CVE-2026-115910 is a vulnerability in python-social-auth's social-core component prior to version 6.2.0. It involves insufficient verification of the OpenID Connect nonce, which is stored globally rather than being bound to the initiating browser session and OAuth state. This flaw allows an attacker who obtains a victim's unused authorization code to reuse it with a valid state from a separate login, bypassing nonce validation and potentially logging in as the victim if PKCE is disabled. The issue is fixed in version 6.2.0.
CVE-2026-114710 is a stored cross-site scripting (XSS) vulnerability in the WP Chill Gallery PhotoBlocks plugin, affecting versions from initial release up to 1.3.7. The flaw allows improper neutralization of input during web page generation, which could lead to execution of malicious scripts in users' browsers. A fix is available in version 1.3.8.
CVE-2026-115597 is a missing authorization vulnerability in ThimPress LearnPress affecting versions prior to 4.4.12. It allows exploitation due to incorrectly configured access control security levels, potentially leading to limited confidentiality and integrity impacts. The issue is fixed in version 4.4.12.
CVE-2026-116388 is a missing authorization vulnerability in the TMS Amelia booking plugin affecting versions prior to 2.4.11. It allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 2.4.11.
CVE-2026-116396 is a stored cross-site scripting (XSS) vulnerability in TMS Amelia versions up to 2.4.12. It involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to inject malicious scripts. The vulnerability has been assigned a CVSS score of 6.5, indicating a medium severity level. A fix is available in version 2.4.13.
CVE-2026-115418 is a high-severity SQL injection vulnerability in the AWS Cloud Development Kit (CDK) module @aws-cdk/aws-redshift-alpha prior to version 2.274.0-alpha.0. It allows an attacker who can influence construct property values to execute SQL statements with Amazon Redshift superuser privileges. This includes the ability to grant access to all cluster users. The vulnerability arises from unsafe handling of user names, comments, or passwords in database-query custom resource handlers. AWS has fixed this issue in version 2.274.0-alpha.0 and recommends upgrading and reviewing existing table grants to PUBLIC.
CVE-2026-115909 is a denial of service vulnerability in the zip-rs zip2 library affecting versions from 1.3.0 up to but not including 9.0.0. The vulnerability arises because the library allocates memory based on an attacker-controlled ZIP64 uncompressed_size field before validating the entry data, which can cause the process to abort due to an impossible allocation request. This issue is fixed in version 9.0.0.
CVE-2026-116403 is a race condition vulnerability in Awesomemotive Easy Digital Downloads affecting versions before 3.7.2. It involves concurrent execution using a shared resource with improper synchronization, which can lead to integrity issues. The flaw is fixed in version 3.7.2.
A path traversal vulnerability exists in the zip-rs zip2 library versions 7.2.0 through 8.x, fixed in 9.0.0. The flaw allows an attacker to craft symbolic link chains that bypass lexical path validation, enabling files to be created or overwritten outside the intended extraction directory. On Windows, this can be exploited with certain privileges to escape extraction boundaries with a single symlink.
CVE-2026-115907 is a high-severity vulnerability in the zip-rs zip2 library for Rust, affecting versions from 5.1.0 up to but not including 9.0.0. The issue involves uncontrolled resource consumption due to unbounded preallocation of output capacity based on attacker-controlled ZIP64 uncompressed sizes before validating the compressed stream. This can cause a panic due to capacity overflow in certain decoder paths, potentially terminating an archive-processing service. The vulnerability is fixed in version 9.0.0.
A vulnerability in the zip-rs zip2 Rust library versions from 0.6.0 up to but not including 9.0.0 allows improper validation of the AES entry reader's HMAC authentication tag. Under certain conditions, such as when the encrypted entry has no payload or the data counter does not reach zero before the end of the archive, the reader may return a clean end of stream without verifying the authentication tag. This can cause applications using certain decryption methods to accept modified plaintext without detecting authentication errors. The issue is fixed in version 9.0.0.
