CVE-2026-79842 is a critical authentication bypass vulnerability in Hewlett Packard Enterprise's Intelligent Management Center (iMC) affecting versions prior to v7.3 E0713. This flaw allows an attacker to bypass authentication controls, potentially leading to full confidentiality and integrity compromise of the affected system without requiring user interaction or privileges.
mongo-c-driver is a project that includes two libraries: libmongoc, a client library written in C for MongoDB. libbson, a library providing useful routines related to building, parsing, and iterating BSON documents.
Security Fix(es):
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.(CVE-2026-106428)
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching this issue requires the application to use the BSON bulk-writer API and produce a precise cumulative document size.(CVE-2026-106431)
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.(CVE-2026-106437)
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.(CVE-2026-106438)
A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.(CVE-2026-88035)
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.(CVE-2026-88036)
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.(CVE-2026-93394)
A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.(CVE-2026-93395)
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
CVE-2026-106432 is a low-severity vulnerability in the MongoDB PHP Driver where the BSON encoder incorrectly converts string lengths to a 32-bit value without proper validation. This flaw can lead to a heap buffer overflow when encoding very large strings near 4 GiB in size, potentially causing process memory corruption or termination of the PHP process. Exploitation requires a non-default runtime configuration that permits multi-gigabyte string values and does not require interaction with the MongoDB server.
System Informer versions before 4.0.26241.138 contain an incorrect authorization vulnerability in the phsvc helper. This flaw allows local attackers to access privileged APIs by connecting from any Authenticode-signed process. Exploitation involves loading code into a Microsoft-signed host process such as rundll32.exe and invoking PhSvcApiCreateService to execute code with SYSTEM privileges. The vulnerability has a high severity with a CVSS 4.0 score of 8.5.
CVE-2026-107781 is a critical server-side request forgery (SSRF) and missing authorization vulnerability in Dromara Skyeye's OnlyOffice save callback function editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary URL and key parameters to cause the server to fetch internal URLs and overwrite any user's stored file, then read the results via another function. This vulnerability allows unauthorized file manipulation and data exposure.
Dromara Skyeye version 0 contains a critical OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint. The flaw allows attackers to inject a single quote into the format parameter, breaking out of the PowerShell string and executing arbitrary commands with the privileges of the Skyeye service account on Windows systems.
Dromara Skyeye version 0 contains a critical missing authentication vulnerability in certain job management endpoints. Unauthenticated attackers can submit jobs with malicious code to the /jobinfo/addAndStart endpoint, leading to remote command execution or job disruption on the executor host. This vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact without requiring any privileges or user interaction.
MIT Kerberos 5 (krb5) versions up to 1.22.2 contain a NULL pointer dereference vulnerability in the make_cred_list() function within rd_cred.c. This flaw allows authenticated Kerberos clients to cause a denial of service by crashing services that accept GSS-API security contexts. The issue arises when attackers send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context(), leading to a service crash.
MIT krb5 versions up to 1.22.2 have a NULL pointer dereference vulnerability in the KDC component's get_pac_princ_with_realm() function. This flaw occurs when processing malformed client names in S4U2Proxy requests from a malicious or compromised cross-realm trusted KDC, potentially causing the krb5kdc service to crash and deny authentication.
IDC Frontier's IDCF Cloud service in Japan suffered a ransomware attack on October 7, 2026, causing an outage in its East Japan Region 1 data center cluster. The attack disrupted services for 495 companies and local governments, leading to the shutdown of impacted systems and disabling of customer management console access. The threat actor claimed to have encrypted large volumes of data and virtual machine resources. IDC Frontier is investigating the attack, isolating affected systems, and verifying security before restoring access. A related outage at Nissui Corporation's logistics subsidiary due to suspected unauthorized access is under investigation, but a connection to the IDCF Cloud attack is unclear. Recent trends indicate increasing cybersecurity incidents targeting Japanese entities, with attackers exploiting access control and authentication weaknesses, possibly accelerated by AI tools. No patch or fix information is available as this is a ransomware incident affecting a cloud service.
FreeScout versions prior to 1.8.235 contain a cross-site scripting (XSS) vulnerability when the APP_CLOUDFLARE_IS_USED setting is enabled. The application trusts the CF-Connecting-IP header during failed login attempts without validation and stores this value in the activity log. The LogsMonitor component inserts this unescaped value into administrator alert emails, allowing injected HTML to execute when the email is viewed. This vulnerability is fixed in version 1.8.235.
Intego Antivirus for Windows versions up to 3.0.0.1 contains a link following vulnerability in its optimization module. This flaw allows local unprivileged users to delete arbitrary folders with SYSTEM privileges by exploiting improper link resolution. Attackers can replace a scanned duplicate file's directory with a junction to a sensitive system path and abuse Windows Installer rollback to execute code as SYSTEM.
Poppler versions 0.42.0 through 26.10.0 contain a stack-based buffer overflow vulnerability in the Decrypt::revision6Hash() function. This flaw allows attackers who can control the password input to overflow stack buffers by supplying a password longer than 127 bytes when opening AESV3/R6 encrypted PDFs. The overflow can lead to process crashes or memory corruption.
CVE-2026-106126 is a critical OS command injection vulnerability in the Active Directory Events Listener component of Tenable Identity Exposure (SaaS). It allows an authenticated user with low privileges to execute arbitrary commands with SYSTEM-level privileges on the Primary Domain Controller emulator (PDCe). This vulnerability affects versions from 0 up to but not including 3.126.0 and has a CVSS score of 9.9, indicating a severe risk to confidentiality, integrity, and availability.
CVE-2026-107608 is a vulnerability in aws-cdk-lib where the asset bundling process using Docker files could improperly include symlinked files or directories in the output without those symlinks being part of the input. This affects all versions prior to 2.267.0. The issue arises when bundling assets with Docker files, potentially causing unexpected files to be included in the deployment package.
CVE-2026-107322 is an OS command injection vulnerability in the Amazon Agent Plugins for AWS, specifically in the databases-on-aws plugin versions 1.0.0 through 1.7.0. This plugin extends AI coding agents with AWS workflows and includes database helper scripts. The vulnerability arises from an incomplete input validation that allows a remote unauthenticated actor to supply crafted content. This crafted input can lead to operating system command execution on the host if the agent invokes the local helper with the malicious database command. The commands execute with the permissions of the helper process. This issue does not affect the Aurora DSQL service or bypass database privileges. A fix is available in version 1.7.1.
TVU Networks TVU Receiver and Transceiver devices with firmware versions prior to 7.9 have a missing authentication vulnerability in their REST API. This flaw allows remote unauthenticated attackers to read sensitive device information and modify device configurations, including DNS settings, potentially enabling man-in-the-middle attacks on connections to TVU cloud infrastructure. The vulnerability is critical with a CVSS 4.0 score of 9.3.
TVU Networks TVU Receiver and Transceiver devices with firmware versions before 7.9 have an authentication bypass vulnerability in the web management login endpoint. This flaw allows remote attackers to gain administrative access by submitting an empty or missing UserName parameter in a POST request, bypassing client-side validation and ignoring password requirements. Successful exploitation grants full administrative control over the device's web interface.
A malware campaign named 'Midnight Mimosa' has been identified on low-cost Android smartphones. These devices come pre-installed with malicious firmware that enables attackers to silently install additional apps, conduct ad fraud, and convert the phones into residential proxies without user consent.