A critical deserialization of untrusted data vulnerability (CVE-2026-112857) exists in axiomthemes Reprizo plugin versions up to 1.0.8. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating severe impact. No patch or remediation details are provided in the available data.
A critical deserialization of untrusted data vulnerability (CVE-2026-112858) exists in axiomthemes Rhodos theme versions up to 1.3.3. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 9.8, indicating high severity and ease of remote exploitation without privileges or user interaction.
CVE-2026-112859 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Little Birdies product, affecting versions from 0 up to and including 1.3.16. This vulnerability allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8, indicating a highly severe issue exploitable remotely without privileges or user interaction.
A critical deserialization of untrusted data vulnerability (CVE-2026-112855) exists in axiomthemes Redy up to version 1.3.5. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating high severity. No patch or remediation information is currently provided.
CVE-2026-112863 is a reflected cross-site scripting (XSS) vulnerability in Hogash KALLYAS affecting versions up to and including 4.25.0. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This can lead to partial compromise of confidentiality, integrity, and availability. The vulnerability has a high severity score of 7.1 (CVSS 3.1). No patch or remediation information is currently provided.
Aokigahara is a newly observed infostealer malware that targets a wide range of sensitive data on Windows systems. It steals traditional credentials such as browser passwords, cookies, cryptocurrency wallets, VPN and FTP client data, email profiles, and password manager files. Uniquely, it also targets AI applications and developer tools including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, collecting authentication files, session tokens, and configuration data. The malware additionally targets cloud environment credentials for AWS, Azure, and Google Cloud, as well as developer environment secrets like Git credentials and SSH private keys. Stolen AI and cloud credentials could enable unauthorized access to paid AI services, cloud resources, and source code repositories. The malware includes capabilities such as screenshot capture, clipboard theft, and a clipper component for cryptocurrency manipulation. There is no confirmed information on how the stolen data is monetized. No patch or remediation guidance is provided.
CVE-2026-115730 is a low-severity vulnerability in i18next-http-backend versions 4.0.2 up to but not including 4.0.3. It involves an incomplete fix in the interpolateUrl() function that allows attackers controlling the namespace (ns) value to redirect translation requests by supplying a namespace starting with a slash. This can lead to loading attacker-hosted translations, enabling UI content injection and cross-site scripting (XSS).
CVE-2026-115729 is a server-side request forgery (SSRF) vulnerability in the pdfme common library versions from 5.5.10 up to but not including 6.2.6. The flaw allows attackers to bypass the isUrlSafeToFetch denylist in the getB64BasePdf function by using specially crafted basePdf URLs with IPv4-mapped IPv6, [::], NAT64, or localhost alias hostnames. This enables reading of loopback, internal, or cloud metadata responses through generated PDF documents.
@hapi/content versions 6.0.1 through before 6.0.3 contain a regular expression denial of service (ReDoS) vulnerability in the Content.disposition() function. This issue arises from an incomplete fix for a previous vulnerability (CVE-2026-35213). An unauthenticated remote attacker can exploit this by sending multipart uploads with a long Content-Disposition parameter that lacks an equals sign, causing quadratic backtracking that blocks the event loop.
Hewlett Packard Enterprise (HPE) released security updates addressing 72 vulnerabilities in ArubaOS, including eight maximum-severity flaws involving authentication bypass and remote code execution (RCE). These critical vulnerabilities affect multiple versions of AOS-8 and AOS-10 and can be exploited remotely without privileges or user interaction. HPE strongly urges customers to apply patches promptly and recommends restricting access to management interfaces to reduce exploitation risk. No public exploit code or active exploitation has been reported as of the advisory date.
PHP2Shell refers to two critical PHP engine vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. These flaws have been exploited in attempts to spread a Mirai-derived botnet variant named Potassium. Despite multiple exploitation attempts and the emergence of an ASLR bypass exploit, no confirmed successful compromises have been reported. The vulnerabilities were patched on October 21, 2026, with PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations have taken precautionary measures including taking systems offline during patching. Exploits require uncommon server configurations and detailed knowledge, limiting their effectiveness in typical production environments.
The PyPI package 'onsokets' version 0.1.0 contains malicious code designed for automated file exfiltration, targeting Android devices. This package is part of a campaign identified as 2026-10-proxyrubika, which has clear malicious intent related to information stealing.
Formbook malware has resurfaced using localized business-order themed lures targeting European users and manufacturing organizations. The attack chain involves JavaScript, hidden PowerShell scripts, an AES-encrypted .NET payload, and process hollowing of aspnet_compiler.exe to execute Formbook. Persistence is maintained via SystemUpdate_* shortcuts and related artifacts. Network detection includes Formbook command-and-control check-ins flagged by Suricata. Indicators of compromise (IOCs) include specific domain names and file hashes. No direct patch or remediation is indicated in the source information.
A path traversal vulnerability (CWE-22) exists in flatpak's xdg-desktop-portal prior to version 1.22.1. Malicious sandboxed applications can exploit the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host system, limited to files accessible by the user. The vulnerability arises because filenames passed to the method are not properly validated by the frontend or common backends, allowing path traversal. This issue has been patched in version 1.22.1.
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1.
A vulnerability in the Linux kernel's dpaa2-switch component was fixed by correcting the error handling in the dpaa2_switch_rx() function. The issue involved improper use of dpaa2_switch_free_fd() on receive frame descriptors, which expects a valid socket buffer pointer but was incorrectly called on descriptors without one. The fix moves dma_unmap_page() handling directly into dpaa2_switch_rx(), ensuring proper memory freeing depending on whether an SKB was created.
A vulnerability in the Linux kernel's wifi nl80211 component was resolved by adding a check to ensure the link is beaconing before performing a color change. This prevents the driver from being called with an invalid link state.
A reference leak vulnerability was identified and fixed in the Linux kernel's ThunderX network driver. The flaw involved the cavium_ptp_get() function acquiring a reference to a PTP PCI device, which was not properly released if initialization failed, causing a resource leak.
A vulnerability in the Linux kernel ALSA sequencer OSS interface was resolved. The snd_seq_oss_read() function incorrectly checks buffer sizes when reading queued events, causing improper handling of undersized reads. This could lead to events being copied incorrectly or left queued, potentially causing unexpected behavior in applications reading sequencer events.
A vulnerability in the Linux kernel's media video-i2c driver was resolved by correcting the driver removal process. The fix involves using vb2_video_unregister_device() instead of video_unregister_device() to properly disconnect the vb2 queue before unregistering the video device.