CVE-2026-77059 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in boneIO versions 1.3.0 up to but not including 1.6.0. The flaw exists in the create_timedatectl_sudoers_file() function, which writes sudoers rules to a predictable temporary file, validates them, and then installs them with root privileges. An attacker with local access can exploit the race window between validation and installation or leverage the predictable filename to perform symlink attacks, resulting in arbitrary sudoers rule injection and local privilege escalation to root. This vulnerability was fixed in boneIO version 1.6.0.
boneIO Black versions from 1.2.0 up to but not including 1.6.0 are vulnerable to Cross-Site Request Forgery (CSRF) attacks on all state-changing API endpoints. The product lacks CSRF tokens and does not validate Origin or Referer headers, allowing remote attackers to craft malicious webpages that can perform unauthorized actions such as rebooting the controller, toggling relay circuits, controlling gates and blinds, or shutting down the device. This vulnerability leads to loss of integrity and availability. The issue is compounded by CVE-2026-77053, which disables authentication by default, enabling any user on the same internal network to trigger these actions. The vulnerability was fixed in version 1.6.0.
boneIO Black versions prior to 1.6.0 do not limit authentication attempts on their web interface or SSH service and lack password complexity enforcement. This allows unauthenticated remote attackers to perform unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access. Version 1.6.0 addresses these issues by implementing rate limiting on web login attempts, enforcing a minimum password length of 8 characters, and restricting SSH authentication attempts to three per connection with a shortened login grace time.
The boneIO black_debian_images product included a Mosquitto MQTT broker configured with default credentials that are identical across all devices and publicly documented. This allows remote attackers to gain full read and write access to the broker, enabling control over connected devices such as relays, blinds, and gates, and the injection of fake entities into linked Home Assistant installations. The vulnerability was fixed in version 1.6.0 by generating unique MQTT passwords per device at first boot. Devices upgraded from earlier versions retain their old credentials, but the web panel notifies owners if default credentials are still in use, prompting a change.
CVE-2026-77055 is a critical vulnerability in boneIO black_debian_images where the boneio service account is granted excessive privileges, including passwordless sudo access and membership in the docker group. This allows a local attacker who compromises the boneio user to escalate privileges to root. The issue is fixed in version 1.6.0 by removing these privileges and enforcing command restrictions with cryptographic verification.
boneIO versions 1.2.0 up to but not including 1.6.0 store sensitive passwords, including MQTT broker and web panel passwords, in cleartext. The API endpoint GET /api/config exposes these passwords to any authenticated user. Due to a related vulnerability (CVE-2026-77053) disabling authentication by default, unauthenticated attackers on the local network can also access these passwords. Version 1.6.0 fixes this by hashing web panel passwords and restricting access to the MQTT broker password, which remains recoverable but is no longer exposed via the API.
boneIO Black firmware versions prior to 1.6.0 have authentication disabled by default on their management web API, exposing all endpoints without requiring credentials. This allows unauthenticated remote attackers to fully control the device, including causing denial of service, modifying configurations, and operating connected physical circuits. The issue was fixed in version 1.6.0 by requiring an administrator account creation during the first-run wizard and restricting API routes to authenticated roles. Versions before 1.2.0 are based on Debian 10, unsupported, and cannot be upgraded in place; affected devices must be re-flashed with the 1.6.0 system image.
boneIO Black versions from 1.3.0 up to but not including 1.6.0 expose a Node-RED instance without authentication via a Caddy reverse proxy at the /nodered/ path. This allows unauthenticated local network attackers to deploy malicious flows through the Node-RED Admin API, enabling remote code execution and full control over the home automation system. The vulnerability is fixed in version 1.6.0.
CVE-2026-116340 is an authorization bypass vulnerability in iFlytek astron-agent versions 1.1.0, 1.1.1, and 1.1.2. It affects the FileInfoV2Service.listKnowledgeByPage function in the Console Knowledge-List Endpoint by manipulating the argument space-id. The vulnerability can be exploited remotely without user interaction and requires low privileges. Public exploit code is available. The vendor has not responded to disclosure and no patch or fix information is provided.
A hardcoded static AES key vulnerability exists in the TTLock Android application before version 9.8.260718 and its associated smart-lock firmware. This flaw allows attackers within Bluetooth range to decrypt the per-pairing session key during BLE pairing. Exploiting this, attackers can forge authenticated BLE requests to unlock the device and perform administrative actions without user interaction.
