CVE-2026-105822 is a server-side request forgery (SSRF) vulnerability in the Tapo Cloud MQTT proxy of TP-Link Systems Inc. The vulnerability arises because the service accepts a user-controlled host value without sufficient validation. Exploitation can cause the Tapo Cloud service to send requests to attacker-controlled servers, potentially exposing internal information and enabling distributed denial-of-service (DDoS) attacks.
CVE-2026-105821 is a broken access control vulnerability in the Tapo Cloud MQTT broker used by TP-Link Systems Inc. The flaw allows an authenticated Tapo device owner to request service tokens for other devices by supplying their device IDs without proper authorization checks. Exploiting this, an attacker can upload malicious content to another user's Tapo Cloud storage, which may then appear as legitimate events in the Tapo app. This vulnerability also enables retrieval of internal service information and potential abuse of outbound request capabilities, possibly impacting service availability.
A path traversal vulnerability (CWE-22) exists in isomorphic-git versions prior to 1.38.6. The tree parser in src/models/GitTree.js improperly accepts standalone '..' entries, allowing malicious remote repositories to write files outside the working directory during clone or checkout operations. This can lead to arbitrary file overwrite and potential code execution. The issue is fixed in version 1.38.6. GitHub-hosted repositories are not affected due to their integrity checks rejecting '..' entries.
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid from DFIQ YAML through POST /api/v2/dfiq/from_yaml, and core/web/apiv2/dfiq.py later interpolates that stored value into an archive filesystem path in POST /api/v2/dfiq/to_archive. A low-privileged authenticated user can import a DFIQ object whose UUID contains traversal sequences and trigger archive export, causing attacker-controlled content with a .yaml suffix to be written outside the intended temporary archive directory. The impact is limited by paths writable by the YETI service account, and the separate DFIQ archive-import zip-slip candidate is not part of this vulnerability. This issue is fixed in version 2.5.1.
CVE-2026-120567 is a vulnerability in the MongoDB Entity Framework Core provider where special elements in user-supplied data are not properly neutralized during bulk update operations. This flaw can cause unintended modifications to fields within database records, potentially relocating existing data into incorrect fields. The issue affects specific versions of the provider and has a low severity rating based on CVSS 4.0 metrics.
Yeti-platform versions up to 2.5.0 contain a path traversal vulnerability in the ExportTask functionality. A low-privileged authenticated user can exploit this by submitting a crafted task name that includes traversal sequences, allowing unauthorized reading of files accessible to the Yeti service account and writing export output to attacker-controlled writable paths. The vulnerability is fixed in version 2.5.1.
CVE-2026-93325 is a vulnerability in Docker Buildx where the protection mechanism requiring user consent before allowing builds to access paths outside the working directory can be bypassed when using the --progress=rawjson option. This causes the consent step to be skipped, potentially allowing unauthorized access during the build process. The issue affects Docker Buildx versions from 0.21.0 up to but not including 0.37.2 and has been fixed in version 0.37.2.
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a route-level authentication check for /api/v2/audit/timeline/{id}. An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields, including analyst usernames, object identifiers and values, and before-and-after object data. This exposes the operational history of threat-intelligence objects while other application routers require authentication. This issue is fixed in version 2.5.1.
Yeti-platform versions 2.5.0 and earlier contain an injection vulnerability in the way user-controlled sorting fields and filter_aliases are handled in ArangoDB AQL queries. Authenticated low-privileged users can craft inputs to manipulate query logic, potentially exposing internal data and causing resource exhaustion. No fix is currently available.
ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to createImageDataBitDepth. An attacker who can supply a PSD to an application with layer decoding enabled can use attacker-controlled layer dimensions to trigger an allocation larger than the configured limit, causing process memory exhaustion and denial of service. The advisory also identifies inflateSync(compressed) decompressing ZIP-encoded channel data without an output-size cap, which can cause a similar denial of service through unbounded decompression. This vulnerability is fixed in 31.0.1.
The filipt package on PyPI contains malicious code that executes during installation by overriding the install command in setup.py. This behavior has been identified as malware, specifically a remote access trojan (RAT), by multiple security vendors. The affected versions are 0.1.0 through 0.1.5. There is no CVSS score available for this threat.
CVE-2026-110826 is a vulnerability in team-alembic's ash_authentication component where session tokens are not properly invalidated after a user changes or resets their password. This allows an attacker holding a victim's session token to remain signed in despite the password change. The flaw arises because the condition to revoke tokens is evaluated before the new password hash is set, causing token revocation to be skipped in non-atomic password change actions. The issue affects versions from 4.5.0 up to but not including 4.15.1 and from 5.0.0-rc.0 up to but not including 5.0.0-rc.16. Fixed versions are 4.15.1 and 5.0.0-rc.16.
fastapi-code-generator versions prior to 0.8.1 contain a code injection vulnerability due to improper escaping of OpenAPI paths in generated route decorators. This allows attacker-controlled input to inject Python code that executes with the application's privileges when the generated module is imported. The issue is fixed in version 0.8.1.
CVE-2026-63469 is a critical code injection vulnerability in koxudaxi fastapi-code-generator versions prior to 0.8.1. The tool generates FastAPI applications from OpenAPI files and improperly inserts response status-code keys as single-quoted Python strings without escaping embedded quotes. This allows an attacker to inject arbitrary Python code if they control or influence a secondary response key in a multi-response operation. The injected code executes with the privileges of the application or CI process importing the generated module. The issue is fixed in version 0.8.1.
fastapi-code-generator versions prior to 0.8.1 contain a code injection vulnerability where unescaped triple quotes in Operation.summary allow injection of Python code into generated route-handler docstrings. This can lead to execution of attacker-controlled code with server process privileges when the affected route handler is invoked. The issue is fixed in version 0.8.1.
CVE-2026-112917 is a critical vulnerability in Docker Desktop for Windows using the WSL2 backend. It allows an unprivileged Linux container to bypass seccomp restrictions on AF_VSOCK via 32-bit socketcall, potentially exposing host-facing services and Windows files accessible to the logged-in user. This affects x86-64 WSL2 environments, while LinuxKit-based backends are not impacted. The vulnerability is fully fixed in Docker Desktop 4.98.0 or later combined with WSL 3.0.3 or later. Running Docker Desktop 4.98.0 or later on older WSL versions remains vulnerable.
CVE-2026-121501 is a session fixation vulnerability in the mathurvishal CloudClassroom-PHP-Project. It affects the session_regenerate_id function in loginlinkadmin.php, allowing remote attackers to manipulate the PHPSESSID argument to fixate a session. The vulnerability has been publicly disclosed, but the vendor has not responded or provided any patches. No versioning information is available for this product.
CVE-2026-121652 is a stored cross-site scripting (XSS) vulnerability in the AWS Amplify library maplibre-gl-js-amplify, which integrates Amazon Location Service with MapLibre GL JS. The flaw affects popup and geofence-control rendering, allowing malicious scripts to be stored and executed in web applications using versions up to 4.0.2.
This is an announcement for an upcoming Ask Me Anything (AMA) event featuring Mike Kosak, Director of Threat Intelligence and Response at LastPass. The event will focus on the evolving role of AI in cybersecurity, discussing AI-driven threats, how attackers use AI, and related topics. No specific vulnerability or threat is described.
A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required.