CVE-2026-46499 is an authorization vulnerability in Collabora Online before versions 24.04.18 and 25.04.11. It allows read-only users to bypass the read-only restriction by sending crafted WebSocket messages to execute document-modifying commands. Although these unauthorized changes cannot be saved directly by the attacker and are discarded when the session ends, they can mislead other collaborators or be saved unknowingly by authorized editors sharing the session. This issue has been fixed in the specified versions.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective `Content Security Policy`, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the `Content Security Policy` header sent by `coolwsd` mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object.
This vulnerability was patched on 11 September 2026, and no customer action is needed.
libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.
CVE-2026-61626 is a high-severity out-of-bounds write vulnerability in libass versions 0.17.4 up to but not including 0.17.5. It arises from insufficient validation of negative Matroska ReadOrder values during event pruning, potentially allowing an attacker to clear bits near a NULL pointer. Exploitation requires a malicious Matroska stream processed with enabled read-order checking and explicit event pruning. The vulnerability is fixed in libass version 0.17.5.
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in `backend/app/incidents/routes/incident_alert.py` omit role and tenant authorization, and `POST /api/incidents/alerts/create/velo-sigma/exclusion` does not validate credentials. Its `return_username_for_logging` dependency in `backend/app/auth/utils.py` calls `decode_token`, which returns ordinary Invalid token or Expired signature strings on failure, and the dependency passes these strings through instead of rejecting the request. A Bearer header is required, but an arbitrary invalid, expired or forged value can create a suppression rule without a valid account. The collection GET at /create/velo-sigma/exclusion lists exclusions; the read, update and delete routes under `/create/velo-sigma/exclusion/{exclusion_id}`, and the `/velo-sigma/exclusion/{exclusion_id}/toggle` route, use `get_current_user` without role checks, permitting any authenticated `customer_user` to manage every exclusion. In `backend/app/incidents/services/velo_sigma.py`, `process_sigma_alert` calls `check_exclusions` and drops matching enabled alerts before incident creation. A null `customer_code` applies a rule across all tenants. Attackers can suppress detections platform-wide through channel, title or field matching, while low-privilege accounts can enumerate detection-tuning data and modify, disable or delete legitimate exclusions. This issue is fixed in version 0.1.77.
Soft Serve, a Go-based Git server, improperly discloses the existence, exact names, and clone URLs of private repositories via HTTP responses. This occurs because the server responds to certain requests without verifying if the requester has read access, allowing enumeration of private repository names. Repository contents and metadata remain protected, and no write access is exposed. The issue affects versions from 0.5.0 up to but not including 0.12.3 and is fixed in version 0.12.3.
The @nx/maven and @nx/gradle plugins for Nx have an OS command injection vulnerability due to unsafe interpolation of plugin options from nx.json into shell commands. This allows execution of arbitrary commands when running nx commands that construct the project graph. The vulnerability affects specific versions of these plugins and has been fixed in versions 22.7.9 and 23.1.2. Users should upgrade both the nx package and the affected plugins to these versions or later to remediate the issue.
This report summarizes multiple cybersecurity incidents and vulnerabilities including a critical 16-year-old buffer overflow in UEFI firmware affecting most servers worldwide, a disputed AI-led intrusion at Anthropic, data breaches at the University of Copenhagen and ENGIE, and a Cloudflare AI data leak. The UEFI flaw allows local network attackers to execute code at high privilege during network boot. Anthropic disputes the scope of an AI-driven intrusion by a startup. The University of Copenhagen breach exposed personal and national ID data of over 500,000 individuals. Cloudflare fixed a cross-tenant data leak in its AI inference platform caused by a cache size mismatch and a bug in the inference engine. Other incidents include suspected Iranian cyberattacks on military freezers and attempts to breach the US Federal Election Commission systems.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60.
CVE-2026-61738 is a critical path traversal vulnerability in socfortress CoPilot versions prior to 0.1.77. The issue occurs in the POST /api/scoutsuite/generate-gcp-report endpoint, where user-supplied filenames from multipart uploads are used without proper sanitization or path containment checks. This allows an attacker with admin or analyst privileges to write files outside the intended directory, potentially overwriting application source files. The vulnerability was fixed in version 0.1.77 by removing caller-controlled filenames from the affected route.
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in production but permits it with a warning in non-production environments.
Chamilo LMS versions before 1.11.40 and from 2.0.0-alpha.1 up to but not including 2.0.1 contain multiple eval() calls in the PEAR HTML_QuickForm libraries that can lead to arbitrary PHP code execution if attacker-controlled data influences form element names. Standard Chamilo forms use hardcoded element names, so exploitation requires a developer-specific plugin or misconfiguration allowing user input to reach these element names. Successful exploitation can result in full server compromise. The vulnerability is fixed in versions 1.11.40 and 2.0.1.
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the `add`, `delete_gradebook_from_skill`, `save_profile`, and `delete_profile` actions in `public/main/inc/ajax/skill.ajax.php` perform database mutations without `Security::check_token()` validation. An attacker can use cross-site request forgery to cause an authenticated administrator or DRH who visits a malicious page to create, modify, or delete skill records and profiles, or remove skill-gradebook associations. This issue is fixed in version 2.0.1.
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_classes: false` safety option. An attacker able to write crafted serialized PHP objects to that column, for example through a separate SQL injection, a compromised admin CSV import, or a lower-privilege admin panel, can instantiate arbitrary PHP objects and trigger POP gadget chains in autoloaded `Symfony`, `Doctrine`, or `Monolog` components. This permits arbitrary OS commands as the web server user, compromising server confidentiality, integrity, and availability. This issue is fixed in version 2.0.1.
Chamilo LMS versions 2.0.0 up to but not including 2.0.1 contain a stored cross-site scripting (XSS) vulnerability in the user profile page. The vulnerability arises because six user-editable profile fields are rendered without proper server-side sanitization, allowing a user with the ROLE_STUDENT role to inject malicious HTML. This malicious content executes in the browsers of visitors viewing the profile, including administrators, potentially enabling account takeover through session or token theft. The issue is fixed in version 2.0.1.
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated `/scoutsuite-report` `StaticFiles` mount in `backend/copilot.py` exposes the `scoutsuite-report` directory even though normal /api routes require JWT authentication. Generated HTML reports and `scoutsuite-results/scoutsuite_results_<name>.js` files disclose AWS, Azure and GCP IAM principals, resource inventories, misconfigurations and findings. Report names derive from caller-selected names with predictable defaults. During an admin- or analyst-initiated GCP scan, `backend/app/integrations/scoutsuite/routes/scoutsuite.py` saves the uploaded Google service-account JSON key into that same web-served directory. In `backend/app/integrations/scoutsuite/services/scoutsuite.py`, `generate_gcp_report_background` removes the key only after the scan finishes. Any anonymous client that can reach the host and request the file path can therefore retrieve the private key during the scan and use the service account's cloud permissions, as well as read retained cloud-security reports. Credential isolation is released in version 0.1.77; a release fully remediating the report-disclosure component has not been established.
CVE-2026-61729 is a critical vulnerability in socfortress CoPilot versions prior to 0.1.76. It involves missing authentication for critical webhook functions due to a publicly hardcoded fallback header value used for authentication. This allows an anonymous attacker to bypass JWT authentication and invoke sensitive API endpoints that can execute commands on Wazuh managers and submit forged alerts, potentially disrupting endpoint defenses and manipulating alert data. The issue is fixed in version 0.1.76.