The qs library version 6.7.0 through 6.16.0 has a vulnerability in its stringify function when using the arrayFormat 'comma'. If an array element has a non-callable own toString property, qs.stringify throws an uncaught TypeError. This can be triggered remotely by an unauthenticated attacker controlling input that is later serialized with this option, potentially crashing the Node.js process and causing a denial of service. There is no impact on confidentiality or integrity, and no prototype pollution occurs.
GFI KerioConnect before version 10.0.8 Patch 2 contains a stored cross-site scripting (XSS) vulnerability in its Webmail component. This flaw allows remote attackers to execute JavaScript in an authenticated user's Webmail session by uploading a specially crafted SVG email attachment that bypasses sanitization of event-handler attributes. Exploitation leverages the temporary-download endpoint's weak Content-Security-Policy sandbox, enabling script execution when the attachment is opened. This can lead to theft of user credentials and mailbox contents. The vulnerability is rated medium severity with a CVSS score of 6.2 and has been observed exploited in the wild by Proofpoint Threat Research. A fix is available in version 10.0.8 Patch 2.
The undici WebSocket client, when using HTTP/2 (enabled by default with allowH2: true), crashes the Node.js process if it connects to a malicious server that responds with a failed WebSocket handshake over HTTP/2. This occurs because the client aborts the request too late, leaving an open HTTP/2 stream that emits an unhandled error when the server closes the connection, causing a denial of service. Versions 8.11.0 and 8.11.1 are affected. A fix is available in version 8.11.2. Workarounds include disabling HTTP/2 for WebSocket connections or avoiding untrusted servers until patched.
Authlib versions up to 1.7.2 accept an empty HMAC key for JWS/JWT HS256/HS384/HS512 signature verification, allowing attackers to forge tokens with arbitrary claims. The empty key produces a deterministic digest that anyone can reproduce, bypassing signature verification. This vulnerability affects OAuth 2.0 resource servers and OIDC relying parties using Authlib if the verification key can be empty at runtime. The issue is fixed in Authlib 1.9.1.
A vulnerability in rustls versions 0.23.44, 0.23.45, and certain 0.24.0-dev releases causes buffered application data to be sent to the server before the client sends the mandatory 'ech_required' alert when Encrypted Client Hello (ECH) is rejected. This violates RFC 9849 requirements that no application data be sent before the alert. The issue affects clients using EchMode::Enable that send application data before handshake completion and connect to servers rejecting their ECH config. The flaw was fixed in rustls 0.23.46 and 0.24.0-dev.2.
A vulnerability in rustls allows a network attacker to poison the client's per-server-name key-exchange record by sending an unauthenticated ServerHello selecting the X25519 group. This causes subsequent ClientHellos for that server name to carry only an X25519 share, potentially leading the handshake to complete with classical key exchange only, losing quantum-resistant confidentiality. No authentication bypass or key compromise occurs. The issue is fixed in rustls versions 0.23.46 and 0.24.0-dev.2.
A vulnerability in rustls versions prior to 0.23.46 and between 0.24.0-dev.1 and 0.24.0-dev.2 allows the TLS master secret or TLS 1.3 resumption PSK to be exposed when formatting a client session value with the Debug trait. This can lead to leakage of sensitive key material if a custom ClientSessionStore logs these debug outputs. Built-in diagnostics do not expose these secrets, and the session-store interface warns about the sensitivity of these values.
Rustls contains a vulnerability in its Brotli certificate decompression feature, which is disabled by default. The Brotli decoder accepts an input-specified history window size that can be up to 1 GiB, potentially causing large memory allocations. This can lead to denial of service via memory exhaustion if a malicious peer sends specially crafted Brotli-encoded certificates. Both clients and servers enabling Brotli decompression and client authentication are affected. The issue is fixed in rustls versions 0.23.46 and 0.24.0-dev.2.
A Brazilian Magecart group exploited a critical vulnerability (CVE-2026-8467) in Plausible Community Edition versions 3.0.0 through 3.2.0 to inject a card skimmer into the Plausible analytics script used by the Brazilian ecommerce platform Convertr. From October 24 to October 27, 2026, the malicious script stole payment card details, CVV, expiry dates, cardholder names, and CPF taxpayer numbers from shoppers during checkout. The stolen data was exfiltrated to the domain 1x0.is. Convertr removed the skimmer and patched the vulnerability on October 27. This Magecart group has targeted multiple Brazilian ecommerce platforms since 2024 using distinctive data exfiltration techniques.
