TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.
Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.
Genesys experienced a cyberattack involving unauthorized access to internal business systems, including a learning management system and a customer relationship management environment. The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not compromised, and customer and partner data within those platforms remain secure. The attackers accessed and likely downloaded business and account information used to manage customer relationships, including names, phone numbers, business emails, job titles, and company information. Genesys contained the incident by suspending the LMS platform and confirmed full containment by October 23, 2026. The investigation is ongoing, and customers are cautioned to watch for phishing attempts impersonating Genesys.
Apache SIS versions 0.7 through 1.6.0 are affected by a path traversal vulnerability (CWE-22) where the software opens linked files from data files without properly restricting file paths. This could allow an attacker to specify local file paths outside the intended directories. The vulnerability affects specific geographic data formats including GML, WKT, and Landsat GeoTIFF bands. The risk of sensitive information leakage is low due to strict file format expectations and parsing stopping at the first error. Version 1.7 of Apache SIS fixes this issue by restricting file references to the same directory or a predetermined directory for datum shift grids.
CVE-2026-92171 is a vulnerability in the Infinispan Operator for Red Hat Data Grid 8 that exposes keystore and truststore passwords in plain text as command-line arguments when cross-site TLS is enabled. These passwords are visible in the Pod specification to any user with get pods permission in the namespace, accessible via node-level process command lines, and often recorded in audit logs. This exposure increases the risk of unauthorized access to sensitive credentials.
A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.
A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A flaw in OpenAI's context compaction process allowed researchers to transfer reasoning traces between AI models, enabling the cheaper distillation of rival AI models. This technique, called compaction smuggling, bypassed initial mitigations and was fixed by OpenAI in October 2026. The vulnerability enabled extraction of proprietary reasoning data from advanced models and its reuse in weaker models, facilitating large-scale copying of AI capabilities. This has been exploited by Chinese entities to develop competitive AI systems, raising national security concerns.
Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request which allows a System Administrator to determine whether internal addresses and ports are reachable from the server via an unauthenticated login request that triggers the discovery fetch.. Mattermost Advisory ID: MMSA-2026-00774
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted from an uploaded PDF which allows an authenticated user to exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.. Mattermost Advisory ID: MMSA-2026-00769
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.. Mattermost Advisory ID: MMSA-2026-00768
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query.
This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.
CVE-2026-93847 is an authorization vulnerability in Mattermost versions 11.7.0 through 11.7.10. It occurs because these versions fail to properly validate reserved system post types during scheduled post creation and publication. This flaw allows an authenticated channel member to publish messages that appear as trusted system events via the scheduled post endpoint.
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.
Security researchers identified a sophisticated supply chain attack campaign involving 42 compromised GitHub repositories across 11 legitimate owners connected to the testmetest npm operation. The campaign evolved to use compiled native addons that decrypt hidden payloads at runtime, evading detection in CI environments through extensive anti-analysis checks. Attackers deployed polymorphic wrappers ranging from 12.9 to 13.7 MB that decode to identical publisher payloads, embedding execution hooks for AI coding assistants and IDEs. The operation included credential theft, repository hijacking, forged commit timelines, and automated malicious package publishing through GitHub Actions using npm trusted publishing. The infrastructure also links to shellpanel exploitation activities targeting cPanel systems. The campaign demonstrates advanced evasion techniques including environment detection for CI systems, containers, sandboxes, debuggers, and security tools before executing malicious code on developer workst...
Adversaries are exploiting Microsoft Teams' default external chat functionality to conduct social engineering attacks and deliver malicious payloads. Analysis of over 400 incidents reveals threat actors consistently impersonate IT support personnel using throwaway Microsoft 365 tenants with IT-themed display names marked as "(Internal)" to bypass external-user warnings. Attacks frequently begin with email bombing followed by Teams contact offering assistance. Adversaries leverage legitimate remote monitoring tools like Quick Assist, AnyDesk, and ScreenConnect to gain hands-on-keyboard access, progressing from initial contact to payload execution in under 15 minutes. Infrastructure patterns show a shift from default onmicrosoft domains toward paid top-level domains, particularly .top domains comprising 50 percent of observed cases. The technique exploits legitimate collaboration features rather than software vulnerabilities, requiring organizations to implement allow-list policies and user training to disru...
CVE-2026-115930 is a high-severity vulnerability in MongoDB Shell (mongosh) versions prior to 2.14.0. It involves improper certificate validation due to the inclusion of recoverable eMudhra intermediate CA certificates in the Node.js TLS root certificate store used by mongosh. This can be mitigated by updating mongosh to version 2.14.0 or later, which bundles a fixed Node.js runtime version 24.22.1 or newer. If mongosh is installed via npm, the Node.js runtime on the host must be updated separately.
Kameleo versions 5.3.0 and 5.3.1 contain an information disclosure vulnerability in the Local API component, specifically in the /general/user-info endpoint. This flaw allows remote attackers to obtain sensitive information without authentication. The vendor has not responded to disclosure attempts and no patch or fix is currently available.
Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723