CVE-2026-108360 is an authorization vulnerability in PHPOffice PhpSpreadsheet affecting versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. The issue arises when external image URLs are validated only initially, allowing a permitted image host to redirect the server to internal addresses, causing blind GET requests. Although the response body is not exposed to attackers, internal endpoints and cloud metadata services may be accessed. This vulnerability has a medium severity rating with a CVSS score of 6.4 and has been fixed in the specified versions.
CVE-2026-54238 is a vulnerability in Supabase Realtime prior to version 2.103.1 where expired JWT tokens with the exp claim encoded as a JSON string are incorrectly accepted by REST broadcast endpoints. This allows an unauthenticated attacker to broadcast realtime messages to subscribers. The issue is patched in version 2.103.1.
A resource exhaustion vulnerability exists in the py-pdf fpdf2 library versions 2.5.0 through 2.8.7. The issue arises from nested SVG <use> references that cause exponential growth in memory and CPU usage during PDF generation, potentially leading to MemoryError and job failures. This vulnerability is fixed in version 2.8.8.
fpdf2, a Python PDF creation library, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 2.8.8. The shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through various image input methods, potentially causing outbound requests to attacker-chosen services or local file reads if the content is a valid image or SVG. The issue is fixed in version 2.8.8.
Arista Networks patched a critical zero-day vulnerability (CVE-2026-114625) in VeloCloud Orchestrator (VCO) On-Prem deployments. The flaw allows authenticated users with basic privileges to escalate to operator-level privileges via low-complexity SQL injection attacks without user interaction. This enables access to internal functionality not intended for remote access, potentially compromising the confidentiality, integrity, and availability of the orchestrator and managed data. Hosted VCO deployments running versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later have been patched. Until patches are applied, Arista recommends restricting VCO web interface access, monitoring for suspicious activity, and blocking known malicious IP addresses involved in ongoing attacks.
CVE-2026-54532 affects CloudPirates Open Source Helm Charts, where a pull_request_target GitHub Actions workflow was vulnerable to cache poisoning and OIDC token theft. The workflow checked out forked code using untrusted references, allowing attacker-controlled code to access repository secrets and tokens. The shared Actions cache could be poisoned by this workflow, enabling malicious code execution in subsequent release or publish workflows. This vulnerability has been patched in commit 271d415.
Eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to insufficient randomness in the certificate generation process. This cryptographic weakness allows attackers to derive private keys from public certificates, enabling unauthorized TLS certificate signing and potential man-in-the-middle (MitM) attacks. Major browser and OS vendors have revoked trust in these intermediates, and eMudhra has revoked the eight compromised certificates. Organizations are advised to audit PKI assets, reissue certificates from trusted CAs, enforce strict revocation checking, and update trust stores to mitigate risk. Palo Alto Networks provides solutions and guidance to assist with managing this incident and preventing exploitation.
This analysis from Unit 42 explores the evolving threat landscape targeting OAuth authorization tokens. Attackers increasingly steal OAuth tokens rather than credentials, enabling them to bypass MFA, survive password resets, and maintain persistent access. Key vulnerabilities include Cross-User OAuth Session Fixation, Cross-Tenant Client ID Confusion, and Cross-Connector OAuth Account Takeover, especially in OAuth-as-a-service environments. These attacks allow account takeover, lateral movement, and data exfiltration without triggering traditional credential alerts. Mitigations include disabling end-user app consent for vague apps, enforcing admin-only approval workflows, monitoring authorization code clipboard events, and auditing redirect URIs. OAuth security depends heavily on the identity provider's protections, which vary widely.
Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue.
AWS remediated the issue on October 7, 2026. No customer action is required.
Pylint versions from 0.15.2 up to but not including 4.0.9 have a vulnerability where module statistics are stored in predictable cache files and loaded using pickle.load. An attacker with write access to the cache directory can replace these files with malicious serialized data, leading to arbitrary code execution with the privileges of the user running Pylint. The default per-user cache is typically not writable by others. This issue is fixed in version 4.0.9.
draw.io Desktop versions prior to 31.4.4 contain a path traversal vulnerability allowing arbitrary local file disclosure. The issue arises because several Electron main process read-side IPC handlers operate on user-chosen filesystem paths without proper authorization checks, leading to a read/write authorization asymmetry. This vulnerability is fixed in version 31.4.4.
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Write”, Classic
Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability
can lead to arbitrary
code execution. It could also impact
Confidentiality,
Integrity,
and Availability.
A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.
dnspython versions prior to 2.9.0 contain an uncontrolled recursion vulnerability in the dns.name.from_wire_parser function. This function follows DNS compression pointer chains without a hop limit, allowing a malicious DNS message to cause excessive pointer traversal. This can lead to high CPU usage, application degradation, or denial of service. The issue is fixed in dnspython version 2.9.0.
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation phase. The prior named-fragment memoization does not cover this path, so nested repeated inline fragments can drive quadratic and worst-case O(n²·m²) CPU work before any resolver or AST-based depth or complexity control runs. An unauthenticated remote attacker can submit a shallow, highly compressible GraphQL query that pins a worker process and can saturate a multi-worker service. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
A vulnerability in graphql-core, a Python GraphQL implementation, allows unauthenticated remote attackers to cause uncontrolled resource consumption. The parser's max_tokens limit does not properly account for comment tokens, which are retained in memory despite being skipped, enabling memory exhaustion before other controls activate. This issue affects versions from 3.2.3 up to but not including 3.2.12, and from 3.3.0a3 up to but not including 3.3.0rc1. The vulnerability has a high severity with a CVSS score of 7.5 and is fixed in versions 3.2.12 and 3.3.0rc1.
Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible.
A memory-related vulnerability in an upstream library used by Next.js for Image Optimization can lead to unauthenticated remote code execution (RCE) when processing SVG files on glibc-based Linux systems. This affects Next.js versions from 10.0.0 up to but excluding 15.5.28, and from 16.0.0 up to but excluding 16.4.1. The vulnerability is critical and can be mitigated by upgrading the 'sharp' library to version 0.35.5 or later, which is included in patched Next.js releases.
Microsoft is retiring the Exchange Web Services (EWS) API in Exchange Online, which causes EWS-dependent applications to stop working when the API is disabled. IT administrators can temporarily re-enable EWS to restore functionality until the final shutdown on April 1, 2027. Microsoft recommends updating or replacing applications to use the Microsoft Graph API, which offers similar features. The retirement affects only Exchange Online and Microsoft 365 environments; on-premises Exchange Server installations remain unaffected.
CVE-2026-114487 is a missing authorization vulnerability in Devolutions Server affecting versions 2026.3.5.0 through 2026.3.10.0 and all versions up to 2026.2.20.0. It allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing Active Directory providers by sending a crafted import request to the PAM AD computer import endpoint.