The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.
An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.
CVE-2026-111585 is a high-severity integer overflow vulnerability in TeamViewer's remote-control screen processing component affecting Windows, macOS, Linux, and Android clients. It allows a malicious or compromised host to send crafted screen dimension data that causes a buffer overflow in the viewer application, potentially leading to denial-of-service or arbitrary code execution on the viewer's system. Exploitation requires the viewer to establish a remote session with the attacker-controlled host. TeamViewer has released patches in version 15.83 and for multiple legacy versions to address this and related vulnerabilities.
CVE-2026-59385 is a vulnerability in Cloud Foundry's CAPI (Cloud Foundry Controller) that allows a user with SpaceDeveloper privileges to indirectly extract space-scoped broker credentials. This is achieved by modifying the URL of a space-scoped broker to redirect credentials to a broker under their control, bypassing the CF API's restriction on direct credential reading. The vulnerability affects versions prior to 1.248.0 and 60.9.0, where fixes have been applied.
Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.
CVE-2026-59386 is a vulnerability in Cloud Foundry Controller (CAPI) that allows a SpaceSupporter to escalate privileges improperly. By modifying an application's start command and buildpack—actions normally restricted to SpaceDeveloper roles—an attacker can retrieve service credentials without authorization. This flaw affects versions up to 60.9.0, where it has been fixed.
A malicious JavaScript file was found in a third-party performance monitoring integration on Polymarket. The script was designed to access authenticated trading sessions, inspect user portfolios, and transfer cryptocurrency assets to attacker-controlled addresses. It operates by reading authentication data from local storage, navigating React components to find trading functions, and creating signed messages to move assets. Polymarket has removed the compromised third-party integration. The extent of victimization and total losses are currently unknown.
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.
A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash.
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable.
Users are recommended to upgrade to 1.16.1 which fixes the issue.
Binance, the largest cryptocurrency exchange, suffered a record $6.3 billion crypto theft on October 29, 2026. The attack likely originated from a compromised DevOps engineer's laptop, allowing unauthorized withdrawal transactions without leaking wallet private keys. The attackers exploited multiple blockchains using valid signatures, indicating control over Binance's hot wallet signing system. Blockchain analysts attribute the attack with high confidence to North Korea's elite hacking unit, TraderTraitor. Approximately $3 billion of the stolen assets have been frozen by stablecoin issuers and security councils, while about $2.4 billion remain unfrozen. Binance is cooperating with law enforcement and has pledged to reimburse all losses using company funds and its Secure Asset Fund for Users (SAFU).
A critical authorization vulnerability exists in Teltonika Networks RUTOS and TSWOS devices within specified versions. An unauthenticated user can invoke LUA functions directly, bypassing normal API validation flows, potentially leading to operating system command execution. This affects multiple device models running RUTOS versions 7.22 through 7.24.2 and TSWOS versions 1.9 through 1.10.
The npm package 'claims-acct-unlock' version 25.2.1 has been identified as malicious by the OpenSSF Package Analysis project. It is flagged because it communicates with a domain linked to malicious activity and executes commands associated with malicious behavior. This package poses a security risk to users who install or use it.
CVE-2026-115455 is a vulnerability in GCC libstdc++ affecting Red Hat Enterprise Linux 10. It involves improper stack memory allocation when extracting data into a bitset from a wide-character stream, leading to a stack-based buffer overflow. This can cause a denial of service (DoS) if an attacker supplies crafted input. The vulnerability requires a specific and uncommon application design pattern to be exploitable. Red Hat's compiler stack-hardening typically causes affected binaries to abort on stack corruption, limiting the impact to DoS.
CVE-2026-114691 is a vulnerability in the libstdc++ component of GCC used in Red Hat Enterprise Linux 10. It involves an integer wrap during memory calculations when constructing a boolean vector with an excessively large element count. This leads to an inconsistent container state causing out-of-bounds memory access, which can crash the application or cause a Denial of Service (DoS). The vulnerability requires attacker-controlled input of near-maximum integer values and has a moderate impact confined to the affected process. No patch or mitigation is currently available that meets Red Hat's criteria.
A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected _wp_page_template meta key, WordPress itself supplies the chain: validate_file() accepts non-scalars, WP_Theme::__toString() then resolves an attacker-controlled path, and on hosts with a readable PEAR install and register_argc_argv enabled this yields remote code execution.
The AI Engine – MCP Server & AI Chatbot for WordPress plugin (versions up to 3.8.6) contains a missing authorization vulnerability in its MCP module's OAuth 2.1 Dynamic Client Registration endpoint. This endpoint allows unauthenticated users to register OAuth clients with attacker-controlled redirect URIs. If an administrator approves the attacker's client on the OAuth consent screen, the attacker can gain administrator-level access through the MCP tools. The consent page lacks protections against clickjacking, enabling attackers to trick administrators into approving malicious clients.
The Food Store – Online Food Delivery & Pickup WordPress plugin versions up to 1.5.5 are vulnerable to stored cross-site scripting (XSS) via the 'service_time' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a specific non-default configuration where 'Enable Checkout Service Fields' is disabled and 'Enable Pickup/Delivery Service' is enabled.
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the administrator to click the injected link in the entry detail view and confirm a dialog, which triggers the admin JavaScript bundle's delegated data-dialog-callback handler to invoke the attacker-supplied function reference.