Threat database

CVE-2025-10248 is a stored Cross-site Scripting (XSS) vulnerability in OpenText Filr Appliance versions prior to 25.4. An authenticated user could upload a malicious file that triggers the XSS attack. This vulnerability has a high severity score of 7.2 and is fixed in version 25.4.

CVE-2026-124959 is an out-of-bounds write vulnerability in the loadIndex function of Spotify Voyager and related libraries nmslib and hnswlib. The vulnerability arises because the function does not verify that the element count in a serialized HNSW index is within the allocated buffer capacity. An attacker can craft a malicious index file with an element count exceeding the stored capacity, causing the loader to write beyond the allocated heap buffer and potentially crash the application.

PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.

CVE-2026-124850 is a SQL injection vulnerability in a database migration script of flowintel versions prior to 4.0.0. The migration process interpolates stored connector identifier values directly into SQL statements without parameterization. An attacker with prior write access to the database can plant malicious identifier values that trigger arbitrary SQL execution during an upgrade. This can lead to unauthorized data disclosure, modification, or deletion.

CVE-2026-104620 is a high-severity vulnerability in PackageKit before version 1.4.1. It involves a relative path traversal flaw in the Zypp backend's simulation of actions, which local attackers could exploit to gain root privileges.

This report summarizes every TLS certificate authority (CA) incident recorded in Mozilla's CA program from 2017 through November 2026, totaling 1,581 incidents across 108 CAs. The dataset highlights incident counts, self-reporting rates, late revocations, and slow response metrics per CA. While 2026 is the busiest year with 338 incidents, only 11 incidents are classified as critical, with eMudhra's computable keys incident being the sole case where a CA lost control of its own keys. The report provides comparative incident rates normalized by peak certificate issuance per CA, revealing significant variance in incident frequency and response quality among CAs. Some CAs have been distrusted due to their incident records. This dataset is intended for transparency and analysis of CA operational security over time.

CVE-2026-124249 is a vulnerability in Python's CPython implementation affecting the http.cookiejar.CookieJar component. The flaw allows a server to delete cookies belonging to other domains from a shared cookie jar by sending an expired Set-Cookie header with manipulated Domain and Path attributes. This occurs because the CookieJar did not consult the cookie policy before deleting cookies, violating RFC 6265 section 5.3. The issue is fixed in CPython version 3.16.0.

CVE-2026-119474 is a vulnerability in HAVELSAN Inc. Liman Render Engine versions before 1.2-81. It involves incorrect permission assignment for a critical resource, which can lead to privilege escalation. The vulnerability has a high severity score of 7.8 and affects versions from 0 up to but not including 1.2-81. A fix is available in version 1.2-81.

CVE-2026-19552 is a vulnerability in Python's ssl.get_server_certificate() function where, when the ca_certs parameter is supplied, the certificate chain is verified but the identity of the certificate is not checked. This affects CPython versions prior to 3.16.0. The issue is fixed in version 3.16.0.

CVE-2026-124636 is a path traversal vulnerability in kevquirk PureBlog versions 3.7.0 through 3.7.2. The flaw exists in the save_page function within includes/lib/content.php of the Page Editor component. An attacker can manipulate the page slug argument to perform path traversal, potentially accessing unauthorized files. Remote exploitation is possible. The issue is fixed in version 3.7.3.

Online fashion retailer Revolve experienced a data breach in September 2026 affecting over 1.5 million individuals. An unauthorized party accessed some of Revolve's systems, including its e-commerce platform, potentially using automated methods to collect customer names, contact information, mailing addresses, and stored payment card numbers with expiration dates. The breach impacted customers who had stored payment methods in their online accounts. Revolve reported the incident to federal law enforcement and engaged external cybersecurity experts for response. The company has not disclosed the exact method of intrusion, and no hacker group has claimed responsibility.

An exposure of the appliance’s confidential certificate information  vulnerability exists in HPE Morpheus manager software.

A remote code execution vulnerability exists in HPE Morpheus Software.

CVE-2026-124635 is a vulnerability in kevquirk PureBlog versions 3.7.0 through 3.7.2 affecting the admin/upload-image.php component. It allows remote attackers to perform unrestricted file uploads. The issue is resolved in version 3.7.3, which should be applied to mitigate the risk.

CVE-2026-124625 is a SQL injection vulnerability in PipraPay version 3.0.0 affecting the deleteData function in the Admin Panel component. The vulnerability arises from improper handling of the selected_ids/ItemID argument, allowing remote attackers to execute SQL injection attacks. The vulnerability has been publicly disclosed and exploit code may be available. No official response or patch has been issued by the vendor yet.

CVE-2026-121841 is a moderate impact vulnerability described as 'Other issue' in Firefox for iOS. It was fixed in Firefox for iOS version 160.0. The specific technical details of the vulnerability are not provided in the advisory.

Privilege escalation in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.

Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.

CVE-2026-16283 is an OS command injection vulnerability in Osbil Technology Ltd.'s oPanel software. The flaw arises from improper neutralization of special elements used in OS commands, allowing an attacker with limited privileges to execute arbitrary commands on the affected system. This vulnerability affects oPanel versions before 1.20.66. A fix is available starting from version 1.20.66.