The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable to improper server certificate validation. It registers a process-wide .NET callback that accepts any certificate for HTTPS connections without verification. This allows a man-in-the-middle attacker to impersonate the ZSIRep server and intercept or modify authentication data and documents. The callback persists after the client is closed, weakening other HTTPS connections in the same application.
The issue was fixed in version 2.12.3.1. The library is used in KS-SOMED (fixed in 2026.03.0.01), KS-PPS (fixed in 2026.03.1.0), KS-MEDIS (fixed in 2026.03.0.0), KS-SOLAB (fixed in 2026.3.1.0), and KS-ASW (fixed in 2026.3.0.1).
CVE-2026-64894 is a high-severity vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer version 1.1.0.0. It involves the inclusion of functionality from an untrusted control sphere, which can lead to a malicious software update. This flaw allows an attacker with limited privileges and user interaction to potentially compromise the system. The vulnerability has a CVSS 4.0 base score of 7.3, indicating significant impact but requires high attack complexity and privileges.
Armorsteal is a Python-based malware kit that steals sensitive data and mines cryptocurrency. It persists on infected Windows systems by installing in a hidden directory and creating scheduled tasks. The malware uses obfuscation and sandbox evasion techniques and includes modules for backdoor access, cryptocurrency mining, keystroke logging, clipboard manipulation, and credential theft from browsers, Discord, wallets, and password managers. It uses multiple command-and-control domains and disables Windows Defender to avoid detection.
CVE-2026-118514 is an incorrect authorization vulnerability in Symfony's HttpFoundation component affecting versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. The RequestMatcher and its replacement MethodRequestMatcher compare HTTP request methods verbatim, causing security rules configured for GET requests to be bypassed by sending HEAD requests. This allows attackers to trigger controller execution and access response headers despite no response body being returned. The issue also affects firewalls configured to match only GET methods, potentially allowing HEAD requests to bypass intended protections.
Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input - the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application and is identical across every installation; it contains a hard-coded secret key for entropy. Because the only input (the server name) is not secret - the instance suffix is hard-coded and the host name is discoverable via the SQL Server Browser service (UDP 1434), the TDS pre-login response, or DNS/NetBIOS - any party able to reach a Jumis SQL Server can compute the password offline and authenticate. The ##Tilde_JumisAdmin## login is a member of the sysadmin server role. Successful authentication therefore grants full administrative control of the SQL Server instance and read/write access to every customer's accounting database hosted on it. The on-premise server installation also programmatically enables xp_cmdshell during routine operation, so sysadmin access escalates to operating-system command execution on the database server.
CVE-2026-106022 is a high-severity vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer version 1.1.0.0. It involves the cleartext storage of sensitive information in memory, which could allow an attacker with limited privileges to retrieve embedded sensitive data. The vulnerability has a CVSS 4.0 base score of 8.6, indicating a significant security risk. No patch or remediation information is currently provided by the vendor.
CVE-2026-106020 is a high-severity vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer version 1.1.0.0. It involves improper neutralization of input used for large language model (LLM) prompting, which can lead to Search Order Hijacking. This flaw could allow an attacker with high privileges and partial user interaction to manipulate the LLM prompt processing, potentially impacting confidentiality, integrity, and availability of the system.
DigiCert experienced a data breach where attackers exploited a self-registration feature to create a unauthorized read-only account on an internal business system. This account accessed archived business customer contact information, including names, email addresses, phone numbers, business addresses, and in some cases, sensitive documents such as driver's licenses and passports. The breach occurred between June 27 and July 2, 2026, and was discovered and blocked on July 2. The compromised system was separate from DigiCert's certificate authority systems, which were not affected. DigiCert has since disabled the self-registration feature, reset passwords, and enhanced monitoring and permission enforcement.
HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://test) instead of an encrypted (wss://) channel. This may allow data exchanged over the connection to be intercepted or read by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://localhost:8000) instead of an encrypted (wss://) channel. This may allow data exchanged over the connection to be intercepted or read by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The redirect to the login page on logout used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 89). A second redirect to the login page in this component used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 78). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The redirect performed after registration used the value of the 'redirect' query parameter without validation, so a crafted registration link could send a user to an untrusted external site. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface (Navbar component). The switch-version action redirected the browser to a dynamically constructed URL (window origin + '/workspace') without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies. Sensitive information in cached responses may be retrieved by an unauthorized user with access to the cache, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-123653 is a medium severity vulnerability in esengine DeepSeek-Reasonix up to version 2.52.0. It affects the discoverDocs function in the internal/memory/doc.go file, where improper neutralization of input used for large language model (LLM) prompting occurs. This flaw can be exploited remotely and has publicly disclosed exploit details. Upgrading to version 2.53.0 addresses the issue.
A path traversal vulnerability in the ocaml.org website allows unauthenticated attackers to read arbitrary files on the server by exploiting the /conferences/ocaml/** endpoint. The server concatenates the raw request path to a base directory without proper validation, enabling escape from the intended directory. The server process runs as root inside a container, but the container does not contain secrets, so the live deployment has no known impact. The issue was reported on 2026-10-31 and fixed by 2026-11-02.