This flaw affects versions prior to 9.5.0 and can lead to full account takeover, including accounts with administrative privileges.
CVE-2026-102116 is a path traversal vulnerability in Kiteworks Email Protection Gateway that allows an authenticated administrator to write files outside intended directories. This can lead to execution of arbitrary files by the application, potentially resulting in remote code execution with the privileges of the service account.