CVE-2026-18390 is an OS command injection vulnerability in the Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows, Linux, and iOS platforms. It affects versions before 5.4.20 and 5.4.21. The vulnerability arises from improper neutralization of special elements used in OS commands, allowing potential command injection. The CVSS 3.1 score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, so patch status is not confirmed.
Ahold Delhaize, a major global food retail chain, experienced a cybersecurity incident that forced it to take some systems offline. The incident disrupted employee access to schedules and pay stubs and affected customer-facing websites, apps, and service platforms in several countries. Despite the disruptions, stores remain open and operational. The company is actively working to assess and mitigate the issue. This follows a previous ransomware attack in 2024 that compromised personal and financial data of over 2.2 million individuals.
CVE-2026-108893 is a critical stack-based buffer overflow vulnerability in the Linksys E1700 router firmware version 1.0.0.4.003. The flaw exists in the setVlan function within the /goform/setVlan endpoint, where improper handling of the vlan_set argument allows remote attackers to trigger a buffer overflow. Exploit code is publicly available, increasing the risk of exploitation. The vendor has not responded to disclosure attempts, and no patch or mitigation guidance is currently available.
LogicalDOC Community Edition versions up to 9.3 contain a username enumeration vulnerability via the AvatarServlet endpoint. This flaw allows unauthenticated attackers to supply usernames or numeric IDs to the userId parameter and observe differences in returned avatar images, enabling them to confirm valid user accounts and retrieve profile pictures. The vulnerability does not require authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity.
LogicalDOC Community Edition versions up to 9.3 contain an unauthenticated file upload vulnerability in the UploadServlet. This flaw allows remote attackers to upload files repeatedly without a session, causing uncleaned temporary files to accumulate and potentially exhaust server disk space. The vulnerability has a high severity score of 8.7 and does not require user interaction or privileges.
LogicalDOC Community Edition versions up to 9.3 have an improper authorization vulnerability in the password recovery mechanism. The PswRecovery servlet does not properly bind password recovery tickets to the requesting user, allowing attackers to reuse tickets across different user accounts, including administrators. This can enable attackers to reset passwords, lock out users, and reveal email addresses.
LogicalDOC Community Edition versions up to 9.3 have a missing authorization vulnerability in the ConvertPdf servlet. Authenticated users can exploit this flaw to download restricted PDF documents by enumerating sequential document IDs and using the version parameter to access PDFs and their versions from folders they should not have access to.
LogicalDOC Community Edition versions up to 9.3 contain a missing authorization vulnerability in the zip-export servlet. Authenticated users can exploit this flaw by supplying a folderId parameter to export restricted folders without proper permission checks. This allows unauthorized downloading of all documents within those folders as a ZIP archive.
LogicalDOC Community Edition versions up to 9.3 have a missing authorization vulnerability in the SoapDocumentService operations. Authenticated users can exploit this flaw to access and modify documents they are not authorized to handle by invoking certain SOAP or REST document service operations with sequential document IDs. This can lead to unauthorized disclosure, deletion, or tampering of documents.
LogicalDOC Community Edition versions up to 9.3 contain a server-side request forgery (SSRF) vulnerability in the default-enabled XMLConverter component. Authenticated users can upload XML documents with stylesheet href attributes that reference internal URLs using http, ftp, file, or jar schemes. This allows the server to make unintended requests and apply attacker-controlled XSLT during document conversion, potentially leading to unauthorized internal resource access or manipulation.
LogicalDOC Community Edition versions up to 9.3 contain a code injection vulnerability that allows authenticated users to execute arbitrary OS commands. This is achieved by submitting malicious Velocity templates in the DocumentService.sendAsEmail subject or message fields, enabling attackers to bypass runtime usage restrictions and execute commands with the privileges of the LogicalDOC process.
LogicalDOC Community Edition versions up to 9.3 contain an HQL injection vulnerability in the DocumentsDataServlet component. Authenticated users with read access to any folder can exploit this flaw by manipulating the 'indexed' parameter, allowing them to inject boolean HQL expressions. This bypasses folder scope and read-permission checks, enabling unauthorized listing of restricted document metadata and extraction of database contents. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.1.
LogicalDOC Community Edition versions up to 9.3 contain a SQL injection vulnerability in the TagsDataServlet component. Authenticated low-privileged users can exploit this flaw by injecting crafted SQL via the firstLetter parameter, enabling them to retrieve sensitive information such as usernames, email addresses, and password hashes. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.1.
CVE-2026-108892 is a critical stack-based buffer overflow vulnerability in the Linksys E1700 router version 1.0.0.4.003. The flaw exists in the ssid1MACFilter function of the Mac Filter component, triggered by manipulation of the newap_text_%d argument. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed, but no vendor response or patch has been provided.
GitLab has disclosed a critical remote code execution vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler. This flaw arises from an integer overflow that allows unauthenticated attackers to execute arbitrary code on affected GitLab servers by submitting specially crafted regular expressions in pipeline configuration files. The issue affects GitLab Community Edition and Enterprise Edition versions prior to 19.2.8, 19.3.4, and 19.4.2. GitLab has released patches for these versions and urges immediate upgrading. GitLab.com and GitLab Dedicated customers are already protected. No exploit details or active attacks have been reported yet.
Funhouse ransomware, distributed by a North Korean threat actor linked to Kimsuky, uses malicious Korean-language resume documents to infect targets. It is a variant of the Endpoint ransomware family, employing multi-stage scripts (Batch, VBS, PowerShell) to install Quasar RAT before deploying ransomware. The campaign shows strong similarities to earlier Kimsuky Endpoint operations, with updates in encryption extensions, contact info, and command-and-control infrastructure. The initial infection vector shifted from LNK files to HWP documents. No known exploits in the wild or patches are applicable as this is malware distribution.