CVE-2026-107484 is a vulnerability in Check Point Quantum Security Gateway's Gaia Portal backend. It involves improper privilege management where an authenticated user without administrative rights can perform operations reserved for administrators.
Starting October 30, 2026, attackers exploited unpatched Check Point Security Gateways via Mobile Access portals using PHP2Shell for initial access, followed by privilege escalation through CVE-2026-123039. Initial attacks targeted Israeli organizations with destructive activity, while a broader second wave targeted multiple countries without destructive actions. Attackers deployed PHP webshells, the persistent TSGA backdoor with TSProxy, and later pivoted to VMware ESXi hosts to deploy a destructive wiper and leave politically themed notes. The malware tools are linked to the PhiliKit framework, previously associated with China nexus threat actors, though attribution remains uncertain. The campaign exploited multiple vulnerabilities and established persistent, covert access on compromised systems.
CVE-2026-126995 is a path traversal vulnerability in the SafeTensorIndex.loadWeights function of the tjake Jlama project affecting versions 0.8.0 through 0.9.0-beta. The flaw allows remote attackers to manipulate the weight_map argument to perform path traversal. Exploit code has been publicly disclosed, but no vendor response or patch is currently available.
A missing authorization vulnerability (CWE-862) in pardus-image-writer versions before 0.9.0 allows privilege escalation. The issue is fixed in version 0.9.0. The CVSS 3.1 score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.
Google Chrome 157 and Mozilla Firefox 160 updates address over 180 security vulnerabilities combined. Chrome 157 fixes 83 flaws including five critical use-after-free issues and multiple high-severity bugs such as out-of-bounds read/write and type confusion. Firefox 160 patches 99 vulnerabilities, including 57 high-severity issues like use-after-free, sandbox escapes, and privilege escalations. No exploitation in the wild has been reported for these vulnerabilities.
The wfx-loot campaign involved attackers using thousands of hijacked GitHub accounts to test and deploy a credential-stealing malware in over 1,800 repositories. The malware was inserted into GitHub Actions workflows, shell scripts, and npm installation hooks to steal GitHub tokens, repository secrets, cloud credentials, and AI service keys. The attacker used valid tokens rather than exploiting GitHub vulnerabilities and concealed their activity by reversing code changes and deleting workflow runs. Organizations affected should assume all accessible secrets were compromised and take action to revoke and rotate credentials.
Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.
CVE-2026-124628 is a high-severity vulnerability in Octopus Server where users could bypass restrictions on self-service LDAP identity editing. This flaw allowed users to modify their LDAP identity even when administrators had disabled such edits, potentially granting unauthorized team memberships and escalating privileges to administrative levels if those teams had elevated rights. The issue affects specific versions of Octopus Server prior to fixed releases in 2026.3.15936 and 2026.2.13526.
Two security vulnerabilities affecting the Cockpit web-based server administration tool in Red Hat Enterprise Linux 9.8 Extended Update Support have been addressed. One vulnerability (CVE-2026-91151) allows local privilege escalation due to insecure symbolic link handling in the public key addition helper. The other (CVE-2026-91150) is a denial of service caused by unbounded fragmented WebSocket messages. Red Hat has released updates to fix these issues in the Cockpit packages for multiple architectures.
CVE-2026-124627 is a high-severity vulnerability in Octopus Deploy Octopus Server affecting versions from 3.0.0 up to but not including 2026.2.13526 and from 2026.3.0 up to but not including 2026.3.15926. The flaw involves incorrect authorization due to improper validation of external identities linked to newly registered users. This can cause a user to inherit LDAP-mapped team memberships and permissions of another user. The issue only impacts instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams. Fixed versions 2026.2.13526 and 2026.3.15926 address this vulnerability.
CVE-2026-116835 is a high-severity vulnerability in Octopus Server where insufficient validation of custom claims on OIDC accounts allows a user with account editing permissions to cause the server to issue signed OIDC tokens that impersonate a different project. This impersonation could grant unauthorized access to external systems that trust the impersonated project's identity. The issue affects specific versions of Octopus Server prior to fixed releases 2026.2.13503 and 2026.3.15894.
CVE-2026-114467 is an out-of-bounds write vulnerability in Git that occurs when the git-merge command is used on a tag containing more than two GPG signatures. This flaw can lead to a low-severity denial of service due to potential application instability or crash.
CVE-2026-114466 is a medium severity vulnerability in Git affecting versions 2.50.1 through 2.56.0. It involves insufficient granularity of access control in the git-fast-import and git-fast-export features, which are not marked as unsafe. This flaw allows arbitrary data to be read or written under certain conditions.
CVE-2026-114469 is an out-of-bounds read vulnerability in Git's git-apply command. It occurs when a binary patch inflates to a very large size, potentially causing the git-apply process to crash. This vulnerability affects specific Git versions and has a medium severity rating with limited impact on confidentiality and availability.
Daylight, an Israeli-American cybersecurity startup, has raised $80 million to advance its AI-powered security operations platform called Aura. Aura uses AI automation combined with human expertise to detect, analyze, and contain cyber threats in real time, including protection for AI platforms against prompt injection and rogue AI activity. The funding will support product development, team expansion, and market growth. This announcement is a funding and product development update rather than a security vulnerability or active threat.
WonderCMS versions prior to 3.7.0 have a vulnerability in the saveAction functionality that allows an authenticated user to change the administrator password without needing to re-authenticate. This flaw enables attackers with some level of access to bypass re-verification controls during password changes, potentially maintaining or escalating unauthorized administrative access. The issue is fixed in version 3.7.0.
CVE-2026-97845 is a medium severity vulnerability involving uncontrolled recursion in the Qt QXmlSimpleReader XML parsing functionality. It affects Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5). The flaw can lead to high impact due to uncontrolled recursion but requires local access with low complexity to exploit. Fixed versions are available in Qt 6.8.10 and 6.11.3.
CVE-2026-125285 is an authentication bypass vulnerability in TIBCO Platform’s Self-Hosted Control Plane versions 1 through 1.21. The flaw allows an attacker to bypass authentication by exploiting an alternate path or channel. This vulnerability has a high severity rating with a CVSS score of 8.8.
Multiple security vulnerabilities have been identified and fixed in the Kerberos (krb5) network authentication system used in Red Hat Enterprise Linux 10. These include unauthenticated memory exhaustion and CPU denial-of-service (DoS) attacks, memory leaks, null pointer dereferences causing DoS, improper authorization, unauthorized key resets, and request alteration leading to information disclosure. The update also includes various bug fixes and enhancements to improve stability and security.