CVE-2026-101259 is a vulnerability in the Apache Camel CoAP component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.2. It allows generation of error messages containing sensitive internal information such as class names, file paths, host names, and connection details. This occurs when the CoAP consumer fails to build its response after route completion and returns detailed exception messages in a 5.00 Internal Server Error response. The issue is fixed in Apache Camel versions 4.18.5, 4.22.2, and later 4.23.0. Users are advised to upgrade to these fixed versions to prevent sensitive information disclosure.
The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.
CVE-2026-116124 is a heap-based buffer overflow vulnerability in GNOME libgsf versions 1.14.0 through 1.14.19. The flaw exists in the ole_info_read_metabat function within the OLE2 Parser component, allowing remote attackers to trigger the overflow. This vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3. A patch identified by commit a8e25560b74f84c3f86df6ca0ac59195fa5af68a is available to address the issue.
Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, but Pillow converts the expected rows without clearing the unwritten tail. The tile path is affected from 5.3.0 and the strip path from 6.0.0. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This can disclose stale heap contents without memory corruption or a process crash. This issue is fixed in version 13.0.0.
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Repeated non-cyclic /Kids references can also cause super-linear CPU and memory use. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled. This can raise an uncaught RecursionError or consume excessive CPU and memory before output is written, causing denial of service. This issue is fixed in version 13.0.0.
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.
@apexacc/cli is distributed by "Apex Accelerator" (Apex Arena), a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs (REF8801, published 2026-10-12) found it is a repackaged Oh My Pi coding agent (1,351 of 1,363 files identical) with malicious additions that hijack the developer's AI coding agent: it overwrites OPENROUTER_BASE_URL so model traffic (prompts, files read, tool results) goes to attacker infrastructure at arena.apexaccs.org; persists an attacker-controlled remote MCP server in ~/.apex/agent/mcp.json; and defaults tool approval to "yolo". A bootstrap retrieves commands from vrf.apexaccs.org: on macOS it drops CloudSyncD (fake password prompt, credential theft, C2 ccmihr.com); on Windows a staged loader chain ends in an infostealer that exfiltrates browser credentials, wallets, messengers, VPN clients and Claude/Cursor/Windsurf configs over Telegram. Elastic analyzed version 1.6.1 and traced the bootstrap to the earliest preserved version (script host arenapex.cloud). The package was still live on npm (latest 1.6.2) with no OSV record as of 2026-10-16. Independently confirmed by static inspection of the live 1.6.2 npm tarball (sha256 7ca5e3908dd8721d0cf6af2488f0825c0d91a5e0b7c8529ef830141a4a3ba31f) on 2026-10-16, without execution: the bin launcher apex.cjs (sha256 4029192a44ee738deba9aa53b57550075cb8fd170a63f0636dea5452256f2175) runs when the user invokes the CLI (no install script). On Windows it sets the current user's PowerShell execution policy to RemoteSigned (no elevation needed), and on Windows 11 it launches a hidden, elevated (UAC RunAs) PowerShell that attempts to add a Defender exclusion for ~/.apex and to set HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy VerifiedAndReputablePolicyState=0 (disabling Smart App Control). From 1.5.122 (2026-09-17) through 1.6.2 those two commands are built in a JavaScript template literal with single backslashes, so the shipped paths are mangled (the exclusion lands on a sibling path '<home>.apex' and the registry key is invalid) and both likely fail; the UAC prompt still appears. Versions 1.5.120 (registry change) and 1.5.121 (adds the Defender exclusion), both 2026-09-17, carried correctly escaped versions of these commands without an elevation prompt, effective only when already running as administrator. The execution-policy change first appears in 1.6.2. It then downloads a ~114MB native binary from GitHub releases of apexaccs/copilot into ~/.apex/bin, and on macOS an additional apex-verify-darwin helper. Both GitHub repositories referenced by the package versions (apexaccs/copilot, Apex-Accelerator/apexcli) return 404 as of 2026-10-16. All versions affected. Indicators from Elastic's report.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (c174007782646e1fdfd9806ecd699e427fd36661dd7137fa462672f41aee6e79)
On CLI startup (invoked via npx per the package README), apex.cjs unconditionally detects Windows 11 and launches a hidden, UAC-elevated PowerShell via Start-Process -Verb RunAs -WindowStyle Hidden with a UTF-16LE base64 -EncodedCommand payload. The elevated payload (a) calls Add-MpPreference -ExclusionPath on %USERPROFILE%\.apex to whitelist the package directory in Windows Defender, and (b) writes HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy VerifiedAndReputablePolicyState=0 via reg add, disabling Smart App Control / Code Integrity enforcement machine-wide. The elevation path uses underscore-prefixed identifiers (_ps, _enc, _sp, _osv, _isWin11, _home), a hidden window, base64 command encoding, and a broad try/catch that silently swallows errors. After weakening the host, the CLI downloads a ~105MB apex-<platform>.exe (and an optional native.node addon) from the publisher's GitHub Releases with no hash or signature verification, chmods 0755, and executes it via spawnSync with inherited stdio and the full process.env. The security-policy downgrade is not consistent with any documented function of an AI CLI and converts an otherwise routine publisher-pinned binary fetch into execution of unverified code under a machine-wide-weakened Windows security posture.
