A heap-based buffer overflow vulnerability exists in the libX11 core X11 protocol client library, triggered by a malicious X server. This vulnerability is identified as CVE-2026-88806 and affects Red Hat Enterprise Linux 8.8 variants. Red Hat has issued a security advisory and released updated libX11 packages to address this issue.
CVE-2026-76173 is a blind SQL injection vulnerability in the WhatsApp module for Dolibarr version 1.9. It affects the public endpoint `public/webhook/receiver.php` where the phone number parameter from JSON input is unsafely incorporated into an SQL query. An unauthenticated attacker can exploit this with the WHATSAPP_WEBHOOK_ALLOW option enabled to extract database information or disrupt service using timing-based techniques.
A critical vulnerability in Red Hat Quay allows unauthenticated attackers to take over registry token signing, enabling them to access private container images, overwrite repositories, and maintain persistent access. The flaw affects deployments where the service managing signing keys is accessible to untrusted clients. Attackers can install malicious signing keys that survive restarts and bypass normal access controls. Disabling anonymous access or changing passwords does not mitigate the risk. Fixes were merged into the project repository on November 11, 2026, but no fixed version is yet officially released.
Fortinet has addressed multiple vulnerabilities in its FortiMail product. The specific vulnerabilities cover a range of common weakness enumerations (CWEs) including command injection, path traversal, integer overflow, and others. No detailed technical information or affected versions are provided. There is no indication of active exploitation in the wild or a CVSS score assigned yet.
CVE-2026-90908 is a critical vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro. It allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Exploitation can lead to administrative access to the MBean server and remote code execution. Azul Payara Micro is affected only if its JMX connector is enabled. Fixed versions are available.
Fortinet has addressed vulnerabilities in its FortiClient and FortiClientEMS products. Specific details about the nature of these vulnerabilities, their impact, and affected versions are not provided in the available information.
CVE-2026-110003 is a critical authentication bypass vulnerability in the administration REST interface of Azul Payara Payara Server. It allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. This bypass leads to password-based authentication succeeding without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, effectively compromising the entire server.
Multiple vulnerabilities have been addressed in various SAP products including SAP NetWeaver Application Server ABAP, SAP NetWeaver AS Java, SAP Web Dispatcher, and others. The specific affected versions are not detailed. No CVSS score or detailed impact information is provided. No known exploits in the wild have been reported.
Maersk confirmed a data theft incident involving approximately 100GB of data stolen from an IT system inherited through an acquisition. The WhiteArmor ransomware group claims responsibility and demands a $5 million ransom. The stolen data reportedly includes driver records with plaintext passwords, staff accounts including superadministrator privileges, delivery and inventory information, and mobile device logs. Maersk states the incident is isolated to a local system and has found no evidence of impact on other systems or customer operations. The investigation is ongoing, and no sensitive data disclosure has been confirmed.
An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform. The API access classes for JobTemplate and WorkflowJobTemplate do not check the caller's Credential use_role when assigning the single-valued webhook_credential foreign key: JobTemplateAccess.can_add/can_change and WorkflowJobTemplateAccess.can_change in awx/main/access.py omit the check_related('webhook_credential', Credential, ..., role_field='use_role') call that UnifiedCredentialsMixin.can_attach performs for the normal many-to-many credentials relationship, and the serializer validates only the credential's type and namespace. A user who may administer their own job template (or workflow job template) and use its project and inventory can therefore attach a webhook token credential (for example a GitLab token) that they do not have use permission on. The template administrator can retrieve the template's webhook key; a subsequent webhook event causes AWX to decrypt the attached token and send it in the request header (for GitLab, PRIVATE-TOKEN) to a status URL derived from the event payload, disclosing the victim's token to a destination the attacker can influence. This may disclose another user's personal access token and allow whatever actions that token permits.
LLMjacking is a tactic where attackers hijack enterprise Large Language Model (LLM) access by exploiting exposed cloud credentials, API keys, and service account tokens. This threat has impacted organizations in financial services, retail, technology, and transportation sectors across North America, South America, and Asia Pacific. Unlike cryptojacking, LLMJacking can rapidly generate fraudulent cloud charges exceeding $100,000 per day, with cumulative costs reaching up to $1 million before access is revoked. Attackers escalate privileges and deploy proxy infrastructure to resell stolen compute capacity through underground marketplaces operated by LLM Mixers, who redistribute unauthorized model access to subscribers.
A phishing campaign impersonates purchasing team personnel with quotation inquiry emails containing compressed attachments. Extracted JavaScript files execute obfuscated PowerShell scripts that decrypt and run multi-stage payloads using AES-256-CBC and XOR encryption. The attack uses process hollowing to inject the final payload into aspnet_compiler.exe. The payload is SnakeKeylogger, an infostealer that collects browser credentials, system information, and keylogging data, exfiltrating it via SMTP or Telegram to attacker infrastructure.
A vulnerability has been fixed in the Apache HTTP Server specifically affecting the mod_http2 module versions 2.4.55 through 2.4.70 and the mod_h2 module versions 2.0.8 through 2.0.42. The issue relates to a concurrency or race condition weakness (CWE-362). No CVSS score or detailed impact information is provided.
CVE-2026-47832 is a vulnerability in the bosh-openstack-cpi-release component of the CloudFoundry Foundation's BOSH deployment. It involves the insertion of sensitive application credentials into log files, potentially exposing confidential information. This affects all versions from 55 up to and including 55.0.4. The vulnerability has a high severity score of 7.3 according to CVSS 4.0 metrics.
An unauthenticated SQL Injection vulnerability exists in the getVpnData function of MB connect line's mbCONNECT24 product. A remote attacker with high privileges can exploit this flaw to execute arbitrary SQL commands, potentially leading to a total loss of confidentiality. The vulnerability affects versions from 1.0.0 up to and including 2.20.0. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
CVE-2026-125836 is a Cross-Site Request Forgery (CSRF) vulnerability in the Simple JWT Login plugin by Nicu Micle. It affects versions from 0 up to and including 3.6.8. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The CVSS score is 8.8, indicating a high severity impact on confidentiality, integrity, and availability.
CVE-2026-126991 is a code injection vulnerability in the Wikidata Lookup expansion module (wiki.py) of MISP misp-modules. An authenticated user can inject SPARQL syntax into queries sent to the Wikidata SPARQL endpoint, potentially altering query logic or causing error conditions that leak internal information. The vulnerability requires authenticated access and use of the wiki expansion module. It does not directly compromise the MISP server or stored data.
Akaunting version 3.3.0 has a stored cross-site scripting (XSS) vulnerability in the invoice import feature. An authenticated user with permission to create invoices can inject HTML into an invoice status field. When another authenticated user opens the invoice edit form, the injected markup is rendered unsafely, allowing execution of attacker-controlled scripts within the Akaunting origin.
CVE-2026-82292 is a low-severity NULL pointer dereference vulnerability in the Qt Framework's QDomDocument::setContent() function within the Qt XML module (qtbase). It affects Qt versions from 4.1.0 up to but not including 6.8.9, and from 6.9.0 up to but not including 6.11.3. The flaw could cause application crashes or denial of service when processing crafted XML content. A fix is available in Qt versions 6.8.9 and 6.11.3.