The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated "bootstrap" exemption so that the very first administrator can be created when the users table is empty. While the table is empty, POST /api/v1/users is exempt from authentication by design: the route handler calls warden.authenticate!(scope: :admin_api), which resolves to AdminApiToken. The inherited ApiToken#authenticate! short-circuits and returns success!() whenever msf.auth_initialized is false, without ever evaluating AdminApiToken's administrator check. In that state the endpoint creates a user — including an administrator — for an entirely unauthenticated caller.
This issue has been fixed in version 6.5.9.
Attackers leveraging Anubis ransomware targeted a U.S. organization in October 2026, deploying a previously undocumented custom backdoor named Lindnor. The backdoor masqueraded as Chrome and VMware components on Microsoft SQL Server machines. Within approximately one hour, threat actors dropped at least 13 executables designed to terminate security services, utilizing five publicly known vulnerable drivers through Bring Your Own Vulnerable Driver (BYOVD) techniques. The attackers installed AnyDesk remote access tool with Safe Mode persistence capabilities to maintain access when security software was not fully operational. Despite deploying numerous security evasion tools and establishing multiple persistence mechanisms, the file encryption payload was successfully blocked before execution. Anubis ransomware, operated by the Hawkmoth group as a ransomware-as-a-service operation, has claimed approximately 96 victims over the past year, with 52% located in the United States.
musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.
Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files.
CVE-2026-123096 is a memory exhaustion vulnerability in the anacrolix/torrent client up to version 1.61.0. It arises from the tracker/http package where malicious HTTP trackers can send unbounded announce or scrape responses. These responses are buffered without limits by Client.Announce and Client.Scrape, leading to potential process memory exhaustion and client crashes.
mpv versions from 0.29.0 up to but not including 0.42.0 contain a CRLF injection vulnerability in the bundled ytdl_hook script. This flaw allows remote attackers who control a feed or page to inject unchecked playlist entries by embedding newline characters in playlist URLs. Exploitation can bypass url_is_safe() checks to open local file URLs or av:// inputs, potentially leading to local file reading or code execution via loading shared objects through ladspa.
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.
Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.
SDL_mixer versions 3.1.2 through 3.2.4 contain a stack-based buffer overflow vulnerability in the FetchXLaw() function within src/decoder_aiff.c. This flaw arises from miscalculated output offsets when expanding A-law or mu-law audio samples, allowing an attacker to craft a malicious AIFF-C file that overwrites approximately 1 KB of adjacent stack memory during decoding. Exploitation can lead to application crashes or potentially arbitrary code execution.
SDL_mixer versions 3.1.2 through 3.2.4 have a stack-based buffer overflow vulnerability in the FetchXLaw() function when decoding A-law or mu-law WAV files. This flaw allows crafted WAV files to overwrite approximately 1 KB of adjacent stack memory, potentially causing application crashes or arbitrary code execution.
Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs.
Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded id can obtain image filenames, viewer and direct file URLs, and download private images.
fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense notes, recurrence schedules, and full user rows of participants and group members.
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.
SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries.
Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. Attackers can leverage this authentication bypass during the multi-step login process to gain unauthorized access to other user accounts, including administrative privileges, in versions from 4.1.0 through 4.20.0.
A vulnerability has been fixed in the firmware of the Zyxel GS1900-24E network switch, specifically in version 2.90(AAHK.2)C0 and earlier. The issue relates to a security flaw identified as CWE-787. No CVSS score or detailed impact information is provided.
A security flaw has been discovered in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function ConnectionManager.connect of the file im_server/app.py of the component WebSocket Connection Manager. The manipulation of the argument agent_name results in missing authentication. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-66903 is an authenticated path traversal vulnerability in Apache OFBiz's Catalog Image Management component. It allows an authenticated user to write image files outside the intended directory, potentially leading to unauthorized file writes. This issue affects Apache OFBiz versions before 24.09.08. The vulnerability is fixed in version 24.09.08.