CVE-2026-115905 is a critical vulnerability in the zip-rs zip2 Rust library affecting versions prior to 9.0.5. The flaw arises from inconsistent handling of filenames between the Central Directory File Header and the Local File Header during ZIP archive extraction. This discrepancy allows a crafted archive to appear safe when inspected via the central directory but to cause a streaming extractor to write files to attacker-chosen paths, potentially overwriting important files used by downstream services. The issue is fixed in version 9.0.5.
CVE-2026-71456 is a vulnerability in Johnson Controls Kantech Entrapass before version 9.20 involving the use of a hard-coded cryptographic key. This flaw enables a Padding Oracle Crypto Attack, compromising cryptographic security. The issue is fixed in version 9.20.
CVE-2026-71455 is a vulnerability in Johnson Controls Kantech Entrapass before version 9.20 that involves cleartext storage of sensitive information in memory. This flaw allows retrieval of embedded sensitive data, potentially exposing confidential information. The vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in version 9.20.
Pyrus Sync for Windows has a local privilege escalation vulnerability due to missing authorization controls in its PyrusSyncService Windows service. This flaw allows an attacker with unprivileged access to create files via the ISyncService contract, potentially escalating their privileges on the affected system. The vulnerability affects versions prior to 1.8.745.0, which contains the fix.
CVE-2026-116370 is a type confusion vulnerability in the loadstring function of the Lua sandbox component in 2K Games Sid Meier's Civilization IV version 1.0.12.68. This flaw can be exploited remotely and has publicly available exploit code. The vulnerability has a medium severity rating with a CVSS score of 5.3.
This report summarizes multiple cyber threats and incidents observed in late October 2026, including large-scale breaches, supply-chain attacks, AI-enabled cybercrime tools, and critical software vulnerabilities. Notable incidents include a cyberattack on Japanese cloud provider Onamae Desktop Cloud affecting over 26,000 servers, a data breach at India's State Bank of India exposing nearly 3,900 customer records, and a supply-chain compromise of the LiteLLM AI gateway. AI-enabled tools are facilitating large-scale fraud and ransomware attacks targeting critical sectors in the United States. Critical PHP vulnerabilities enabling remote code execution are being widely exploited, with most instances unpatched. Oracle and GitLab have released patches for numerous critical vulnerabilities, including a critical remote code execution flaw in GitLab and a privilege escalation vulnerability in Arista VeloCloud Orchestrator that has been exploited in the wild.
CVE-2026-82390 is a low-severity vulnerability in the Zephyr project's Espressif AES driver that causes a race condition in multi-session cipher operations. The driver incorrectly programs hardware key registers outside a mutex lock, allowing operations from one session to use the key and direction of another session. This leads to cryptographic failures where data intended to be protected under one key is processed under another, potentially exposing plaintext if the attacker controls the second key. The issue affects applications using two or more concurrent sessions with different keys, which is not the case for in-tree Zephyr subsystems. The fix involves reprogramming the key and direction inside the mutex lock at each operation to prevent stale register usage.
CVE-2026-82389 is a memory-safety vulnerability in the Zephyr Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) role. It occurs when a failed RFCOMM connection triggers cleanup that zeroes linked SDP client request nodes still in use, leading to dereferencing of null pointers and potential Bluetooth stack crash or hang. The flaw affects Zephyr versions from 4.4.0 up to but not including 4.5.0 and requires Bluetooth Classic and HFP AG configurations. The vulnerability does not allow attacker-controlled memory writes but results in denial of service via stack crash or hang.
CVE-2026-82388 is a use-after-free vulnerability in the Zephyr project's Bluetooth Hands-Free Profile (HFP) implementation. It occurs when a failure in RFCOMM connection triggers premature zeroing of an HFP object still linked in the SDP client's request list, leading to dereferencing null pointers and a self-referential list. This results in a denial of service due to faults or hangs in the Bluetooth host thread. The flaw affects Zephyr versions from 4.4.0 up to but not including 4.5.0 and requires both CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF to be enabled. A fix is available in version 4.5.0.
