Craft CMS versions 5.0.0 through before 5.11.2 have a privilege escalation vulnerability allowing unauthenticated users to reclaim deactivated non-admin accounts. This enables attackers to reset passwords and inherit direct permissions, potentially leading to privileged account takeover if email verification is disabled.
Craft CMS versions from 5.7.0 up to but not including 5.11.2 contain a path traversal vulnerability allowing authenticated control panel users to read arbitrary SVG files. This occurs via the app/icon-svg endpoint, which improperly resolves supplied aliases or absolute paths without permission checks, enabling reading of any SVG-content file accessible by the PHP process, including files outside the Craft installation directory.
Craft CMS versions from 5.0.0 up to but not including 5.11.2 contain an authorization bypass vulnerability. This flaw allows anonymous GraphQL clients to access section entries that should be out of scope by chaining navigation through prev/next fields. Sensitive content such as titles, slugs, and custom fields from restricted sections can be enumerated and read by attackers. The vulnerability is rated critical with a CVSS score of 9.3. A fix is available in version 5.11.2.
Craft CMS versions from 5.0.0 up to but not including 5.11.2 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to read content from sites outside the intended GraphQL schema's Sites scope by sending a specially crafted POST request to the /actions/graphql/api endpoint. The vulnerability is fixed in version 5.11.2.
Parse Server versions 8.6.109 through 8.6.115 and 9.10.6-alpha.1 through 9.10.7-alpha.1 contain an information disclosure vulnerability. This flaw allows attackers with write access but without read access to infer whether certain protected fields are set by observing markers in create or update responses. The vulnerability was fixed in versions 8.6.116 and 9.10.7-alpha.2.
WWBN AVideo versions up to 29.7.0 contain a path traversal vulnerability in the plugin/AI/receiveAsync.json.php component. This flaw allows any user with a valid AI token to write arbitrary .vtt subtitle files by injecting directory traversal sequences into the unsanitized response[lang] parameter. Exploitation involves sending a type=translation request with a crafted lang value to place attacker-controlled subtitle files in the webroot or overwrite other users' subtitle files.
The PyPI package 'super-color' versions 0.1.0 through 0.1.3 contains malicious code that downloads and installs an infostealer. This malware hides its malicious actions within the library usage, executing a remote executable to steal information.
CVE-2026-124330 is a path traversal vulnerability in FlowCI flow-core-x affecting versions 1.23.0 through 1.23.19. It involves manipulation of the fileName argument in the LocalFileManager component, allowing remote attackers to traverse directories. The attack requires a high degree of complexity and is considered difficult to exploit. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.
Brava Security is a cybersecurity startup that has emerged from stealth mode with $15 million in funding. The company offers an AI-powered platform that simulates attacker behavior to generate telemetry resembling real attacks, helping organizations identify gaps in their security defenses. The platform integrates with existing security infrastructure without requiring changes and provides insights quickly after onboarding. This solution aims to improve detection capabilities by modeling how attacks would appear in specific environments, thereby enhancing the effectiveness of security monitoring tools.
CVE-2026-124329 is a path traversal vulnerability in FlowCI flow-core-x affecting versions 1.23.0 through 1.23.19. It occurs in the FileHelper.unzip function, allowing an attacker to manipulate file paths during the unzip process. The attack can be performed remotely but requires high complexity and is difficult to exploit. Public exploit code exists, but no vendor response or patch has been provided.
The supercolor-tui package on PyPI contains malicious code that downloads and installs an infostealer. This malware executes a remote executable to steal information, hiding its actions within library usage. Multiple versions of the package are affected.
CVE-2026-124328 is a code injection vulnerability in FlowCI flow-core-x versions 1.23.0 through 1.23.19. It affects the ConditionManagerImpl.run function in the Groovy Script Evaluation component. The vulnerability allows remote attackers to inject code by manipulating the 'condition' argument. Public exploit code has been disclosed, but the vendor has not responded or provided a fix. The CVSS 4.0 base score is 5.3, indicating a medium severity level.
CVE-2026-124326 is a path traversal vulnerability in DataLinkDC Dinky versions 1.2.0 through 1.2.5. The flaw exists in the file.getOriginalFilename function within CatalogueController.java of the Catalogue Upload component. An attacker can remotely manipulate the filename argument to perform path traversal. Exploit code has been published, but there is no indication of active exploitation in the wild. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
The RubyGem 'control-character-command-injection' version 1.0.1 contains malicious code executed during installation. This code collects sensitive host information including hostname, username, current working directory, home directory, and contents of system files such as /etc/resolv.conf, /etc/passwd, and /etc/hosts. It then sends this data via a TLS connection to an external, unauthorized server. This exfiltration occurs automatically without user interaction.
The RubyGem 'agentic-call-control' version 1.1.8 contains malicious code in its native extension script that executes during installation. This script collects sensitive host information including directory paths, hostname, login name, and contents of system files such as /etc/resolv.conf, /etc/passwd, and /etc/hosts. It then serializes this data as JSON and exfiltrates it over TLS to an attacker-controlled domain. Additionally, it performs a DNS lookup to the same domain as an out-of-band beacon. This behavior is unrelated to any legitimate build or installation process and constitutes unauthorized data harvesting and exfiltration.
The RubyGem 'dynamic-object-handler' version 1.0.1 contains malicious code in its native extension mkrf_conf.rb. During installation, it collects sensitive system information including directory paths, hostname, login name, and contents of critical system files. This data is exfiltrated via a TLS-encrypted POST request to a hardcoded Burp Collaborator subdomain, enabling out-of-band confirmation of code execution even if outbound TCP/443 is blocked.
The donjon-ledger RubyGem version 2.0.2 contains malicious code executed during installation. The gemspec declares a native extension that runs a Ruby script collecting host identifiers and sensitive system files, then exfiltrates this data over a TLS connection to a hardcoded external server. This behavior occurs automatically when the gem is installed, without any legitimate build activity.