CVE-2026-116118 is an OS command injection vulnerability in the Sed Command Filter component of Z.ai Zcode versions 3.14.0 through 3.15.1. This flaw allows remote attackers to execute arbitrary operating system commands. The vulnerability has been publicly disclosed, but no known exploits are currently observed in the wild. The CVSS 4.0 base score is 5.3, indicating a medium severity level.
A security vulnerability (CVE-2025-11395) in the podman tool allows arbitrary file write when importing an OCI archive. Podman is part of the libpod library used for managing container pods, a Kubernetes concept. This issue is addressed in Red Hat Enterprise Linux 9 with an update to podman version 5.8.2-8.el9_8. The vulnerability has been rated as Important by Red Hat Product Security. No known exploits in the wild have been reported.
A security update for python3-urllib3 addresses a denial of service vulnerability caused by unbounded memory allocation in the chunk parser (CVE-2026-97689). This flaw could allow an attacker to cause a denial of service condition. The vulnerability affects versions of python3-urllib3 prior to 1.26.5-8.el9_8.2. A fixed version is available and should be applied to mitigate the issue.
Libreswan, an IPsec and IKE implementation for Linux, has multiple security vulnerabilities including a use-after-free bug in IKEv2 when using IKE-over-TCP (CVE-2026-94453), a denial of service via bogus X.509 certificates (CVE-2026-77205), and a null pointer dereference in PKCS#7 bundles with no certificates (CVE-2026-77207). These issues affect versions prior to 5.3.3-1.el10_2. A security update fixing these vulnerabilities is available.
A denial of service vulnerability exists in XZ Utils due to a buffer overflow in index decoding. This flaw affects versions of the xz utility prior to 5.2.5-8.el9_8.1. The issue has been rated as moderate severity by Red Hat and is fixed in version 5.2.5-8.el9_8.1.
OpenJPEG versions 2.4.0 through 2.5.4 and git master through commit 8314119b contain an out-of-bounds read and write vulnerability in the function opj_dwt_encode_and_deinterleave_v() located in src/lib/openjp2/dwt.c. This flaw can be exploited to cause a denial of service condition.
CVE-2026-111497, known as Node2Shell, HTTP2Shell, or Broccoli2Shell, is a remote code execution vulnerability in the Brotli decoder used by official, unmodified Node.js builds. A malformed Brotli compressed request body can trigger an out-of-bounds write, resulting in a shell on the target system. This has been reproduced on x86-64 systems against multiple Node.js targets including plain node:http, official slim images, Express 5.3.0, and Koa 3. The vulnerability arises from improper handling of block switches in Brotli streams, leading to memory corruption and arbitrary code execution. A public scanner is actively mapping Brotli-capable hosts, indicating reconnaissance activity preceding exploitation.
A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
CVE-2026-116056 is a server-side request forgery (SSRF) vulnerability in KodCloud KodExplorer affecting versions 4.0 through 4.19. The flaw exists in the request_url_safe function within the Remote Download component, allowing remote attackers to manipulate server requests. The vendor has not responded to disclosure, and no patch or fix information is available. The vulnerability has a medium severity rating with a CVSS score of 5.3.
vLLM versions from 0.20.0 up to but not including 0.30.0 contain a denial of service vulnerability. Remote attackers can crash the engine by sending malformed multimodal metadata to the /inference/v1/generate endpoint. This causes a negative text span in Qwen2.5-VL position construction, terminating the engine. The issue is fixed in version 0.30.0.
Rclone versions from 1.68.0 up to but not including 1.75.2 contain an authorization bypass vulnerability in the serve s3 --auth-proxy feature. This flaw allows authenticated tenants to manipulate multipart uploads of other tenants by referencing their upload IDs. Attackers who know a victim's bucket, object, and upload ID can inject parts, complete, or abort ongoing uploads and view metadata across tenants. The vulnerability has a medium severity with a CVSS score of 5.0.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability in the handling of XMP profiles by various decoders. An attacker can supply images with crafted XMP profiles that cause memory to leak each time they are processed, potentially leading to resource exhaustion and denial of service. The vulnerability has a medium severity rating with a CVSS score of 5.3.
vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.