Threat database

The MCP file tool in SiYuan note-taking software has an incomplete blocklist for sensitive paths compared to the HTTP file API it claims to align with. This discrepancy allows an authenticated Administrator-level MCP client to read sensitive files such as data/.siyuan/publishAccess.json, exposing plaintext passwords that protect publish-mode shared notebooks and documents. Other sensitive paths blocked by the HTTP API remain accessible via the MCP tool. This issue persists despite prior remediation for a related vulnerability and represents a scope restriction failure in the MCP tool's path resolution logic.

fpdf2 versions from 2.5.0 up to but not including 2.8.8 contain a vulnerability where nested SVG <use> references cause exponential growth in memory and CPU usage during PDF image processing. This can lead to resource exhaustion and process failure with a MemoryError. The issue arises from deep-copying referenced SVG graphics trees, allowing a crafted small SVG to consume excessive resources without external dependencies or special configurations.

fpdf2 versions prior to 2.8.8 implicitly load external HTTP(S) URLs and local filesystem image paths when rendering content via its image and HTML/SVG rendering APIs. This can lead to outbound network requests or local file access attempts if untrusted input controls image references. The vulnerability may enable Server-Side Request Forgery (SSRF) and limited local file access depending on the content. A fix is available in version 2.8.8.

A vulnerability in Grav versions 1.7.53.3 through before 1.7.53.6 allows unauthorized access to sensitive profiler data via an authorization bypass in the Debugger component. This flaw enables unauthenticated attackers to read stored records, including administrator plaintext passwords and configuration credentials, by exploiting a loopback REMOTE_ADDR fallback behind a same-host reverse proxy.

CVE-2026-117505 is a medium severity vulnerability in a2aproject a2a-java up to version 1.2.0.Final. It involves resource consumption caused by manipulation of the queue.offer function in the ChildQueue component. The vulnerability can be exploited remotely without user interaction. Upgrading to version 1.3.0.Final resolves the issue.

Google Guava versions from 4.0 up to but not including 33.7.2 contain a deserialization vulnerability in CompactHashMap, CompactHashSet, and MapMakerInternalMap. These classes read an attacker-controlled size value from a serialized stream without proper upper bound validation, leading to uncontrolled memory allocation. This can cause the Java Virtual Machine (JVM) to allocate multi-gigabyte arrays and crash with an OutOfMemoryError, even when the serialized data contains only a small number of actual elements.

KGS Software tia Viewer versions prior to 1.2.8 are vulnerable to a stored Cross-site Scripting (XSS) flaw via the annotation API. An authenticated attacker can inject malicious JavaScript into stickynote annotations, which executes when any user views the document, potentially compromising user sessions. The vulnerability has been fixed in version 1.2.8.

A malware campaign named Yoba exploits the popularity of AI tools like ChatGPT and Claude by distributing malicious installers through fake GitHub projects. These projects mimic legitimate desktop applications and use DLL sideloading with signed executables from OpenAI and Anthropic to evade security. The malware chain includes YobaDropper and YobaLoader, which deliver unwanted software such as XMRig cryptocurrency miners. The threat actor avoids traditional command-and-control infrastructure, relying instead on Telegram, Tor, Catbox, and DNS over HTTPS. The campaign appears to originate from actors in the UTC-4 timezone with possible Russian links and excludes CIS countries from infection.

Since the public disclosure of two critical PHP vulnerabilities on October 21, 2026, exploitation attempts leveraging the PHP2Shell mechanism have been monitored. Although no successful full exploit chains have been observed, private exploits exist and some tools attempt to exploit these vulnerabilities. Challenges such as request-size limits, memory exhaustion, and PHP configuration differences have hindered successful exploitation. Some tools labeled as PHP2Shell exploits actually use unrelated session poisoning techniques requiring separate vulnerabilities. Telemetry indicates a significant reduction in exposed vulnerable machines and affected organizations within one week. Despite limited success so far, PHP2Shell remains a significant security risk requiring immediate attention.

CVE-2026-118027 is a frame poisoning vulnerability in the Layout component of Mozilla Firefox. This security flaw was addressed and fixed in Firefox ESR version 115.44. The vulnerability is considered high impact by Mozilla. No public exploit or active exploitation in the wild has been reported. The fix is available in the specified ESR release.

Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

CVE-2026-118018 is a spoofing vulnerability in the Downloads component of Firefox for Android. This issue could allow an attacker to present misleading or deceptive download information to the user. The vulnerability was addressed and fixed in Firefox version 159.

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.