QloApps versions up to 1.7.0 have an insecure direct object reference vulnerability in several back-office AJAX handlers. This flaw allows hotel-restricted employees to bypass hotel access checks by supplying other hotels' identifiers, enabling unauthorized reading, uploading, and deletion of booking documents, as well as deletion of rooms and images.
Square Squash version 0 contains a critical insecure deserialization vulnerability. Unauthenticated attackers can submit crafted YAML data to the POST /api/1.0/symbolication endpoint. When the system processes symbolication requests referencing attacker-controlled UUIDs, it deserializes this data unsafely using YAML.load with SafeYAML in unsafe mode. This allows arbitrary Ruby object deserialization, potentially leading to remote code execution.
CVE-2026-108899 is a medium severity vulnerability in tobychui zoraxy up to version 3.3.4. It involves improper authorization due to manipulation of the PathPrefix argument in the handleBasicAuth function within the Path Exception Matcher component. This flaw can be exploited remotely without authentication. An exploit has been published. Upgrading to version 3.3.5-rc1 resolves the issue.
CVE-2026-92681 is a critical vulnerability in @neo4j/graphql versions from 3.23.0 up to 7.6.3. It involves missing authentication enforcement for top-level fields annotated with @cypher when @authentication directives are applied at the schema or type level. This flaw allows unauthenticated users to invoke these fields and execute Cypher statements with the privileges of the GraphQL service account, potentially leading to unauthorized data reading and modification. The issue is fixed in version 7.6.4.
CVE-2026-92682 is an authorization vulnerability in @neo4j/graphql versions 7.0.0 up to but not including 7.6.4. The issue arises because the 'none' quantifier in @authorization filters on relationships and connections is not properly negated when translated to Cypher queries, causing it to behave like 'some'. This flaw allows authenticated users who should be denied access to read, create, or delete sensitive data. The vulnerability is fixed in version 7.6.4.
CVE-2026-108898 is a cross-site scripting (XSS) vulnerability in the Wireless Settings component of the Netis WF2409E router firmware version 3.3.42541. The vulnerability arises from improper handling of the SSID argument, allowing remote attackers to inject malicious scripts. The exploit code is publicly available, but no vendor response or patch has been provided.
CVE-2026-108897 is a medium severity vulnerability in the SHAREit App version 6.27.38_ww for Android by Smart Media4U Technology. It involves an exposed dangerous routine in the syncInvoke function of the WebView JS Bridge component. The vulnerability can be exploited remotely without user interaction. The vendor has not responded to the disclosure, and no patch or fix information is available. Public exploit details have been disclosed but no known exploitation in the wild is reported.
CVE-2026-108896 is a critical OS command injection vulnerability in the Linksys E1700 router firmware version 1.0.0.4.003. It affects the setLinksysIpv6 function in the /goform/setLinksysIpv6 endpoint, where manipulation of the _6rd_prefix or _6rd_prefix_len arguments allows remote attackers to execute arbitrary OS commands. The vulnerability can be exploited remotely without user interaction and has a high CVSS 4.0 score of 9.4. The vendor was notified but has not responded or issued a patch. Public exploit code is available, increasing the risk of exploitation.
IonQ announced its plan to acquire Elisity, a zero trust security firm specializing in least-privilege access technology, in an all-stock deal valued up to $1.3 billion. Elisity's software restricts communication on enterprise networks based on least-privilege policies, integrating identity, asset, and risk data to guide access decisions. IonQ aims to leverage Elisity's technology and customer relationships to enhance its security portfolio, particularly in post-quantum cryptography and quantum key distribution. The acquisition is expected to close in Q4 2026, with Elisity's management remaining in place. This announcement is a business transaction and does not describe a specific security vulnerability or threat.
CVE-2026-92877 is a high-severity vulnerability in the Eclipse Foundation's jaxb-ri (core) component. It involves XML External Entity (XXE) injection due to reliance solely on the FEATURE_SECURE_PROCESSING flag to prevent external entity resolution. On some JAXP implementations where this feature does not fully block external entity resolution, attackers can exploit untrusted XML unmarshalling to read local files via out-of-band XXE.
CVE-2026-108895 is a critical OS command injection vulnerability in the Linksys E1700 router firmware version 1.0.0.4.003. The flaw exists in the setDMZ function of the /goform/setDMZ file, where manipulation of the MAC_addr argument allows remote attackers to execute arbitrary OS commands. The vulnerability is remotely exploitable without user interaction and has a high CVSS 4.0 score of 9.4. Public exploit code is available, but no vendor response or patch has been provided.
SGLang versions up to 0.5.21 have a denial of service vulnerability caused by disabling Pillow's decompression bomb protection. This occurs because the Image.MAX_IMAGE_PIXELS setting is set to None in NanoNemotronVLImageProcessor, allowing remote attackers to submit small but highly compressed images with very large dimensions. This can exhaust worker memory during image decoding, leading to denial of service.
SGLang versions up to 0.5.21 have a resource allocation vulnerability allowing remote attackers to bypass video processing limits by manipulating parameters in the video_url object. This can cause excessive memory consumption and denial of service.
SGLang versions up to 0.5.21 have a vulnerability in the preprocess_video function of qwen_vl.py that allows unbounded memory allocation. This occurs because frames are decoded at full source resolution before max_pixels limits are applied. Remote attackers can exploit this by submitting high-resolution videos to the /v1/chat/completions endpoint, causing concurrent requests to exhaust worker memory and result in denial of service.
SGLang versions up to 0.5.21 have a vulnerability in the load_audio function where highly compressed audio data can be decompressed into very large PCM buffers without limits on duration or sample size. This allows remote attackers to cause denial of service by exhausting memory and CPU resources.
SGLang versions up to 0.5.21 have a vulnerability allowing unauthenticated remote attackers to exhaust server memory by uploading oversized files to the /v1/audio/transcriptions endpoint. This leads to denial of service by crashing the HTTP/tokenizer worker due to unbounded memory allocation.
CVE-2026-12613 is a high-severity vulnerability in the Ministry of Justice General Directorate of Information Technology UYAP Document Editor affecting Windows, Linux, and MacOS versions prior to 5.4.20 and 5.4.21. It involves deserialization of untrusted data, which allows object injection. The vulnerability has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability. No explicit patch or remediation details are provided in the available data.
CVE-2026-108894 is a critical OS command injection vulnerability in the Linksys E1700 router version 1.0.0.4.003. The flaw exists in the addStaticRoute function of the Static Route Handler component, where manipulation of certain arguments can lead to remote command execution. The vulnerability allows an attacker to execute arbitrary OS commands remotely without user interaction. The exploit code has been publicly released, increasing the risk of attacks. The vendor has not responded to disclosure requests, and no patch or mitigation guidance is currently available.
AvisLoader is a newly identified Windows malware loader that employs encrypted peer-to-peer communications to protect its command-and-control infrastructure from disruption. It uses ClickFix delivery methods, shortcut-based persistence mechanisms, and supports remote command execution. This design aims to enhance the malware's resilience and operational stealth.