A vulnerability in libtirpc allows a remote attacker to cause a denial of service by sending specially crafted PMAPPROC_DUMP replies to a client using the pmap_getmaps() function. This leads to unbounded decoding, resulting in excessive memory and CPU usage and crashing the client process.
A vulnerability in libtirpc allows an authenticated remote attacker to cause a denial of service by sending oversized wrapped data requests to an RPC service configured with RPCSEC_GSS integrity or privacy. This leads to unbounded memory allocation, exhausting system resources and destabilizing or terminating the service.
A heap buffer overflow vulnerability exists in the stbl_AddSize function of GPAC MP4Box version 2.4. This flaw can be triggered by processing a specially crafted MP4 file, leading to a denial of service (DoS) condition.
An integer overflow vulnerability exists in OpenModSim versions up to and including 1.11.0. This flaw can lead to a denial of service condition. No CVSS score or detailed technical information is provided. No patch or remediation details are available at this time.
ConnectWise is investigating unauthorized access attempts targeting its Cloud Backup platform, formerly known as SkyKick. The company has initiated incident response and containment measures but has not confirmed any successful data access. Third-party intelligence suggests possible compromise and lateral movement into live Office 365 environments of MSP customers. Indicators of suspicious activity include specific IP addresses and user agents. The investigation is ongoing, and no confirmed data breach has been reported yet.
CVE-2026-108372 is an origin validation error in the huangruiteng loopx project affecting versions from 0.0.1 up to but not including 0.4.5. The vulnerability allows a remote attacker to induce an operator visiting attacker-controlled web content to perform cross-origin requests to certain endpoints on the local loopx control plane. This can expose control-plane state, goal and run information, local absolute paths, private Markdown files under registered goal roots, and dry-run configuration projections. The affected endpoints do not allow cross-origin writes or arbitrary file access. The issue is fixed in version 0.4.5.
OpenHuman versions before 0.56.0 are vulnerable to a cross-site request forgery (CSRF) attack on the unauthenticated GET /auth/telegram loopback callback. This flaw allows an attacker with an OpenHuman account to trick a user running the local core into switching their active session to the attacker's backend account, exposing sensitive agent actions, memory writes, and Telegram messages. The vulnerability is fixed in version 0.56.0.
Arcane versions prior to 2.6.0 contain an incorrect privilege assignment vulnerability in the UpdateUser function. This flaw allows a user with delegated users:update permission to change the global administrator's password without proper privilege checks, enabling complete takeover of the administrator account. The issue is resolved in version 2.6.0.
CVE-2026-68498 is a high-severity vulnerability in FasterXML jackson-core affecting versions from 2.16.0 onward. It involves uncontrolled resource consumption due to improper enforcement of the maxNameLength constraint when parsing JSON property names from character-based inputs (e.g., String, Reader, char[]). This allows an attacker to cause excessive memory allocation, potentially exhausting heap memory and crashing the process. Byte-input parsers are not affected. The issue arises because the name length check is delayed until after a large buffer allocation, exceeding the intended limit. No authentication is required, and the default configuration is vulnerable.
Arcane versions prior to 2.11.0 contain an incorrect authorization vulnerability in the AuthMiddleware.managerAuth component. This flaw allows an attacker possessing a valid X-Arcane-Agent-Token to access administrator-restricted Go pprof runtime and diagnostic endpoints without proper admin checks. The vulnerability is fixed in version 2.11.0.
Arcane versions prior to 2.5.0 contain a vulnerability where an attacker with certain registry permissions can cause the system to send a stored encrypted token to an attacker-controlled registry URL. This occurs because the registry URL can be changed without requiring a replacement token, allowing the preserved token to be decrypted and exposed. This can lead to unauthorized access or tampering of container images. The issue is fixed in version 2.5.0.
CVE-2026-96542 is a vulnerability in the standalone installer for EA Javelin Anticheat on Windows that allows local non-administrative users to elevate privileges to NT AUTHORITY\SYSTEM by modifying the service configuration and executable path. This issue affects specific versions of the standalone installer and requires manual execution outside of standard game installations. The vulnerability is fixed in version 1.0.14940699 and later, with integrated EA game titles automatically repairing service permissions.
Frappe HRMS versions prior to 15.58.3 and between 16.0.0 and before 16.4.3 contain a missing authorization vulnerability in their PWA API endpoints. Authenticated users can access employee data records belonging to other employees without proper authorization. This vulnerability allows unauthorized disclosure of sensitive HR data. The issue is fixed in versions 15.58.3 and 16.4.3.
CVE-2026-55796 is an SQL injection vulnerability in the Salary Payments via ECS report of Frappe HRMS. Versions prior to 15.60.3 and between 16.0.0 and before 16.7.1 allow authenticated HR users to inject SQL via crafted report filter values. This can lead to unauthorized access to sensitive database records. The issue is fixed in versions 15.60.3 and 16.7.1.
CVE-2026-108373 is a missing authorization vulnerability in ERPNext affecting certain endpoints in the Sales Person-wise Transaction Summary report. Versions prior to 15.118.0 and between 16.0.0 and before 16.27.0 do not enforce proper authorization checks, allowing role-limited authenticated users to access financial data beyond their permissions. This issue is fixed in versions 15.118.0 and 16.27.0.
ERPNext versions prior to 15.121.0 and between 16.0.0 and 16.34.0 contain a missing authorization vulnerability. Low-privileged authenticated users can invoke certain state-changing methods without proper permission checks, allowing unauthorized data modification. This issue is resolved in versions 15.121.0 and 16.34.0.
LMCache versions from 0.3.9 up to but not including 0.5.6 have a critical unauthenticated remote code execution vulnerability in multiprocess mode via unsafe pickle deserialization on the ZeroMQ transport port (default 5555). The transport socket, used for inter-process communication, lacks authentication and deserializes attacker-controlled data using pickle.loads, allowing arbitrary code execution as the LMCache process user. By default, the transport binds to localhost, but multi-node deployments often bind to routable addresses, exposing the service. Official container images run the LMCache process as root, increasing risk. The vulnerability is fixed in version 0.5.6 by replacing pickle with a safe, versioned MessagePack format and restricting network exposure.
Suno, an AI music generator, experienced a limited security incident in late 2025 that was publicly disclosed in mid-2026. The breach involved outdated source code that is no longer in use, and the company confirmed no sensitive personal information was compromised. The incident revealed that Suno trained its AI model by scraping millions of songs and lyrics from platforms including YouTube, Deezer, and Genius. Suno is currently facing copyright infringement lawsuits from major music labels. The hacker claimed no specific motivation beyond general interest in hacking. Users are advised to be cautious if they have Suno accounts.
lopdf versions prior to 0.42.0 contain a stack overflow vulnerability in the PDF parser due to unbounded recursion when processing deeply nested PDF arrays or dictionaries. A crafted PDF with around 10,000 levels of nested arrays in the Catalog can cause the parser to exhaust the call stack and abort the process with SIGABRT, resulting in a denial of service. This vulnerability does not cause a panic that can be caught, making it effective for crashing services that parse untrusted PDFs. The issue is fixed in lopdf version 0.42.0 by enforcing a maximum object-nesting depth.