Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address.
To remediate this issue, users should upgrade to version 1.166.2 or later.
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.
KNIME Business Hub versions before 1.19.0 have a vulnerability where sensitive cookies used in HTTPS sessions lack the 'secure' attribute. This omission can allow an unauthenticated remote attacker to compromise user sessions if combined with other security issues like cross-site scripting or man-in-the-middle attacks. No workaround is available for this vulnerability.
CVE-2026-115517 is a vulnerability in KNIME Business Hub versions before 1.19.0 that allows unrestricted network access between execution contexts. An authenticated remote user can access open network ports on executors in different execution contexts if the attacked executor's IP address is known and ports are open without further authentication. By default, no network ports are open, but workflows may open ports, creating an attack surface. Manual network policies can mitigate this risk.
Two unauthenticated remote code execution vulnerabilities, collectively dubbed 'php2shell', affect PHP versions since 5.4. These flaws can be triggered by a simple HTTP request and pose a critical risk to all industries running PHP applications, including popular platforms like WordPress and Drupal. Older PHP branches are end-of-life and will not receive patches, representing about half of use cases. Cisco Talos has released Snort signatures to detect exploitation attempts. Immediate upgrading to PHP 8.2 or later is strongly advised, as no patches exist for PHP 8.1 or earlier.
LiteLLM versions from 1.87.0 up to but not including 1.100.4, and certain subsequent minor versions, contain an improper privilege management vulnerability. The proxy server reuses a cryptographic context for secrets and session tokens, enabling an authenticated internal user to forge administrator credentials. This allows escalation to administrative access and execution of arbitrary commands via the MCP stdio endpoint. Early vulnerable versions require an experimental login feature enabled, while later versions are exploitable by default. The issue is fixed in versions 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.
SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access.
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
Capcom notified customers of unauthorized access to CAPCOM ID accounts but their email security configuration is weak. Their official notification emails failed DMARC alignment checks despite passing SPF and DKIM individually. Capcom's DMARC policy is set to 'p=none', which only monitors failures without requesting rejection or quarantine of unauthenticated emails. This lax configuration increases the risk of phishing and spoofing attacks impersonating Capcom. The company uses an external email delivery service but has not properly aligned authentication to prevent spoofing. The notification warns customers about potential misuse of their information but Capcom has not taken stronger email security measures to prevent secondary damage.
CVE-2026-77157 is a vulnerability in Checkmarx's ast-cli tool where downloaded helper binaries were not verified for integrity before execution. This allowed an attacker who could compromise the download server to substitute malicious binaries that would be executed on developer machines or CI pipelines using affected versions. The issue has been fixed by adding SHA-256 checksum verification of the downloaded archives prior to extraction.
CVE-2026-77156 is a path traversal vulnerability in the tar extraction logic of Checkmarx's ast-cli tool on Linux and macOS. It allows malicious tar archives with absolute or traversal paths to write files outside the intended install directory. Windows versions are not affected due to built-in path validation. Exploitation requires compromising the archive download source. The issue is fixed by validating extraction paths to ensure they remain within the working directory.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.
CVE-2026-114611 is a critical vulnerability in schorschii OCO-Server versions prior to 1.2.3 involving improper certificate validation in the Apple MDM enrollment endpoint. The vulnerability allows an attacker to forge enrollment requests using arbitrary self-signed certificates, bypassing proper certificate chain validation. This leads to issuance of a valid MDM identity certificate for a victim device, enabling device-record hijacking and impersonation of the victim device in MDM communications. Version 1.2.3 addresses this issue.
PhpSpreadsheet versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0 contain a vulnerability in the Ods::processTableRow function. This vulnerability allows an attacker to specify an unbounded number of repeated rows in an ODS spreadsheet file, causing uncontrolled resource consumption. The issue can lead to substantial CPU and memory usage, potentially terminating the PHP worker process. This vulnerability has been fixed in the stated versions.
CVE-2026-93336 is a missing authorization vulnerability in Canonical Juju versions 4.0 through 4.0.15. It allows a controller-authenticated principal, such as a unit agent or a user with only login permission, to read any application's charm resource across any model. This includes sensitive data like container-registry credentials, accessible via a crafted request specifying an arbitrary unit.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.