Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.py uses _is_bad_path to validate safe_extractall targets by comparing resolved path strings with startswith instead of comparing path components. A course author or staff user with course import permission can submit a crafted .tar.gz archive through the import_olx flow initiated by cms.djangoapps.contentstore.views.import_export.import_handler. An archive member can therefore escape into a sibling course staging directory whose name shares the attacker's base64 directory prefix, causing limited cross-tenant file corruption. Zip archives are not practically affected because ZipFile.extractall strips parent traversal segments, and the advisory does not establish arbitrary filesystem writes, file reads, or direct code execution. This issue is fixed in Ulmo and Verawood.1.
A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass.
A Microsoft update (KB5002914) released in September 2026 caused copy-and-paste functionality to fail silently in Excel across multiple versions, including Excel 2016, 2019, 2021, 2024, and Excel Online. Microsoft identified this as a code regression and released a fix (KB5002655) that resolves the issue only for the Microsoft Installer (.msi)-based edition of Office 2016. Other Excel versions remain affected, with Microsoft recommending workarounds such as using the Paste Special option. Uninstalling KB5002914 restores functionality but removes important security patches.
MapServer versions from 6.0 up to 8.6.4 have a vulnerability in the OpenLayers HTML output for WMS GetMap requests with application/openlayers format. The vulnerability allows an attacker to inject arbitrary JavaScript by manipulating the X-Forwarded-Host HTTP header when the deployment trusts this header and does not set fixed online resource values. This can lead to cross-site scripting (XSS) attacks, enabling session token theft and unauthorized actions in the context of the victim's browser. The issue is fixed in version 8.6.4.
An Israeli influence-for-hire company called BlackCore has been identified conducting digital manipulation campaigns across multiple countries. The company operates through a sophisticated infrastructure offering services including discourse dominance, organic engagement manipulation, and counter-operations. Researchers identified a specific campaign involving a 14-week training program delivered to Angolan government employees in early 2026, which included the creation and deployment of fake social media personas and coordinated inauthentic behavior. The operation utilized AI-generated profile pictures, fake news outlets like 'Agita News', and coordinated amplification tactics across Facebook, Instagram, and TikTok. BlackCore's promotional materials openly advertised their capabilities to conduct deceptive influence operations on behalf of government clients, demonstrating how influence-for-hire services have become accessible to state actors seeking to manipulate online discourse.
A flaw in the Linux kernel's perf subsystem for Intel uncore events caused improper initialization and reference counting of uncore boxes on CPUs coming online or going offline. This could lead to premature teardown of monitoring boxes in certain CPU configurations, specifically single-CPU-per-die setups. The issue was fixed by reordering function calls to ensure correct context is set before reference counting operations.
A vulnerability in the Linux kernel version 4.8 involves a missing check for allocation failure of per-CPU node statistics during memory initialization, which can lead to a NULL pointer dereference. The issue occurs in the free_area_init_core_hotplug function when handling alloc_percpu failures. The fix propagates the allocation failure error up the stack and ensures safe fallback behavior, preventing the kernel from dereferencing NULL pointers during node online attempts.
CVE-2026-76447 is a medium severity vulnerability in Cisco Identity Services Engine (ISE) Software versions 3.1.0 through 3.5.0. It involves missing authentication on a critical function in the Online Certificate Status Protocol (OCSP) responder, allowing an unauthenticated remote attacker to trigger an administrative reload of the OCSP responder's certificate and key material.
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/update_category.php of the component Category Update. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
This threat involves illegal online gambling infrastructure that spans multiple cybercrime categories, including money laundering, scams, and espionage. It includes over 1.7 million Chinese-language casino domains linked to triad-aligned syndicates, thousands of scam gambling websites targeting global users with rigged games and withdrawal fraud, and China-aligned APT groups deploying the PeckBirdy malware framework via fake casino and adult websites. These operations exploit hosting providers in the U.S. and Europe while using bulletproof hosting in Asia. The campaigns have increased sharply since 2023, with PeckBirdy domains evading detection on VirusTotal. The visual similarity of these sites complicates detection efforts.
A vulnerability in the Linux kernel arm64 architecture was resolved that involved reading the GMID_EL1 register even when Memory Tagging Extension (MTE) is disabled. This could cause an undefined instruction exception and kernel panic in pKVM environments when CPUs are offlined and brought back online. The fix gates the GMID_EL1 read based on CPU features and configuration to prevent this error.
The Bookly plugin for WordPress (Online Scheduling and Appointment Booking System) up to version 28.1 suffers from an authorization bypass vulnerability via the 'conversation_id' parameter. This allows unauthenticated attackers to enumerate and access AI booking conversation transcripts of any customer, exposing sensitive personal information such as names, emails, phone numbers, and appointment details. Attackers can also inject arbitrary messages into victim conversations, which are replayed to the AI worker. The vulnerability arises from missing validation on a user-controlled key and the use of sequential integer conversation IDs without ownership or session identifiers.
A vulnerability exists in the Oracle Sales Online product of Oracle E-Business Suite versions 12.2.3 through 12.2.15. This vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Sales Online, potentially resulting in unauthorized access to critical data and unauthorized modification of some data. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high severity with significant confidentiality and integrity impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.
A vulnerability exists in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3 through 12.2.15. This vulnerability allows a low privileged attacker with network access via HTTP to potentially take over the Oracle Sales Online component. The CVSS 3.1 base score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update in September 2026 addressing this and many other vulnerabilities across multiple products.
A vulnerability exists in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3 through 12.2.15. This vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Sales Online, requiring user interaction from a third party. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification of some data within Oracle Sales Online. The vulnerability has a CVSS 3.1 base score of 7.6, indicating high severity with significant confidentiality and integrity impacts. Oracle has released security patches addressing this and many other vulnerabilities in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate risk.
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Wage Determination Online). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Contract Lifecycle Management for Public Sector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Contract Lifecycle Management for Public Sector accessible data as well as unauthorized read access to a subset of Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