CVE-2026-19742 is a vulnerability in the Zephyr project's IPv6 stack where the long-lived secret key used for generating stable and temporary IPv6 interface identifiers is derived from a non-cryptographically secure random source. This allows an attacker observing device traffic to recover the key and predict or track IPv6 addresses, undermining privacy protections. The issue affects Zephyr versions from 3.7.0 up to but not including 4.5.0. A fix is available in version 4.5.0, which uses a cryptographically secure random source and aborts generation if unavailable.
CVE-2026-81038 is a vulnerability in the Zephyr project's Object Transfer Service (OTS) server affecting versions 3.3.0 through 4.4.2. It involves an information leak due to uninitialized stack memory disclosure when handling the Object Action Control Point (OACP) response indication for checksum calculation requests. The flaw allows any nearby peer to trigger this leak without authentication. On assertion-enabled builds, it can cause a device panic leading to denial of service. The vulnerability has a high severity score of 7.1.
CVE-2026-81039 is a denial-of-service vulnerability in Zephyr's Bluetooth host stack affecting versions from 2.3.0 up to but not including 4.5.0. It arises when multiple connectable extended advertising sets run on the same identity, causing a mis-attribution of connection reservations. This leads to permanent consumption of connection slots until reboot or disabling Bluetooth, resulting in failure to accept new connections. The issue impacts availability only and does not cause memory corruption or data leakage.
CVE-2026-116369 is an OS command injection vulnerability in Sunwood-ai-labs github-kanban-mcp-server versions up to 0.4.0. The flaw exists in the handleListIssues function of src/handlers/issue-handlers.ts, where manipulation of the state or labels argument can lead to command injection. The vulnerability can be exploited remotely. Upgrading to version 0.4.1 addresses this issue.
CVE-2026-116394 is a medium severity vulnerability in Magepeople inc.'s WpEvently plugin (up to version 5.7.9) that allows improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue. This vulnerability enables code injection via crafted input. A fix is available in version 5.7.10.
Mattermost versions 11.7.0 through 11.7.10 contain an authorization flaw where the API does not properly restrict which built-in roles a team admin can assign to team members. This allows a team admin to grant permissions beyond the configured permission scheme via the update-team-member-roles REST API endpoint. The vulnerability has a low severity rating with limited impact on confidentiality and integrity.
Syncplify Server! versions prior to 8.8.0 contain a path traversal vulnerability due to improper link resolution before file access. This flaw allows attackers who can place symbolic links or directory junctions inside a user's home folder to access files outside the intended virtual filesystem root. The vulnerability arises because confinement checks are performed on the requested path rather than the actual on-disk target of the link, enabling unauthorized file access beyond the home-folder boundary.
Syncplify Server! versions prior to 8.8.0 have an access control bypass vulnerability due to improper resolution of path equivalence. Authenticated SFTP users can bypass per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names, allowing unauthorized file uploads and downloads. This vulnerability is fixed in version 8.8.0.
Multiple security vulnerabilities have been identified and fixed in the libxml2 library used in Red Hat Enterprise Linux 9.6 Extended Update Support. These include denial of service, arbitrary code execution via various buffer overflow and use-after-free flaws, data integrity issues due to integer overflow, information disclosure, SSRF, and double-free/use-after-free in Python bindings. The update synchronizes release versions across several RHEL releases and addresses these critical security issues.
CVE-2026-115680 is an out-of-bounds read vulnerability (CWE-125) affecting Arm Keil MDK-Middleware versions 8.0.0 through 8.3.0. The flaw involves DHCPv6 Option processing, which may lead to over-reads of memory and unintended data retransmission. The vulnerability has a medium severity with a CVSS score of 6.5. No public exploits or patches are currently documented.
A heap buffer overflow vulnerability exists in the RainerScript replace() function of the rsyslog daemon, which can lead to a denial of service condition. This issue affects Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related variants. Red Hat has issued a security update to address this vulnerability.