gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter without checking that each chunk contains the fixed fields, parameter TLVs, gap acknowledgements, or duplicate TSNs those sub-decoders read. A crafted SCTP segment can therefore cause out-of-bounds or inverted slice panics; the panic can terminate applications that use gopacket.DecodeOptions.SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic enabled, while the default recovery-enabled APIs convert it to a per-packet decode error. This is the SCTP sub-decoder residual named but not remediated by CVE-2026-65819, whose version 1.7.1 changes bounded the generic dispatcher but left these per-type reads and loops unchecked. The impact is availability only, with no data disclosure, modification, or allocation amplification. This issue is fixed in version 1.7.2.
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges.
The grizzly-baileys npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control.
Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Cross Site Request Forgery.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI Engine: from n/a through 3.8.8.
croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact even when SendingText is false. This skips askReceiveOverwrite and rename handling for a predictable exact-name collision in the receiver's working directory, allowing a remote sender whose transfer the user accepts to overwrite or truncate a matching regular file through recipientInitializeFile, or to remove and replace a matching destination with an empty file or an in-directory symlink through createEmptyFileAndFinish, without confirmation. The impact is limited to pre-existing names in the croc-stdin- namespace that the sender can predict; other filenames retain the prompt, dotfiles outside that namespace are not reachable, and symlink targets remain confined to the receive directory. This issue is fixed in version 11.5.2.
Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint.
To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.
Microsoft Threat Intelligence analyzed two human-operated intrusion cases where attackers used Microsoft Teams to impersonate IT support and socially engineer users into granting remote access via Quick Assist. The attackers then staged portable runtimes, performed host and network discovery, and abused Active Directory Certificate Services (AD CS) to obtain authentication certificates for privileged accounts. Two distinct AD CS abuse techniques were observed: ESC1 template abuse allowing certificate issuance for privileged accounts, and ESC8 NTLM relay to AD CS Web Enrollment to obtain domain-controller certificates. These certificate-based authentications enabled persistent privileged access independent of passwords. The incidents highlight risks from social engineering combined with insecure or overly permissive AD CS configurations rather than software vulnerabilities. Microsoft Defender detections and containment effectiveness varied between cases, influencing the extent of attacker progression.
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible older versions. The authorization check that was introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated users to run a pod on the management cluster.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player widget for WP: from n/a through 1.1.10.
CVE-2026-119116 is a high-severity use-after-free and double-free vulnerability in the SetClient command handler of the kmstool-enclave sample application within AWS aws-nitro-enclaves-sdk-c versions before 0.4.6. This flaw allows an application running on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave, potentially leading to arbitrary code execution within the enclave. AWS has fixed this issue in version 0.4.6 of the SDK. Users should rebuild any enclave images that include kmstool-enclave or derived code against the fixed version to mitigate the risk.
Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In `src/utils/sql-parser.ts`, `scanSingleLineComment` treats every double dash as a comment start, whereas MySQL and MariaDB require following whitespace, a control character, or the end of the line. The read-only check in `src/tools/execute-sql.ts` validates split statements with `isReadOnlySQL`, but `src/connectors/mysql/index.ts` and `src/connectors/mariadb/index.ts` execute the original string with `multipleStatements` enabled. A double dash followed by a non-whitespace character can therefore hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus operators and executes both statements. Anyone able to influence the assistant's SQL, including through prompt injection in content the assistant reads, can bypass read-only mode to modify or drop database data, subject to the database account's privileges. PostgreSQL is not affected by this path because its double-dash parsing agrees with the checker and its connector executes individual split statements. This issue is fixed in version 0.22.6.
Cybercriminals exploit the popularity of ebooks by distributing malware disguised as ebook files, using search result manipulation, phishing scams, and fake pirate library sites. These attacks can lead to malware infections such as cryptocurrency miners and infostealers, data leaks including personal and financial information, and fraudulent charges via fake bookstore sites. E-readers themselves are less commonly targeted, but vulnerabilities exist in advanced models. Users' reading histories and personal data can also be exposed through data leaks or account compromises. Safe practices include using official bookstores, keeping devices and apps updated, and avoiding unofficial firmware.
CVE-2026-119291 is a vulnerability in zuke-build's zuke automation system prior to version 1.4.0. It involves improper handling of symbolic links during setup and import operations, allowing an attacker to supply a malicious repository or template with symbolic links that cause files outside the intended directory to be overwritten with the user's permissions. This can lead to unauthorized modification of files. The issue is fixed in version 1.4.0.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.
CVE-2026-104615 is an authentication bypass vulnerability in SUSE Rancher Fleet's cluster registration flow affecting multiple versions before fixed releases. The flaw allows a registration request to claim a cluster identity without proper binding to the registration token, enabling association with a different managed cluster's identity. This could lead to unauthorized actions on clusters.
Zuke-build versions prior to 1.10.0 contain a vulnerability in the @zuke/gh githubWorkflow(...) gate where it insufficiently verifies the authenticity of dispatched workflow runs. The gate relies solely on a display-title marker visible in the workflow run list, which can be spoofed by an attacker with workflow_dispatch permission in an external repository. This allows an attacker to substitute a workflow run conclusion, potentially authorizing unvalidated releases or blocking valid ones. The issue is resolved in version 1.10.0.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.