Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on.
The OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.
This issue affects req_llm: from 1.9.0 before 1.29.0.
CVE-2026-95620 is a use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support within the Qt Network module. This flaw allows a malicious or compromised HTTP/2 server to cause the client application to crash, impacting availability. The vulnerability affects Qt versions from 6.9.0 up to but not including 6.11.3. The CVSS 4.0 base score is 2.1, indicating a low severity level. There are no known exploits in the wild and no patch information is provided in the input data.
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.
A China-linked advanced persistent threat (APT) group known as Storm-0940 has been using the open source AI penetration testing tool Artex to automate attacks targeting ConnectWise customers. The campaign, active since at least 2021 and intensified since September 2026, involved password spraying, OAuth application abuse, and reconnaissance at machine speed. The attackers gained privileged access to multiple Microsoft 365 tenants by abusing compromised ConnectWise application credentials. ConnectWise suspended several cloud services in response. The threat actor established persistence by modifying application credentials, enabling continued access even after remediation efforts. Hundreds of organizations across multiple sectors were targeted, including aerospace, defense, financial services, and government. Microsoft and other security firms have documented the attack techniques and recommended monitoring service principal sign-ins and directory changes for suspicious activity.
This entry is a daily podcast update from the SANS Internet Storm Center dated October 23, 2026. It does not contain specific information about a security vulnerability, exploit, or threat. The content primarily serves as a news or informational update without technical details or actionable threat intelligence.
The securityheaders.com API is no longer accepting new API keys and is effectively deprecated. Users are advised to switch to an alternative API provided by https://httpsornot.com, which offers similar functionality for checking HTTP security headers with a rate limit of 120 requests per hour per IP without requiring an API key. The new API uses a different JSON response format and grading system. This change does not represent a security vulnerability but rather a service discontinuation and migration notice.
A critical SQL injection vulnerability (CVE-2026-114625) in Arista Networks' VeloCloud Orchestrator (VCO) allows remote attackers with authenticated access to escalate privileges to operator level and access internal functionality not intended for remote use. The flaw affects on-premises VCO versions prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12. Arista has patched the vulnerability and already mitigated hosted deployments. Attackers have actively exploited this zero-day, and administrators are urged to update immediately and monitor for suspicious activity.
Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every public function in Plug.Crypto validates argument types in a function-head guard. A failed guard makes the Erlang VM raise FunctionClauseError with the actual argument values in the top stack frame, so the secret key base, a derived key, or the value an API key is compared against lands in that frame. The library's rescue blocks and Plug.Crypto.prune_args_from_stacktrace/1 only reach exceptions raised inside a function body, so they never see a guard failure. Plug.Cowboy and Bandit write the frame to the error log and attach it as crash_reason Logger metadata, which error trackers forward.
Two entry points take request data. Plug.Crypto.verify/4 exposes the secret key base when the token is neither a binary nor nil, which Phoenix.Token.verify/4 reaches because it forwards the token unguarded. Plug.Crypto.secure_compare/2 exposes the other operand when one side is not a binary, as happens when a missing request header yields nil. Reading the leaked value needs separate access to the logs or the error tracker, so the request alone does not disclose the secret to the attacker.
This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1.
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
CVE-2026-89320 is a high-severity vulnerability in Eclipse Foundation's Eclipse KeyPont - GOSE where the HmacShaCryptor.Hash function fails to hash its input and always returns the MAC of an empty message under the key. This flaw causes the authentication tag in AES-CBC-HMAC JSON Web Encryption (JWE) to be constant per key and independent of the message, effectively removing ciphertext integrity.
CVE-2026-25784 is a critical vulnerability in Hallo Welt! GmbH BlueSpice container images (versions 5.2.3 up to but not including 5.2.7). It arises from an insecure default initialization of the $mwsgTokenAuthenticatorServiceCIDR setting, which disables IP restrictions on internal service authentication if the related environment variable is unset. This allows any user with read access, including anonymous users on public wikis, to obtain an application token via the REST API and escalate privileges to sysop level.
CVE-2026-89319 is a medium severity vulnerability in Eclipse KeyPont - GOSE where the Decrypt function improperly validates a 64-bit plaintext length read from a protected header field. This can cause panics due to truncated or oversized values, leading to unbounded memory allocation or slice-bounds errors.
CVE-2026-25716 is a missing authorization vulnerability in Hallo Welt! GmbH BlueSpice affecting the BlueSpiceUserManager extension. Authenticated users without special privileges can block or unblock arbitrary user accounts, including administrators, via REST endpoints that do not verify permissions. This can lead to denial of service by locking out administrators or unauthorized removal of blocks imposed by administrators. The issue affects BlueSpice versions from 5.0.0 before 5.1.11 and from 5.2.0 before 5.2.7.
CVE-2026-89318 is a vulnerability in Eclipse KeyPont - GOSE where the Decrypt function passes an incorrectly sized initialization vector (IV) to the Go standard library's AEAD Open method without validating its length. This causes the Go library to panic, crashing the decrypting goroutine. The issue affects versions from 0 up to 1.0.0-rc4, including some release candidates. The vulnerability has a medium severity with a CVSS score of 6.9.
CVE-2026-89317 is a medium severity vulnerability in Eclipse Foundation's Eclipse KeyPont - GOSE component. The vulnerability arises because the library parses the JWS 'crit' header but does not enforce the requirement to reject tokens with unrecognized critical extensions, as mandated by RFC 7515 §4.1.11. Since GOSE implements no header extensions, any token with a non-empty 'crit' header should have been rejected but was not.
CVE-2026-89316 is a medium severity vulnerability in Eclipse KeyPont - GOSE where the function LoadPublicKey performs an unchecked type assertion on an EC key's curve. If a JSON Web Key (JWK) declares a key type "EC" but specifies a non-EC algorithm, this triggers a panic due to the unchecked assertion.
CVE-2026-89315 is a vulnerability in Eclipse KeyPont - GOSE where the JwtClaims.MarshalJSON function uses Go's reflect.StructOf to dynamically create struct fields for JWT claims. This function panics if a claim name is not a valid Go identifier or duplicates another field name, conditions which can be triggered by ordinary JWT claim names. The vulnerability affects multiple versions of the product up to 1.0.0-rc4. It has a CVSS 4.0 score of 6.9, indicating medium severity.
CVE-2026-89314 is a medium severity vulnerability in Eclipse Foundation's Eclipse KeyPont - GOSE. It involves an inefficient algorithmic complexity issue in the jwkFields.CheckConsistency function, which uses a pairwise nested loop to detect duplicate key_ops entries. This causes the validation cost to grow quadratically with the number of entries. Since this check runs on every JWK and JWKS unmarshal, a specially crafted JWKS document could cause significant CPU consumption, potentially occupying a CPU core for many seconds.
CVE-2026-89313 is a medium severity vulnerability in Eclipse KeyPont - GOSE where the function JwksTrustStore.Get incorrectly returns the last key in the JWKS document when a requested key ID (kid) is not found, instead of signaling a 'not found' error. This occurs due to the use of a named return value and a naked return statement that returns the last parsed key with a nil error. This behavior can cause callers to receive incorrect key data, potentially leading to trust or validation issues.