CVE-2026-3322 is a vulnerability in Lobster DATA GmbH's Lobster_pro product where improper permission checks allow attackers with limited privileges to access administrative endpoints. It affects version 4.12.12-LTS and possibly other versions prior to 25.1.3. The issue permits interaction with endpoints that should require administrative privileges, potentially leading to unauthorized actions. The CVSS 4.0 base score is 5.6, indicating a medium severity. No public exploits or patches are currently documented.
Genesys experienced a cyberattack involving unauthorized access to internal business systems, including a learning management system and a customer relationship management environment. The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not compromised, and customer and partner data within those platforms remain secure. The attackers accessed and likely downloaded business and account information used to manage customer relationships, including names, phone numbers, business emails, job titles, and company information. Genesys contained the incident by suspending the LMS platform and confirmed full containment by October 23, 2026. The investigation is ongoing, and customers are cautioned to watch for phishing attempts impersonating Genesys.
Apache SIS versions 0.7 through 1.6.0 are affected by a path traversal vulnerability (CWE-22) where the software opens linked files from data files without properly restricting file paths. This could allow an attacker to specify local file paths outside the intended directories. The vulnerability affects specific geographic data formats including GML, WKT, and Landsat GeoTIFF bands. The risk of sensitive information leakage is low due to strict file format expectations and parsing stopping at the first error. Version 1.7 of Apache SIS fixes this issue by restricting file references to the same directory or a predetermined directory for datum shift grids.
CVE-2026-92171 is a vulnerability in the Infinispan Operator for Red Hat Data Grid 8 that exposes keystore and truststore passwords in plain text as command-line arguments when cross-site TLS is enabled. These passwords are visible in the Pod specification to any user with get pods permission in the namespace, accessible via node-level process command lines, and often recorded in audit logs. This exposure increases the risk of unauthorized access to sensitive credentials.
A NULL pointer dereference vulnerability exists in the gssproxy daemon of Red Hat Enterprise Linux 10. When a GSSX_INIT_SEC_CONTEXT request is received without the target_name field, the daemon crashes due to dereferencing a NULL pointer. This can be triggered by any local user without authentication via the Unix socket, causing a persistent denial of service as the daemon does not automatically restart. Dependent services such as Kerberized NFS and IdM are also affected while the daemon is down.
CVE-2026-116339 is a medium-severity vulnerability in iFlytek astron-agent versions 1.1.0, 1.1.1, and 1.1.2. It involves an incomplete blacklist implementation in the DDL Whitelist Handler component, specifically in the file core/memory/database/api/v1/exec_ddl.py. The flaw allows remote attackers to manipulate the blacklist, potentially bypassing intended restrictions. The vulnerability has been publicly disclosed with available exploit details, but the vendor has not responded or provided a fix.
A flaw in OpenAI's context compaction process allowed researchers to transfer reasoning traces between AI models, enabling the cheaper distillation of rival AI models. This technique, called compaction smuggling, bypassed initial mitigations and was fixed by OpenAI in October 2026. The vulnerability enabled extraction of proprietary reasoning data from advanced models and its reuse in weaker models, facilitating large-scale copying of AI capabilities. This has been exploited by Chinese entities to develop competitive AI systems, raising national security concerns.
CVE-2026-93848 is a Server-Side Request Forgery (SSRF) vulnerability in Mattermost versions 11.7.0 through 11.7.10. The issue arises because these versions do not properly filter outbound internal-connection requests to the OpenID discovery endpoint. This flaw allows a System Administrator to verify the reachability of internal addresses and ports from the server by triggering an unauthenticated login request that initiates the discovery fetch.
CVE-2026-93850 is a vulnerability in Mattermost versions 11.7.0 through 11.7.10, 11.8.0 through 11.8.5, 11.9.0 through 11.9.1, and 11.10.0 through 11.10.1. It involves improper handling of highly compressed PDF data, where the application fails to limit the volume of text extracted from uploaded PDFs. This flaw allows an authenticated user to cause a denial of service by uploading a crafted PDF whose compressed content expands into a very large amount of text, exhausting server memory.
Mattermost versions 11.7.0 through 11.7.10, 11.8.0 through 11.8.5, 11.9.0 through 11.9.1, and 11.10.0 through 11.10.1 contain a vulnerability in the WebSocket msgpack decoder. The software fails to enforce allocation limits on byte-string decode paths, allowing an authenticated remote attacker to trigger excessive memory allocation by sending a crafted binary WebSocket frame with a large declared payload length. This can lead to denial of service due to resource exhaustion.