The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. [...]
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
An authenticated user with the global Surveys: create permission in LimeSurvey Community Edition 7.4.0 can store a value in the date_min attribute of a Date/Time question that breaks JavaScript. This stored value is inserted into a single-quoted inline JavaScript literal without proper JavaScript-context encoding when the question is rendered by another user, leading to a potential cross-site scripting (XSS) vulnerability.
MISP has a cross-site scripting (XSS) vulnerability in its remote event preview page. This occurs when a linked remote MISP server supplies a crafted tag ID that is improperly sanitized in JavaScript context. An authenticated user viewing the event preview and interacting with the tag element may have arbitrary JavaScript executed in their browser session. This could lead to session hijacking or unauthorized actions. The vulnerability affects versions prior to the fix commit around v2.5.48, though the exact boundary is unconfirmed.
MISP has a stored cross-site scripting (XSS) vulnerability in the remote event preview index table rendering. An attacker with write access on a linked remote MISP server can craft event identifiers containing malicious HTML or JavaScript. When a user on the local MISP instance views the remote event preview, the malicious script executes in their browser context. This can lead to arbitrary script execution, session hijacking, data theft, or unauthorized actions. The vulnerability affects versions prior to 2.5.48.
MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature affecting versions prior to 2.5.48. This vulnerability arises because event IDs returned from linked remote MISP servers are rendered without proper output encoding. An attacker controlling or compromising a linked server could inject malicious HTML or JavaScript that executes in the browser of authenticated users viewing the ID Translator page. Exploitation requires an authenticated user, a configured linked server, and navigation to the vulnerable page.
MISP versions prior to 2.5.48 contain an improper input validation vulnerability in the decaying model import functionality. This flaw allows authenticated users with decaying-model permissions to overwrite or modify decaying models belonging to other organizations, including changing ownership and default flags. The vulnerability arises because nested model keys with primary key, organization ID, and default flag can bypass input validation during import.
MISP versions prior to 2.5.48 contain an improper access control vulnerability in the attribute search and paginated attribute view endpoints. Authenticated users with read access to events owned by other organizations could query for soft-deleted attributes and receive data that should have been restricted. This vulnerability exposes confidential soft-deleted threat intelligence attributes from other organizations to unauthorized users, potentially leaking sensitive information that was intended to be hidden.
MISP contains an authorization bypass vulnerability in its related events listing functionality. Authenticated users with access to at least one event can retrieve metadata of related events they are not authorized to view. This occurs because the system uses a correlation table that does not re-validate access rights for each related event, potentially exposing event titles, dates, and correlation counts. The vulnerability affects MISP versions prior to the fix commit 2ffa97f05.
MISP versions prior to 2.5.48 contain an authorization flaw in correlation handling during attribute searches. The system uses a stale distribution snapshot for authorization checks instead of the live event access control list, allowing authenticated users with read access to retrieve attributes and event details from events they no longer have permission to view. This flaw affects confidentiality by exposing unauthorized attribute values and event metadata.
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer that allows execution of arbitrary JavaScript when viewing crafted TAXII objects. This occurs because JSON string properties are rendered without HTML encoding. An authenticated user with access to the TAXII object viewer who opens a malicious TAXII object can have scripts executed in their browser context, potentially leading to session token theft or unauthorized actions. The vulnerability affects MISP versions prior to 2.5.48.
A vulnerability in xxhash-rust version prior to 0.8.16 allows a safe API to accept a custom secret that is shorter than the internal minimum length. This leads to undefined behavior due to construction of invalid fixed-width references when running in release mode, as the length check is only enforced by debug assertions. The issue does not require unsafe code from the caller and can cause memory safety violations under certain conditions.
Copernik XML Factory versions before 0.1.2, when using the stock JDK XML provider, improperly allow XInclude resource resolution after enabling XInclude. This breaks the library's guarantee that XInclude resolution remains disabled, potentially allowing attackers to read local files or perform SSRF via HTTP references when parsing untrusted XML. The issue does not affect the Xerces or Android providers. Upgrading to version 0.1.2 or adding Apache Xerces to the classpath mitigates the vulnerability.
Wasmtime, a WebAssembly runtime, contains a vulnerability in its handling of bulk-data-transfer instructions like memory.copy when combined with preemption via epochs or fuel and store state mutations or computation cancellations. This can lead to exposure of intermediate internal states, causing semantic inconsistencies and potential segfaults. The issue affects embedders using Store::epoch_deadline_callback and performing store mutations or resuming computations after cancellation. Wasmtime versions 46.0.0 up to but not including 46.0.2 and 47.0.0 up to but not including 47.0.3 are affected. The vulnerability is fixed in versions 46.0.2 and 47.0.3 by reverting to a behavior that avoids preemption points during these operations.
The domain microsoftusercontent.com, owned by Microsoft, is used as a content delivery network (CDN) for Microsoft 365 user content. There are concerns that compromised user accounts or sites could potentially deliver malicious content from this domain. This raises caution about whitelisting microsoftusercontent.com in antivirus or security solutions. No specific vulnerability or exploit details are provided, and no official vendor advisory or patch information is available.
probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without a closing greater-than character. The synchronous parser converts and scans the full supplied buffer without an input cap, while the streaming parser reparses the complete accumulated SVG prefix for every received chunk. The probe.sync(), probe(stream), and probe(url) entry points can therefore block the Node.js event loop at full CPU, and attacker-controlled chunking can amplify the streaming cost. This issue is fixed in version 7.4.0.
CVE-2026-104859 is an OS command injection vulnerability in the nrwl nx monorepo tool affecting versions from 21.4.0 up to but not including 22.7.8, and from 23.0.0 up to but not including 23.1.1. The vulnerability arises because certain Docker release pipeline commands are constructed as shell command strings that interpolate untrusted configuration values, allowing execution of arbitrary shell commands. This can lead to execution of commands with the release job's privileges, potentially exposing sensitive credentials. The issue is fixed in versions 22.7.8 and 23.1.1.
CVE-2026-59265 is a high-severity code execution vulnerability in Apache OpenOffice up to version 4.1.16. It arises from an untrusted search path issue in the Java integration, allowing a crafted document to execute arbitrary code when opened. The issue is fixed in version 4.1.17, currently in release candidate phase. Users can mitigate the risk by disabling Java runtime integration or avoiding opening untrusted files until the update is applied.
This content discusses the proposal to rename Cybersecurity Awareness Month to Cybersecurity Readiness Month, arguing that awareness of cybersecurity risks is no longer the main issue. Instead, the focus should shift to readiness—taking concrete actions such as patching vulnerabilities, testing backups, and exercising incident response plans. The article highlights that awareness campaigns have succeeded in educating people about threats like phishing and ransomware, but behavior and preparedness remain challenges. It also notes the problematic acronym collision of CSAM with child sexual abuse material. The proposal aims to emphasize measurable security outcomes rather than passive awareness.
Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on a shared build server, developer host, or multi-user container can discover and connect to a running socket because the transport performs no authentication and relies on filesystem containment. The daemon's PROCESS_IN_BACKGROUND request accepts a module path and invokes its default export, allowing a caller that controls a file to execute code as the account running Nx; other handlers can expose workspace file contents, project graphs, and task hashes. Disabling the daemon alone does not remove the vulnerable plugin-worker sockets, while single-user machines without another local account are not exposed. This issue is fixed in versions 22.7.9 and 23.1.2.