Devika version 1.0 contains a directory traversal vulnerability in the Coder.save_code_to_project function. This flaw allows attackers with limited privileges to write files outside the intended project workspace, potentially leading to full compromise of confidentiality, integrity, and availability of the system. The vulnerability has a high severity with a CVSS score of 8.8. No patch or official fix information is currently provided.
POMS oretnom23v1.0 contains SQL injection vulnerabilities that allow attackers to manipulate backend SQL queries, potentially leading to unauthorized data access or modification. No specific affected versions or patches are identified.
InvoicePlane version 1.7.1 contains a critical remote code execution (RCE) vulnerability that allows attackers to execute arbitrary code on affected systems remotely. No vendor advisory or patch information is currently available to confirm remediation status or mitigation steps.
SuiteCRM versions 8.10.1 and earlier, including 7.15.1, contain an authenticated Server-Side Request Forgery (SSRF) vulnerability. This flaw allows an authenticated user to cause the server to make HTTP requests to arbitrary locations.
Ecava_ntegraXor version 16.0.701.10 contains a remote code execution (RCE) vulnerability that allows an attacker to execute arbitrary code on the affected system remotely.
Food-Ordering 1.0 contains a Local File Inclusion (LFI) vulnerability that allows an attacker to include files from the local server. This can potentially expose sensitive information or enable further attacks.
TigerGraph Community Edition version 4.2.4 contains a vulnerability that allows arbitrary file write. This vulnerability could enable an attacker to write files to the system without authorization.
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provider_options.baseUrl results in server-side request forgery. The attack can be initiated remotely. Applying a patch is the recommended action to fix this issue.
Red Hat has released a security advisory for Red Hat Hardened Images RPMs, including multiple nodejs26-related packages and the v8-devel package. The update addresses several vulnerabilities identified by CVE-2026-102276, CVE-2026-102277, and CVE-2026-102278. The advisory provides updated package versions to fix bugs and enhance security. The update is available for aarch64 and x86_64 architectures as well as noarch packages. No specific technical details or exploitation methods are provided.
AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamID_SystemName value through the /config?action=set web configuration API. Attackers can exploit this flaw when device authentication is disabled to persistently execute arbitrary script in the browser of any administrator who opens the web management interface, enabling theft of stored secrets such as web UI credentials, RTMP stream keys, publish URLs, and NFS/SMB share credentials, as well as hijacking of the authenticated session.
This security advisory addresses vulnerabilities in GVFS, the GNOME Virtual File System, specifically a heap-based buffer overflow in the SFTP component and a local privilege escalation via a socket ownership race condition. The update is rated as important by Red Hat and affects Red Hat Enterprise Linux 10 and its variants. The vulnerabilities could allow local users to gain elevated privileges or cause memory corruption. A security update is available to remediate these issues.
In August 2026, a new loader designated 2CLoader was identified being used to distribute information stealers including Vidar and Remus, along with XWorm RAT. The loader implements extensive anti-analysis capabilities including anti-VM, anti-debug, and user activity checks. It employs sophisticated evasion techniques such as indirect system calls using Hell's Gate technique and inline trampoline hooks to bypass endpoint security detection. The loader stores its configuration and encrypted payload as a PE resource, using rolling XOR and AES-GCM encryption for payload protection. It supports multiple payload execution methods including RunPE, LoadPE, and CLR hosting for .NET assemblies. Network communication with command-and-control servers uses HTTP POST requests with JSON formatted messages encrypted via XOR. Multiple persistence mechanisms are available through registry keys, scheduled tasks, and startup folders.
Deno versions 2.7.0 through 2.9.7 on Windows have a critical OS command injection vulnerability in the node:child_process module. The vulnerability arises because shell arguments are escaped incorrectly for the shell type, allowing attackers to inject arbitrary OS commands when untrusted input is passed with the shell option. This can lead to arbitrary command execution with the privileges of the Deno process.
restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.
CVE-2026-103500 is a heap buffer overflow vulnerability in Mozilla Thunderbird that occurs when a user opens an email of size 2GB or larger. This flaw was addressed and fixed in Thunderbird versions 157, 140.17, and 153.4. The vulnerability has a medium severity rating with a CVSS score of 6.3. Exploitation requires user interaction (opening a large email), and it impacts confidentiality, integrity, and availability to a limited extent.
CVE-2026-103446 is an authorization bypass vulnerability in the Wikimedia Foundation's MediaWiki WikiLambda extension version 1.46. It involves a user-controlled key that allows authentication bypass, potentially enabling unauthorized access. The vulnerability has a high severity with a CVSS score of 7.4. A patch is available for this issue. The affected product is a cloud service, and the vendor manages remediation for this service.
Reachy Mini Wireless OS images prior to version 0.2.4 contain a local privilege escalation vulnerability due to an overly broad sudoers entry. The pollen daemon user (uid 1000) has passwordless sudo access to /usr/bin/systemctl without restrictions, allowing any process running as pollen to gain full root privileges. This issue has been patched in version 0.2.4.