RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees the expected block number without also verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the derived offset to exceed the client slice offset and making ctx->offset - offset underflow in _2buf_slice(). The resulting buffer-relative calculation can read before the payload buffer and crash the client, causing denial of service and potentially exposing adjacent memory. No fixed release is available as of this review.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An unauthenticated attacker can craft a Cookie header so Coraza indexes or drops a cookie under a different name or value from the backend application, causing rules targeting REQUEST_COOKIES or REQUEST_COOKIES_NAMES to miss application-visible attacker data. Exploitation depends on the backend parser and affected rule scope, and interior control characters with inconsistent backend behavior are outside this advisory's remediation. This issue is fixed in version 3.8.1.
x64dbg-MCP Server versions prior to 1.1 expose the debugger's full functionality over HTTP without any authentication, allowing unauthenticated network clients to execute arbitrary debugger commands, attach to processes, and manipulate memory and files. This critical vulnerability is fixed in version 1.1.
CVE-2026-107820 is an integer overflow vulnerability in the duty1g x64dbg-MCP Server plugin prior to version 1.2. The vulnerability arises from parsing an unbounded Content-Length header and performing unchecked addition, which can cause a runtime integer-overflow panic. This leads to termination of the x64dbg process and its live debugging session, resulting in a denial of service. The server listens on all interfaces by default, allowing unauthenticated network clients to trigger this condition. The issue is fixed in version 1.2.
CVE-2026-107834 is a medium severity vulnerability in OWASP Coraza WAF versions 3.0.0 through 3.7.x. It involves uncontrolled resource consumption due to the handling of multipart file uploads, where temporary file descriptors remain open until the entire request completes. An unauthenticated attacker can exploit this by submitting many minimal file parts, exhausting the process file descriptor table and causing failures in creating temporary files, blocking legitimate uploads and preventing the process from opening files or sockets. This issue is fixed in version 3.8.0.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail that was not visited by the bounded walk, causing gjson.Valid to recurse without a depth bound and terminate the hosting process with an unrecoverable fatal stack overflow. The ProcessRequest and ProcessResponse JSON paths share the affected readJSON validation flow, and the payload can remain within recommended body-size and argument-count limits. This issue is fixed in version 3.8.1.
CVE-2026-107825 is an improper input validation vulnerability in Coraza WAF versions 3.0.0 through 3.7.x. The ProcessURI function fails to properly handle malformed URIs containing control bytes, causing query parameters to be omitted from internal variables while downstream integrations may still process them. This discrepancy allows unauthenticated attackers to bypass security rules targeting query parameters. The issue is fixed in version 3.8.0.
A vulnerability in MariaDB server's view FRM parser allows improper encoding of newline characters in usernames. This flaw affects multiple MariaDB versions from 10.6.1 up to but excluding 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2. An attacker with CREATE USER and CREATE VIEW WITH GRANT OPTION privileges could craft a username that embeds additional view metadata, causing the parser to misinterpret it as security metadata and potentially escalate privileges. The issue is fixed in the stated fixed versions.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-107818 is a high-severity vulnerability in MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. It involves external control of system or configuration settings via the mariadb.service unit using the /run/mysqld/wsrep-new-cluster file during service restart. A database user with FILE privilege and appropriate secure-file-priv settings could create this file and inject attacker-controlled environment variables, potentially compromising confidentiality, integrity, and availability. The issue is fixed in the stated versions.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-107816 is an out-of-bounds read vulnerability in the MariaDB server's qc_info plugin affecting multiple versions from 10.6.1 through versions prior to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The flaw occurs when a query containing embedded null bytes is cached, and subsequent reading of information_schema.query_cache_info may access memory beyond the allocated buffer, potentially disclosing adjacent memory or causing a server crash. The issue has been fixed in the specified later versions.
Threat actors are exploiting two unpatched vulnerabilities in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. The exploited flaws include a critical authentication bypass (CVE-2026-105133) and a medium-severity OS command injection (CVE-2026-105134). These vulnerabilities affect versions up to and including 10.3.4, despite fixes reportedly available in 10.3.2. Attackers chain these vulnerabilities to gain unauthorized access and execute malicious code, deploying XMRig miners disguised as legitimate services and using obfuscation techniques to evade detection. The attacks have targeted at least five organizations as of October 7, 2026. No official patch status from the vendor is confirmed at this time.
A vulnerability in GIMP's XCF loader allows a NULL pointer dereference when processing certain image parasites without verifying their presence. This can cause the application to crash when opening a specially crafted XCF file containing a zero-size simulation parasite. The issue impacts application availability but does not affect confidentiality or integrity.
A vulnerability in BusyBox's tar applet allows crafted tar archives with symlink and hardlink entries to create or replace files outside the intended extraction directory. This occurs because the deferred link-creation handling does not validate that the resolved destination remains inside the extraction directory. Exploitation with elevated privileges can lead to privilege escalation or arbitrary code execution. The issue affects multiple BusyBox versions packaged in Ubuntu and Red Hat Hardened Images. A security update is available from Red Hat to address this flaw.
pyload-ng contains an authentication bypass vulnerability in its API endpoints getUserData and get_userdata, which are accessible to any authenticated user regardless of permission level due to a flawed permission check. This allows low-privileged users to brute-force the administrator password without lockout or effective rate limiting, potentially leading to full administrative takeover.
pyLoad-ng version 0.5.0b3 (develop branch) improperly trusts the client-supplied X-Forwarded-For HTTP header to determine client IP for rate limiting and audit logging. This allows an attacker to bypass rate limits by rotating the X-Forwarded-For value on each request, and to spoof source IP addresses in security logs, undermining IP-based blocking and attribution. The server directly faces clients without a trusted proxy configuration, making the XFF header untrusted input. This vulnerability is rated medium severity.
pyLoad-ng versions up to 0.5.0b3.dev101 contain a vulnerability where revoking user privileges or changing passwords via the REST API does not invalidate the user's existing session. This allows a user to retain access with old privileges or session state despite database updates. The issue affects the session-based authentication branch, which caches roles and permissions at login and does not re-check them on each request. The API key authentication branch is unaffected. Sessions can remain valid for about a month due to the default session lifetime.
pyLoad-ng contains a vulnerability where an admin revoking or downgrading a non-admin user's permissions via the documented API does not invalidate the user's existing Flask session cookie. As a result, the demoted user retains their previous elevated permissions in their session for up to the session lifetime (~31 days) or until they log out. This stale session issue occurs because the API method that changes permissions does not clear or refresh user sessions, and no mechanism exists to update session data after login. The vulnerability affects versions from 0.5.0b3.dev98 through 0.5.0b3.dev101 and has a CVSS score of 7.5 (high severity).