CVE-2026-118029 is a vulnerability in the Athena module of AWS SDK for pandas (awswrangler) before version 3.16.1. It involves unverified ownership of the default query result location, which could allow remote actors to read Athena query results and tamper with the results by exploiting a pre-created S3 bucket. The issue is fixed in version 3.16.1. Users are advised to upgrade and verify ownership of the default Athena result bucket or set explicit result locations.
An extortion campaign targeted Japanese real estate websites in October 2026, compromising one company and pivoting to nearly 20 related sites via shared hosting credentials. The attacker, known as kkkkevin777, stole over 16,000 customer records including plaintext passwords and sensitive personal data. Ransom pages with deadlines were deployed, threatening to expose stolen data. Ten days after the extortion wave, PHP2Shell exploitation tooling was found on an exposed staging server, indicating preparation for further attacks. Additional data from a Taiwanese company was also exfiltrated. The server contained weaponized PHP2Shell scripts, web shells, and tools for lateral movement, though no confirmed live exploitation via PHP2Shell was documented.
CVE-2026-116404 is a missing authorization vulnerability in the David Anderson Redux Framework up to version 4.5.16. This flaw allows an attacker with limited privileges to lift sensitive data embedded in the cache without proper authorization. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. It does not require user interaction and impacts confidentiality but not integrity or availability.
A stored cross-site scripting (XSS) vulnerability exists in the iCagenda extension for Joomla, specifically in the url-type event Custom Field. This affects versions 3.2.1 through 4.0.16 of the extension. The vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed with high impact on confidentiality and integrity, requiring user interaction.
A CSV formula injection vulnerability exists in the iCagenda extension for Joomla versions 3.5.0 through 4.0.16. This flaw involves improper neutralization of formula elements in CSV files generated by the registrations export feature, which could allow malicious formulas to be injected into exported CSV data.
A vulnerability in the Linux kernel's AMDGPU driver (version 6.16) involves improper handling of the eviction fence for buffer objects (BO). The eviction fence is detached prematurely when closing any handle to a BO, even if other handles remain open, potentially allowing the BO to be evicted while still in use by user queues. This issue has been fixed by ensuring the eviction fence remains until the last handle to the BO is closed.
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post does not strip the payload on save because the dangerous characters reside within shortcode attribute text between square brackets, which kses treats as plain text rather than HTML markup.
The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.
A vulnerability in the Linux kernel's p54 wifi firmware parser allows reading beyond the bounds of firmware records due to insufficient validation of record lengths. This flaw can cause the parser to read past the intended data fields when processing malformed firmware records. The issue has been addressed by validating component ID and version record lengths and rejecting descriptor values that cause underflow or empty ranges before updating driver state.
MLflow tracking servers running without authentication or with basic authentication are vulnerable to an arbitrary file read vulnerability via crafted model versions tagged as prompts with schemeless local paths. This allows remote attackers to read arbitrary files on the server filesystem with the privileges of the MLflow server process. The vulnerability affects MLflow versions 3.10.0 through 3.16.1 and is fixed in version 3.17.0.
MLflow's CrewAI autologging feature in versions >=2.19.0 and <3.17.0 leaks CrewAI LLM provider API keys in trace telemetry. The vulnerability arises because MLflow serializes the CrewAI Agent object's __dict__ including the LLM object, whose string representation contains the API key in plaintext. This sensitive information is unintentionally sent to MLflow's trace backend or any configured OTLP destination without explicit logging by the application. The issue affects MLflow 3.16.0 with CrewAI 1.15.18 and is fixed in MLflow 3.17.0.
A vulnerability in the follow-redirects Node.js library versions 1.16.0 through 1.16.1 allows sensitive headers to be improperly forwarded during cross-origin redirects. This occurs because the sensitiveHeaders option is checked using value instanceof Array, which fails for arrays created in different JavaScript realms, causing the sensitive headers list to be replaced with an empty array. As a result, custom credential headers can be sent to attacker-controlled redirect destinations. The issue is fixed in version 1.16.2.
A double free vulnerability exists in the XKB SetGeometry function in X.Org X Server versions before 21.1.25 and X Wayland versions before 24.1.14. This flaw could allow attached clients to cause a crash or potentially execute code within the X server context. The vulnerability affects multiple Ubuntu package versions of xorg-server. It has a high severity rating with a CVSS score of 7.8.
Red Hat OpenShift Container Platform 4.16.74 includes multiple security fixes addressing kernel vulnerabilities such as use-after-free, out-of-bounds access, and improper certificate trust. These fixes resolve issues in netfilter, SCTP, PPPoE, IPv6, RDMA, IPv4 checksum validation, and distrust of certain intermediate CA certificates. Users of OpenShift Container Platform 4.16 are advised to upgrade to this release to mitigate these critical security issues.
NextChat version 2.16.1 has a client-side cross-site scripting (XSS) vulnerability in its Plugin Editor. This flaw arises from unsafe rendering of externally supplied OpenAPI plugin schema content using React's dangerouslySetInnerHTML without proper sanitization. An attacker can host a malicious OpenAPI schema and trick a user into loading it, leading to arbitrary JavaScript execution within the NextChat application context. Exploitation could expose JavaScript-accessible cookies and other client-side data.
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 4.16.74. See the following advisory for the container images for
this release:
https://access.redhat.com/errata/RHSA-2026:89715
Security Fix(es):
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of
Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
* cri-o: cri-o: Sandbox state poisoning via pod annotations may expose
runtime socket (CVE-2026-62146)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.16 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
