HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted over unencrypted connections and intercepted by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact under certain conditions.
OpenAI has released GPT-6 Cyber, an advanced AI model designed for cybersecurity tasks, which significantly improves on its predecessor GPT-5.6 Cyber in vulnerability exploitation capabilities while maintaining strict adherence to authorized testing boundaries. The model demonstrated the ability to reproduce thousands of Linux kernel vulnerabilities and generate functional privilege escalation exploits, and it identified numerous high-severity flaws in Firefox, some of which are being patched by Mozilla. OpenAI has implemented safeguards to prevent misuse, including monitoring and restrictions to avoid unauthorized exploitation of critical systems. Access to GPT-6 Cyber is currently limited to approved customers for authorized security testing.
HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff responses. This may cause content to be interpreted as an unintended type, potentially resulting in unintended behavior or security impact under certain conditions.
HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or security impact under certain conditions.
US government agencies have issued warnings urging organizations in healthcare, chemical, food, and transportation sectors to harden industrial refrigeration and cold chain monitoring systems. Recent cyberattacks in Europe targeted refrigeration controllers in supermarkets and blood banks, causing significant inventory loss and equipment hazards. Attackers manipulated temperature settings to spoil food and trigger defrost cycles, with some incidents causing fires. The threat actors may exploit vulnerabilities such as authentication bypasses, code injection, and weak configurations in internet-exposed controllers. Agencies recommend removing these controllers from internet access or protecting them with firewalls, enforcing strong authentication, and maintaining system updates and backups.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal.
This issue affects pardus-boot-repair: from 1.0.8 before 1.1.0.
Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3.
In October 2026, Ahold Delhaize, a major Dutch-Belgian grocery retailer, suffered a cyberattack that disrupted operations in the US and Benelux regions. The incident led to significant financial impacts, including an estimated reduction of €200 million to €250 million in fourth-quarter net sales and a €75 million to €100 million hit to operating income. The company temporarily disconnected some systems to contain the attack, affecting online capabilities and supply-chain operations. No evidence of data theft was reported at the time. The attack caused the company to lower its 2026 financial outlook. The specific attack type has not been disclosed.
A path traversal vulnerability (CWE-22) exists in pardus-boot-repair versions from 1.0.9 up to but not including 1.1.0, developed by TÜBİTAK BİLGEM Software Technologies Research Institute. This flaw allows an attacker to improperly access files outside the intended directory restrictions. The issue is fixed in version 1.1.0.
CVE-2026-123746 is an authentication bypass vulnerability in the Symfony Security HTTP component affecting versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. The flaw occurs because the AuthenticatorManager::authenticateUser() method does not invoke the firewall user checker's checkPostAuth() method when users are authenticated programmatically. This allows accounts rejected by custom user checkers in checkPostAuth(), such as expired accounts, to be authenticated via programmatic flows like password resets or email verification. The default user checker is not affected. The issue is fixed by dispatching the security.authentication.success event to trigger checkPostAuth() during programmatic authentication.
Apache James server versions prior to 3.9.1 contain an improper validation vulnerability in the JMAP webPush SSRF functionality that allows reaching internal addresses. This issue is fixed in version 3.9.1.
The Everest Forms plugin for WordPress, up to and including version 3.6.2, suffers from an Insecure Direct Object Reference (IDOR) vulnerability in the get_entry function. This flaw allows authenticated users with custom-level access or higher to access, read, and delete form entries belonging to other users without proper authorization. The vulnerability exposes personally identifiable information submitted through public forms. The CVSS score is 6.5, indicating a medium severity impact.
A vulnerability in the Apache James Mime4J library prior to version 0.8.15 allows denial of service due to allocation of resources without limits or throttling when parsing MIME messages. The issue is fixed in version 0.8.15 by enforcing new limits and providing better defaults.
The Live2DWebCanvas WordPress plugin versions up to and including 2.2.1 contain an arbitrary file upload vulnerability via the download_one_file function. This flaw arises from missing file extension and MIME type validation, allowing unauthenticated attackers to upload potentially executable files. Remote code execution is possible if the plugin is configured with the non-default custom-local apiType setting, which requires a paid license and exposes REST nonce and session tokens on front-end pages.
A resource allocation vulnerability exists in the Apache James Mime4J library prior to version 0.8.15 that can lead to denial of service when parsing MIME messages. The issue is addressed in MIME4J version 0.8.15, which is included in Apache James server 3.9.1.
Apache James server versions prior to 3.9.1 have a vulnerability in the SieveFileRepository component due to incorrect validation of file paths. This flaw allows authenticated attackers to perform path traversal, enabling them to set arbitrary SIEVE scripts for other users. Exploitation can lead to denial of service or interception of mail traffic. Upgrading to version 3.9.1 addresses this issue.