CVE-2026-116371 is an improper authentication vulnerability in Akuvox Akubela HyPanel PS51 version 51.130.40.26. The flaw involves manipulation of the 'engrmode' argument in the /login endpoint, which can allow an attacker to bypass authentication remotely. The vendor has not responded to disclosure requests, and no patch or mitigation guidance is currently available. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-115905 is a critical vulnerability in the zip-rs zip2 Rust library affecting versions prior to 9.0.5. The flaw arises from inconsistent handling of filenames between the Central Directory File Header and the Local File Header during ZIP archive extraction. This discrepancy allows a crafted archive to appear safe when inspected via the central directory but to cause a streaming extractor to write files to attacker-chosen paths, potentially overwriting important files used by downstream services. The issue is fixed in version 9.0.5.
CVE-2026-71456 is a vulnerability in Johnson Controls Kantech Entrapass before version 9.20 involving the use of a hard-coded cryptographic key. This flaw enables a Padding Oracle Crypto Attack, compromising cryptographic security. The issue is fixed in version 9.20.
CVE-2026-71455 is a vulnerability in Johnson Controls Kantech Entrapass before version 9.20 that involves cleartext storage of sensitive information in memory. This flaw allows retrieval of embedded sensitive data, potentially exposing confidential information. The vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in version 9.20.
Pyrus Sync for Windows has a local privilege escalation vulnerability due to missing authorization controls in its PyrusSyncService Windows service. This flaw allows an attacker with unprivileged access to create files via the ISyncService contract, potentially escalating their privileges on the affected system. The vulnerability affects versions prior to 1.8.745.0, which contains the fix.
CVE-2026-116370 is a type confusion vulnerability in the loadstring function of the Lua sandbox component in 2K Games Sid Meier's Civilization IV version 1.0.12.68. This flaw can be exploited remotely and has publicly available exploit code. The vulnerability has a medium severity rating with a CVSS score of 5.3.
This report summarizes multiple cyber threats and incidents observed in late October 2026, including large-scale breaches, supply-chain attacks, AI-enabled cybercrime tools, and critical software vulnerabilities. Notable incidents include a cyberattack on Japanese cloud provider Onamae Desktop Cloud affecting over 26,000 servers, a data breach at India's State Bank of India exposing nearly 3,900 customer records, and a supply-chain compromise of the LiteLLM AI gateway. AI-enabled tools are facilitating large-scale fraud and ransomware attacks targeting critical sectors in the United States. Critical PHP vulnerabilities enabling remote code execution are being widely exploited, with most instances unpatched. Oracle and GitLab have released patches for numerous critical vulnerabilities, including a critical remote code execution flaw in GitLab and a privilege escalation vulnerability in Arista VeloCloud Orchestrator that has been exploited in the wild.
CVE-2026-82390 is a low-severity vulnerability in the Zephyr project's Espressif AES driver that causes a race condition in multi-session cipher operations. The driver incorrectly programs hardware key registers outside a mutex lock, allowing operations from one session to use the key and direction of another session. This leads to cryptographic failures where data intended to be protected under one key is processed under another, potentially exposing plaintext if the attacker controls the second key. The issue affects applications using two or more concurrent sessions with different keys, which is not the case for in-tree Zephyr subsystems. The fix involves reprogramming the key and direction inside the mutex lock at each operation to prevent stale register usage.
CVE-2026-82389 is a memory-safety vulnerability in the Zephyr Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) role. It occurs when a failed RFCOMM connection triggers cleanup that zeroes linked SDP client request nodes still in use, leading to dereferencing of null pointers and potential Bluetooth stack crash or hang. The flaw affects Zephyr versions from 4.4.0 up to but not including 4.5.0 and requires Bluetooth Classic and HFP AG configurations. The vulnerability does not allow attacker-controlled memory writes but results in denial of service via stack crash or hang.