Attackers compromised camera management software (CMS.exe) to gain initial access to multiple organizations. They deployed malware (rs.win32.exe) into user AppData directories and used DLL sideloading with the legitimate Windows binary WpcMon.exe and malicious DLLs to establish beaconing to a command-and-control server. Persistence was maintained via Run Key registry modifications. The affected camera management software, possibly linked to 3R Global and kvision.ai, lacked sufficient security controls and logging. Organizations are advised to treat camera systems and their management platforms as critical attack surfaces and implement access controls and monitoring to detect unusual activity.
CVE-2026-113775 is a high-severity vulnerability in Autodesk Fusion desktop application where a malicious dynamic library loaded via the TextCommands.LoadDll API command can lead to arbitrary code execution. The flaw is due to an exposed dangerous function that allows code execution in the context of the current process. Versions from 2705.1.30 up to but not including 2706.1.14 are affected. A fix is available in version 2706.1.14.
CVE-2026-109089 is a heap-based buffer overflow vulnerability in the X.Org libXi library versions before 1.8.4. The flaw occurs when handling the DEVICE_RESOLUTION property, which can be exploited by a malicious X server to overflow the heap. This vulnerability has a high severity rating and has been fixed in version 1.8.4.
CVE-2026-102638 is a stored cross-site scripting (XSS) vulnerability in Autodesk Fusion desktop application. It occurs when a malicious HTML payload is embedded in the description of an electronic library (.lbr) file and displayed in the Library Manager after import. Exploitation can allow an attacker to read local files or execute arbitrary code within the context of the current process. The vulnerability affects versions from 2705.1.30 up to but not including 2706.1.14 and has been assigned a high severity score of 7.1. A fix is available in version 2706.1.14.
CVE-2026-102637 is a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. It occurs via a malicious HTML payload in the documentName parameter of a Fusion protocol URL. When a user invokes such a URL, the vulnerability can be triggered, potentially allowing an attacker to read local files or execute arbitrary code within the application's process context. The flaw affects versions from 2705.1.30 up to but not including 2706.1.14. A fix is available starting with version 2706.1.14.
CVE-2026-102636 is a stored Cross-site Scripting (XSS) vulnerability in Autodesk Fusion desktop application. It occurs when a malicious HTML payload is embedded in a design name and executed when another user opens the manipulated design. This vulnerability allows an attacker to read local files or execute arbitrary code within the context of the current process.
CVE-2026-107672 is a command injection vulnerability in Autodesk Fusion Post Processor Utility versions 5.0.1 up to but not including 5.0.2. It arises from a trusted Markdown injection triggered by a maliciously crafted .stack.json file, allowing an attacker to execute arbitrary commands with the current user's privileges. The vulnerability has a high severity with a CVSS score of 8.8. A fix is available in version 5.0.2.
CVE-2026-117511 is an OS command injection vulnerability in the desmondmorris node-tesseract library versions 0.2.0 through 0.2.7. The flaw exists in the process function of the lib/tesseract.js file within the Command Builder component, where manipulation of the image argument can lead to remote command injection. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). Public exploit code has been disclosed, but no official patch or vendor response is currently available.
CVE-2026-116863 is a critical Cross-Site Request Forgery (CSRF) vulnerability affecting Tribulant Software's Newsletters plugin (versions up to 4.18.2). This flaw allows attackers to perform unauthorized actions on behalf of authenticated users. The vulnerability impacts confidentiality, integrity, and availability of the affected system.
CVE-2026-115495 is a vulnerability in the WatchGuard Mobile VPN with SSL client for Windows that allows a local attacker who can capture loopback network traffic to obtain the user's VPN username and password due to cleartext transmission of sensitive information. This issue affects versions from 12.0 up to but not including 2026.4. A fix is available in version 2026.4. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.7.
CVE-2026-90465 is an authentication bypass vulnerability in WatchGuard Fireware OS affecting the FireCluster Sync processing. An attacker on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, can send specially crafted requests to perform privileged firewall management actions as root. The vulnerability affects multiple version ranges of Fireware OS and has been assigned a high severity score. Fixed versions are available.
