CVE-2026-79979 is a use-after-free vulnerability in the Zephyr project affecting arm64 builds with CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled. The issue arises from improper TLB invalidation that only targets ASID 0, allowing stale translations for other ASIDs to persist. This flaw enables unprivileged user threads to access and modify kernel or other domain memory, breaking memory isolation and potentially leading to full system compromise. The vulnerability affects Zephyr versions from 4.3.0 up to but not including 4.5.0. A fix has been implemented to correct the TLB invalidation to cover all ASIDs and preserve proper memory domain permissions.
CVE-2026-79978 is a low-severity vulnerability in the Zephyr RTOS affecting the ADXL345 accelerometer driver. The issue arises from out-of-bounds writes during FIFO data processing when the allocated buffer is smaller than a full batch. This can cause silent data corruption or crashes due to memory corruption in the RTIO block pool. Exploitation requires specific hardware configuration and buffer pool starvation conditions.
CVE-2026-79977 is a vulnerability in the WireGuard VPN implementation within Zephyr (subsys/net/lib/wireguard/wg.c) that allows an attacker to spoof the peer endpoint address without authentication. This occurs because the code updates the peer endpoint from unauthenticated messages when the receiver index does not match any session. The flaw enables an attacker to redirect traffic to an arbitrary address, causing denial of service or limited traffic interception without decrypting or forging tunnel content. The vulnerability affects Zephyr versions from 4.4.0 through 4.4.2. A fix removes unauthenticated endpoint updates and restricts handshake initiation to authenticated endpoints or configured endpoints. WireGuard in Zephyr is experimental and not enabled by default.
Zephyr's OpenThread integration used a default, publicly known Joining Device Credential (PSKd) "J01NME" when the joiner autostart feature was enabled but the PSKd was not overridden. This allowed an attacker within radio range to authenticate as a commissioner and provision the device with a malicious operational dataset, effectively taking control of the device's Thread network connection. The vulnerability affects Zephyr versions from 1.14.0 up to but not including 4.5.0. A fix was implemented to remove the default PSKd and enforce build-time checks requiring a unique PSKd when joiner autostart is enabled.
CVE-2026-115797 is a vulnerability in the Tenda F6 router's Web Management Interface version 12.02.01.73. It involves cleartext transmission of sensitive information due to manipulation of the ecos_pw argument. The vulnerability can be exploited remotely but requires high complexity and is considered difficult to exploit. No patch information is provided. The CVSS score is 6.3, indicating a medium severity risk.
The php2shell vulnerability involves complex exploitation steps requiring specific memory conditions and environment setups. Proofs of concept (PoCs) published so far rely on artificial conditions such as low memory limits and single-worker configurations, which are uncommon in real-world deployments. The exploit involves leaking memory addresses to defeat ASLR and modifying function pointers to execute commands, but command size is limited. Disabling session.upload_progress is recommended as a mitigation until an official fix is available.
pypdf versions prior to 6.21.2 contain a vulnerability where repeated malformed cross-reference entries can cause excessive resource consumption by triggering complete PDF stream reloads during recovery attempts. This issue leads to long runtimes when processing crafted PDF files. The vulnerability is fixed in version 6.21.2.
A vulnerability in the pypdf library prior to version 6.21.2 allows an attacker to craft a PDF file with a cross-reference table declaring more entries than the file actually contains. This causes the library to perform excessive iteration, leading to long processing times when opening the file. The issue is addressed in version 6.21.2.
pypdf versions prior to 6.21.2 contain a vulnerability where an attacker can craft a PDF that repeatedly references the same nonexistent indirect object. This causes repeated full-file recovery loads and long runtimes when accessing certain file parts such as pages. The issue is fixed in version 6.21.2.
virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.
An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script.
AWS fixed this issue service-side. No customer action is required.
Microsoft Teams will introduce an AI-powered, context-aware phishing detection feature starting in early November 2026. This feature aims to identify phishing, social engineering, impersonation attempts, and deceptive intent by analyzing conversation context, particularly focusing on external first-contact chats. The system does not retain message content for AI training or other secondary uses and requires no action from IT administrators to enable. This enhancement is part of a broader set of security improvements in Teams designed to reduce phishing and fraud risks.
The LiteLLM 1.107.0 Python package was compromised and published to PyPI, distributing malicious code that executed automatically during Python interpreter startup. The payload collected a wide range of credentials including developer, cloud, browser, SSH, and environment variables, then encrypted and exfiltrated this data to attacker-controlled endpoints. The compromise originated from stolen developer GitHub credentials used to alter the release workflow. The malicious code executed without requiring explicit import of LiteLLM, affecting any environment where Python was started with the compromised package installed. Recovery requires more than removing the package; affected Python environments, running processes, and exposed credentials must be addressed. Microsoft Defender provides detection and hunting guidance. No patch or fixed version is explicitly stated.
A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation
of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.
The Otter Blocks WordPress plugin versions before 3.2.8 contain a vulnerability where user-supplied block styling values are not properly sanitized and escaped before being written into inline stylesheets. This flaw allows users with contributor-level access or higher to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post. The vulnerability is identified as CVE-2026-109933 and has a CVSS score of 6.8, indicating a medium severity level.
The Otter Blocks WordPress plugin versions before 3.2.8 contains a vulnerability where a pattern used to rewrite dynamic-content tokens is not properly bounded. This flaw allows the pattern to consume the quote closing an HTML attribute and incorporate adjacent unescaped data as new attributes. As a result, unauthenticated users can perform stored Cross-Site Scripting (XSS) attacks that execute in the browsers of any visitors viewing the affected page, including logged-in administrators.
The Otter Blocks WordPress plugin versions before 3.2.8 improperly handle access control for post data via a REST API endpoint. It treats any post with published status as publicly readable, allowing unauthenticated users to access manual excerpts of password-protected posts, content and titles of non-public post types, and on WooCommerce sites, coupon codes and their descriptions. This vulnerability can lead to unauthorized information disclosure.
The Popup Builder WordPress plugin versions before 4.4.6 contain a vulnerability where authorization checks are not performed before trashing popup content during a maintenance routine triggered by unauthenticated requests. This flaw allows unauthenticated attackers to move popups into the Trash and overwrite their preview data.
The User Profile Builder WordPress plugin versions before 4.0.5 contain a vulnerability where one shortcode attribute is not properly sanitized and escaped before being output in a redirect message. This flaw allows users with contributor-level permissions to perform stored cross-site scripting (XSS) attacks against users with higher privileges who submit the affected form.
The User Profile Builder WordPress plugin versions before 4.0.5 contain an authorization bypass vulnerability. This flaw allows an Administrator of a Multisite subsite to edit any user's account email via the front-end Edit Profile form without proper authorization checks. Exploiting this, an attacker can change the email of a Network Super Admin account and potentially take over that account through the password reset process.