Zohocorp ManageEngine DDI Central versions prior to 6301 contain an authentication bypass vulnerability in the Windows DNS and DHCP agent synchronization APIs. This flaw allows unauthenticated users to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications. The vulnerability is critical with a CVSS score of 9.1 and has been fixed in version 6301.
CVE-2026-126993 is a vulnerability in SiteServer SSCMS versions 7.2.0, 7.2.1, and 7.2.2 involving inadequate encryption strength in an unknown function related to the /api/v1/captcha endpoint. The flaw allows remote attackers to manipulate an argument named Value, weakening encryption. Public exploit code has been released, but no vendor response or patch is available.
Multiple vulnerabilities have been fixed in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. The specific nature of these vulnerabilities is not detailed in the provided information.
Zohocorp ManageEngine DDI Central versions prior to 6301 contain a PowerShell injection vulnerability caused by insufficient validation of user-supplied TXT record values in Windows DNS operations. This vulnerability allows an attacker with low privileges to execute arbitrary OS commands. The issue is fixed in version 6301.
The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM.
The /external_tools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services.
The vulnerability also affected the edit workflow: the change_config endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic.
Affected component: the website sub-application of MISP Modules, specifically the external_tools module (serializer in models.py, list endpoint, and the external_tools_index.html template). The impact is limited to confidentiality of the stored API keys; no integrity or availability impact on the MISP Modules website itself is indicated by the patch.
Fortinet has addressed multiple vulnerabilities in its FortiOS product. Specific details about the vulnerabilities, affected versions, and impact are not provided in the available data.
The bsv-rs crate's Shamir backup recovery mechanism accepted shares with an x coordinate of 0, allowing an attacker to supply a crafted share that directly determines the recovered private key. This flaw existed since the crate's first release (0.2.0) and was fixed in versions 0.8.7 and 0.9.0-beta.7.0. The vulnerability allows an attacker to substitute the recovered private key if the application recovers a Shamir backup from shares it did not originally produce.
CVE-2026-124705 is an open redirect vulnerability in Progress Software's Telerik UI for .NET MAUI versions 5.2.0 up to but not including 16.0.0. The flaw exists in the RadRichTextEditor hyperlink handling and RadPdfViewer link annotation handling, allowing an unauthenticated attacker to craft documents or PDF links that launch arbitrary operating system protocol handlers with attacker-controlled arguments when opened by a user. This vulnerability is fixed in version 16.0.0.
Fortinet has addressed multiple vulnerabilities in FortiManager and FortiAnalyzer products, including their cloud versions and related products such as FortiManager Cloud, FortiAnalyzer Cloud, FortiAnalyzer-BigData, FortiSASE-Sovereign, and FortiSASE-Sovereign GUI. The specific vulnerabilities span a range of common weakness enumerations (CWEs) but no detailed impact or exploitation information is provided.
CVE-2026-102895 is an authentication bypass vulnerability in GPUStack, an open-source software managing GPU clusters for AI workloads. The flaw arises because GPUStack trusts the 'X-Gpustack-Real-IP' header to identify request origin. If this header indicates a loopback IP (127.0.0.1), GPUStack bypasses authentication, allowing attackers to spoof this header and gain unauthorized access. This affects all versions prior to 2.2.0, which was released at the end of June 2026. The vulnerability was publicly disclosed at the end of July 2026, with the CVE assigned on November 4, 2026. Exploit attempts have been observed but no confirmed exploitation in the wild is reported.
Multiple command injection and macro expansion vulnerabilities have been identified in the RPM Package Manager (RPM) used in Red Hat Enterprise Linux 10. These vulnerabilities involve unescaped filenames and tarball paths that can lead to command execution during package building and unpacking operations. Red Hat has released security updates addressing these issues.
A security update for the host metering service in Red Hat Enterprise Linux 7 Extended Lifecycle Support addresses a vulnerability in the golang crypto/x509 package. The flaw (CVE-2026-111943) allows man-in-the-middle attacks via untrusted intermediate certificates. Red Hat has rated this update as having an important security impact and has released patches for affected packages.
Two security vulnerabilities have been identified in Cockpit, a web-based server administration tool for GNU/Linux. The first is a local privilege escalation due to insecure symbolic link handling in the public key addition helper (CVE-2026-91151). The second is a denial of service vulnerability caused by unbounded fragmented WebSocket messages (CVE-2026-91150). These issues affect Red Hat Enterprise Linux 10 across multiple architectures. Red Hat has issued security updates addressing these vulnerabilities.
In September 2026, attackers targeting a U.S. retailer shifted from error-prone manual commands to AI-generated PowerShell scripts, enabling rapid and effective exploitation. The AI-assisted attacks included credential harvesting from SolarWinds Orion software and lateral movement across servers. These attacks were financially motivated, focusing on point-of-sale systems to extract passwords and credentials. The intrusion was linked to earlier attacks in 2026 that lacked AI assistance, indicating recent integration of AI capabilities. Similar AI-assisted attacks increased across multiple sectors and countries throughout 2026.
A security vulnerability (CVE-2026-13732) in the GNU Debugger (GDB) affects Red Hat Enterprise Linux 8.6. The flaw is an out-of-bounds write in the STABS parser function read_member_functions() triggered by a crafted ELF file. Red Hat has released an important security update to address this issue in GDB packages for affected versions.
Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS.
This issue affects WebFOCUS: 9.1, from 9.2 through 7, and from 9.3 through 7.
The npm package 'pdf-html5-page-flip' version 2.0.2 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately using a different device. Removal of the package does not guarantee elimination of all malicious software introduced by this package.
The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the `masterstudy_ms_stm_set_discard_transient` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by setting the `stm_developer_access_token` transient and using the developer access auto-login flow to obtain administrator session cookies.
VibeBP plugin for WordPress versions up to 1.9.9.8.1 contains a privilege escalation vulnerability. Authenticated users with Subscriber-level access or higher can exploit the set_email_notification_settings() function to update their own 'wp_capabilities' user meta, granting themselves administrator privileges.