A SPARQL injection vulnerability exists in the Wikidata Lookup expansion module (wiki.py) of MISP misp-modules. Authenticated users with access to this module can inject crafted SPARQL syntax into queries sent to the Wikidata endpoint, potentially manipulating query logic or causing errors that leak internal information. The vulnerability does not directly compromise the MISP server or its stored data.
A stored cross-site scripting (XSS) vulnerability exists in the Microchip TimePictra platform that allows an authenticated, low-privileged attacker to inject malicious script content. This script executes when another user views the affected page, potentially leading to high-impact consequences.
An Incorrect Authorization vulnerability exists in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About prior to version 1.2.5, which allows privilege escalation. The vulnerability has a high severity with a CVSS score of 7.8. It affects local attack vectors with low complexity and no user interaction required, potentially leading to full confidentiality, integrity, and availability impact.
ManageEngine M365 Manager Plus versions below 4818 contain a vulnerability where an authenticated technician can exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope. This privilege escalation can lead to remote code execution during administrative processing. The vulnerability has a critical severity with a CVSS score of 9.9.
A path traversal vulnerability in Git allows an attacker to write to arbitrary files by cloning and committing to a malicious repository. This flaw could be triggered by a user interacting with a crafted repository, potentially leading to limited integrity impact without confidentiality or availability effects.
An authenticated remote code execution vulnerability exists in Zohocorp ManageEngine products including AssetExplorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus. The flaw affects versions below 7860 for AssetExplorer, below 15290 for ServiceDesk Plus, and below 15150 for both ServiceDesk Plus MSP and SupportCenter Plus. Exploitation requires an authenticated user with the Create Query Reports permission to craft malicious database queries that execute arbitrary commands on the server.
A heap-based buffer overflow vulnerability exists in the libX11 core X11 protocol client library, triggered by a malicious X server. This vulnerability is identified as CVE-2026-88806 and affects Red Hat Enterprise Linux 8.8 variants. Red Hat has issued a security advisory and released updated libX11 packages to address this issue.
CVE-2026-76173 is a blind SQL injection vulnerability in the WhatsApp module for Dolibarr version 1.9. It affects the public endpoint `public/webhook/receiver.php` where the phone number parameter from JSON input is unsafely incorporated into an SQL query. An unauthenticated attacker can exploit this with the WHATSAPP_WEBHOOK_ALLOW option enabled to extract database information or disrupt service using timing-based techniques.
A critical vulnerability in Red Hat Quay allows unauthenticated attackers to take over registry token signing, enabling them to access private container images, overwrite repositories, and maintain persistent access. The flaw affects deployments where the service managing signing keys is accessible to untrusted clients. Attackers can install malicious signing keys that survive restarts and bypass normal access controls. Disabling anonymous access or changing passwords does not mitigate the risk. Fixes were merged into the project repository on November 11, 2026, but no fixed version is yet officially released.
Fortinet has addressed multiple vulnerabilities in its FortiMail product. The specific vulnerabilities cover a range of common weakness enumerations (CWEs) including command injection, path traversal, integer overflow, and others. No detailed technical information or affected versions are provided. There is no indication of active exploitation in the wild or a CVSS score assigned yet.
CVE-2026-90908 is a critical vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro. It allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Exploitation can lead to administrative access to the MBean server and remote code execution. Azul Payara Micro is affected only if its JMX connector is enabled. Fixed versions are available.
Fortinet has addressed vulnerabilities in its FortiClient and FortiClientEMS products. Specific details about the nature of these vulnerabilities, their impact, and affected versions are not provided in the available information.
CVE-2026-110003 is a critical authentication bypass vulnerability in the administration REST interface of Azul Payara Payara Server. It allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. This bypass leads to password-based authentication succeeding without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, effectively compromising the entire server.
Multiple vulnerabilities have been addressed in various SAP products including SAP NetWeaver Application Server ABAP, SAP NetWeaver AS Java, SAP Web Dispatcher, and others. The specific affected versions are not detailed. No CVSS score or detailed impact information is provided. No known exploits in the wild have been reported.
Maersk confirmed a data theft incident involving approximately 100GB of data stolen from an IT system inherited through an acquisition. The WhiteArmor ransomware group claims responsibility and demands a $5 million ransom. The stolen data reportedly includes driver records with plaintext passwords, staff accounts including superadministrator privileges, delivery and inventory information, and mobile device logs. Maersk states the incident is isolated to a local system and has found no evidence of impact on other systems or customer operations. The investigation is ongoing, and no sensitive data disclosure has been confirmed.
CVE-2026-126642 is an authorization flaw in AWX, the automation controller component of Red Hat Ansible Automation Platform 2. It allows a user with job template administration rights to attach a webhook token credential they do not have permission to use. This can lead to disclosure of another user's personal access token when a webhook event triggers AWX to send the token to an attacker-controlled destination. The flaw impacts confidentiality but does not affect integrity or availability of the controller.
LLMjacking is a tactic where attackers hijack enterprise Large Language Model (LLM) access by exploiting exposed cloud credentials, API keys, and service account tokens. This threat has impacted organizations in financial services, retail, technology, and transportation sectors across North America, South America, and Asia Pacific. Unlike cryptojacking, LLMJacking can rapidly generate fraudulent cloud charges exceeding $100,000 per day, with cumulative costs reaching up to $1 million before access is revoked. Attackers escalate privileges and deploy proxy infrastructure to resell stolen compute capacity through underground marketplaces operated by LLM Mixers, who redistribute unauthorized model access to subscribers.
A phishing campaign impersonates purchasing team personnel with quotation inquiry emails containing compressed attachments. Extracted JavaScript files execute obfuscated PowerShell scripts that decrypt and run multi-stage payloads using AES-256-CBC and XOR encryption. The attack uses process hollowing to inject the final payload into aspnet_compiler.exe. The payload is SnakeKeylogger, an infostealer that collects browser credentials, system information, and keylogging data, exfiltrating it via SMTP or Telegram to attacker infrastructure.
A vulnerability has been fixed in the Apache HTTP Server specifically affecting the mod_http2 module versions 2.4.55 through 2.4.70 and the mod_h2 module versions 2.0.8 through 2.0.42. The issue relates to a concurrency or race condition weakness (CWE-362). No CVSS score or detailed impact information is provided.