AdminNeo versions 4.6.0 through 5.5.0 are vulnerable to cookie attribute injection via the unsanitized X-Forwarded-Prefix HTTP header. This allows an attacker who can control or influence this header to inject arbitrary cookie attributes into all Set-Cookie response headers, including session and encryption key cookies. The vulnerability enables session hijacking, credential theft, and session fixation by manipulating cookie scope and attributes. The issue arises from concatenating the X-Forwarded-Prefix header directly into the REQUEST_URI without sanitization and manually constructing Set-Cookie headers without escaping. A fix is available in AdminNeo version 5.5.1.
AdminNeo versions prior to 5.5.1 are vulnerable to a cross-site scripting (XSS) attack due to unsanitized insertion of the MySQL server version string into a script tag with a valid Content Security Policy (CSP) nonce. An attacker controlling a reachable MySQL server can craft a malicious version string that breaks out of the JavaScript context and executes arbitrary code in the victim's browser. This vulnerability requires no authentication when combined with login CSRF. A fix is available in version 5.5.1.
AdminNeo versions prior to 5.5.1 contain a vulnerability in their SQLite interface that allows authenticated users to execute arbitrary code. The application blocks ATTACH queries to prevent arbitrary file creation, but does not block the VACUUM INTO command, which can write the entire database to an arbitrary file path. An attacker can exploit this by injecting PHP code into a table name and then using VACUUM INTO to write a web shell to the web root, enabling remote command execution.
AdminNeo versions prior to 5.5.1 have a vulnerability in their CSRF token implementation that allows an attacker who observes a single CSRF token to recover the session secret instantly and forge unlimited valid CSRF tokens. This flaw arises because the token transmits both the XOR mask and the masked value, enabling trivial secret recovery. The session token entropy is low (~20 bits), making brute-force attacks feasible even without token observation. Exploitation allows attackers to perform unauthorized SQL commands through the victim's session, including creating backdoor users and dropping tables.
Python's ssl module has been updated to include a denylist of known compromised intermediate certificates. This enhancement ensures that these certificates are automatically rejected, improving security even if certificate revocation is not configured. The vulnerability affects multiple Python versions prior to their respective fixed releases.
Parse Server versions before 8.6.101 and from 9.0.0 up to but not including 9.10.4 have a missing authorization vulnerability affecting MongoDB deployments. This flaw allows unauthenticated attackers to delete the stored schema of any class by sending REST API delete requests to the internal _SCHEMA collection. Such unauthorized deletions can remove field definitions, class-level permissions, and protected fields, potentially exposing data to unauthorized reads and modifications. The issue is fixed in versions 8.6.101 and 9.10.4.
Parse Server versions before 8.6.100 and from 9.0.0 up to but not including 9.10.4 allow clients to write reserved internal field names in object writes. This vulnerability enables attackers to disrupt object reads on MongoDB by injecting reserved fields, affecting all users querying that class. Additionally, attackers can clear their own account lockout state and password history, bypassing lockout and password policies.
Parse Server versions before 8.6.102 and from 9.0.0 up to but not including 9.10.5 contain an authentication bypass vulnerability. This occurs because custom AuthAdapter subclasses do not have their validateSetUp, validateLogin, and validateUpdate methods called, causing the system to fall back to a default that accepts any authentication data. This flaw allows attackers to supply arbitrary authentication data to sign up, link identities, log in as existing users, or bypass additional authentication factors.
Parse Server versions before 8.6.104 and 9.0.0 before 9.10.5 contain a privilege escalation vulnerability in the SMS multi-factor authentication (MFA) login process. The server saves the entire login request with master privileges when issuing an SMS MFA verification code. This allows an SMS MFA-enrolled user to modify master-key-restricted fields on their own account, such as the email-verification flag or values protected by beforeSave triggers.
Parse Server versions before 8.6.103 and from 9.0.0 up to but not including 9.10.5 contain an information disclosure vulnerability in the LiveQuery feature. The issue arises because the subscription hash omits constraints adjacent to a $or operator, causing distinct subscriptions to be grouped incorrectly. This allows authenticated clients using $or queries to receive events intended for other users, including session tokens that could be used for impersonation.
An analysis of DMARC policies for 226 large European listed companies across major stock indices found that 48 (21%) have no effective DMARC policy, allowing their corporate domains to be spoofed via email. An additional 41 companies have partial or quarantine-only policies, while 137 (61%) enforce a reject policy to block spoofed emails. The study highlights significant gaps in email domain protection among major corporations, potentially enabling email spoofing attacks that impersonate these companies' domains.
This content discusses the remastered Zero2Automated beginner malware analysis course and inquiries about updates from the researcher @0verfl0w_. The course offers a redesigned syllabus covering malware reverse engineering fundamentals and practical analysis techniques. It is a learning resource rather than a security threat or vulnerability.
The Rust compiler executable (rustc) version 1.99.0 for Windows has been flagged as malicious by multiple antivirus vendors on VirusTotal. This detection appears specific to version 1.99.0, as version 1.99.1 is not flagged. The issue was reproducible with a fresh installation of Rust 1.99.0 via rustup. The SHA256 hash of the flagged binary is FC40F1C8B65095A22A48C111AADC279C26A049B7E4161E8B99FFE3EB23873E86. No further technical details or confirmed exploits are available.
BIND 9.18 has multiple security vulnerabilities including a denial of service via unbounded processing of crafted DNS messages (CVE-2026-19630), arbitrary code execution via GSS-TSIG UDP message replay, and denial of service via assertion failures in redirect and RPZ query processing. These issues affect versions prior to 9.18.29-14.el9_8.12. A security update is available from Red Hat to address these vulnerabilities.
A critical security update for the python3-pillow library addresses multiple vulnerabilities including a heap buffer overflow in _tiffWriteProc when saving TIFF images to BytesIO (CVE-2026-112393). These flaws could lead to code execution. The update fixes these issues in version 5.1.1-36.el8_10. Users of affected versions should apply the update to mitigate the risk.
Ivanti Connect Secure has a vulnerability involving the generation of predictable numbers or identifiers that enables a remote authenticated attacker to upload files with attacker-controlled content to a known disk location. This vulnerability can be combined with other vulnerabilities (CVE-2026-104935 and CVE-2026-111357) to potentially escalate impact. It is known to be exploited in the wild.
Multiple vulnerabilities were identified in the .NET platform affecting versions dotnet8, dotnet10, and dotnet11. These include a code execution flaw in the Blazor WebAssembly debug proxy due to improper escaping, a denial of service or code execution issue in the Brotli decompression library, and a local privilege escalation vulnerability related to improper file ownership handling. Fixes have been released for these issues across various Ubuntu releases.
.NET 10.0 for Red Hat Enterprise Linux contains an elevation of privilege vulnerability in ASP.NET Core identified as CVE-2026-114148. This security issue is addressed in updated SDK version 10.0.114 and runtime version 10.0.14. The vulnerability affects multiple .NET versions including 8.0, 9.0, 10.0, and 11.0. Red Hat has released patches to fix this important security flaw.