File Browser v2.63.15 has a vulnerability where deleting a shared directory using a path with a trailing slash fails to remove the associated public share. This occurs because the database query for shares uses the unnormalized path, missing the exact share path without the trailing slash. As a result, if the directory is recreated later, the stale public share becomes active again, exposing the new directory contents through the old public URL. The issue affects versions prior to 2.63.17 and is fixed in 2.63.17.
The npm package @jelou/cli-win32-x64 version 4.26.1 contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
PrestaShop versions before 8.2.9 and 9.2.1 have an authorization bypass vulnerability in multi-shop setups. Authenticated Webservice API key holders can read and modify customer records across shops without proper ownership checks. This flaw allows attackers to access sensitive customer data including password hashes and secure keys, and to change customer emails and passwords, potentially leading to account takeover.
CVE-2026-71531 is an authorization vulnerability in PrestaShop versions before 8.2.9 and 9.2.1 affecting the Webservice API. It allows attackers with a restricted shop key to bypass shop-specific access controls by manipulating the id_shop parameter to access data from all shops. This flaw enables unauthorized reading, modification, or deletion of data across shops, including sensitive customer information such as email addresses, secure keys, and password hashes.
CVE-2026-129180 is a SQL injection vulnerability in projectworlds Visitor Management System version 1.0. The flaw exists in the mysqli_query function within the actionpage.php file, where manipulation of the 'purpose' argument allows remote attackers to execute SQL injection attacks. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code has been published, but there is no indication of active exploitation in the wild. No patch or remediation information is currently available.
NLTK versions prior to 3.10.4 contain an untrusted search path vulnerability in the nltk.parse.dependencygraph.dot2img function. This function resolves the Graphviz dot executable via the PATH environment variable but does not perform ownership or writability validation on the resolved executable. A local low-privileged attacker with write access to a directory in the victim's PATH can replace or plant a malicious dot executable, leading to code execution when dot2img or DependencyGraph.repr_svg is invoked. This issue is fixed in version 3.10.4.
A security flaw has been discovered in Stirling-Tools Stirling-PDF up to 3.3.0. Affected is the function WorkflowParticipantController.getParticipantDetails of the file app/proprietary/src/main/java/stirling/software/proprietary/workflow/controller/WorkflowParticipantController.java of the component Participant Details Endpoint. Performing a manipulation results in insufficient session timeout value. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
A malicious file identified by the SHA-256 hash ed968e840d10d2d313a870bc131a4e2c311d7ad09bdf32b3418147221f51a6e2 was observed by OffSeq Mirage honeypot sensors during attacker activity between November 13 and 14, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Brazil. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
IBM DataStage on Cloud Pak for Data version 5.4.0.0 contains a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability is identified as CWE-918 and has a CVSS 3.1 base score of 6.4, indicating a medium severity level. Exploitation requires authentication and does not involve user interaction. No public exploits or known active exploitation have been reported. The affected product is not a cloud service, and no patch or remediation details are currently provided.
IBM Security QRadar EDR versions 3.12.0 through 3.12.26 contain an improper access control vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability but has a medium severity rating based on its potential to disclose confidential data.
IBM Security QRadar EDR versions 3.12.0 through 3.12.26 contain a vulnerability where improper rate limiting on TOTP verification allows a remote authenticated attacker to bypass security restrictions. This flaw could enable attackers with valid credentials to perform excessive authentication attempts without being blocked, potentially compromising confidentiality and integrity of the system.
CVE-2026-109158 is a vulnerability in IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands where sensitive information may be logged within error messages by the AI Agent. This exposure could allow unauthorized parties to access sensitive environment details through log files.
The rush-mfa npm package contains malicious code that compromises any computer on which it is installed or running. Systems affected by this package should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
CVE-2026-115788 is a high-severity vulnerability in IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands. It involves improper output neutralization for logs (CWE-117), which can lead to log forging when creating a resource. The vulnerability affects multiple versions of the product series 12.x and 13.x. No public exploits or patches are currently documented.
CVE-2025-43874 is a high-severity OS Command Injection vulnerability in Johnson Controls iSTAR Ultra series devices. It affects multiple product variants including iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2 versions prior to 6.9.2.CU02. The flaw arises from improper neutralization of special elements used in OS commands, potentially allowing an attacker with low privileges to execute arbitrary OS commands. A fix is available in version 6.9.2.CU02.
CVE-2026-114468 is a vulnerability in IBM App Connect Operator and App Connect Enterprise Certified Containers Operands where hard-coded credentials allow an attacker with the ability to run HTTP calls inside the container to make administrative calls to a running IntegrationRuntime. This could lead to unauthorized modification or disruption of the service.
CVE-2025-53700 is a medium severity vulnerability in Johnson Controls iSTAR Ultra and related products that involves insecure storage of sensitive information. This flaw affects multiple iSTAR Ultra variants prior to version 6.9.2.CU02 and allows file manipulation as described by CAPEC-15. The vulnerability has been fixed in version 6.9.2.CU02.
IBM Bob version 2.0.3 has a vulnerability where unauthorized extensions can retrieve session tokens through the authentication provider API. These tokens are exposed in the account identifier field during account enumeration without explicit user consent. This exposure could allow malicious extensions to access sensitive session information. The vulnerability has a low severity rating and does not appear to have known exploits in the wild.
CVE-2025-53699 is a high-severity vulnerability in Johnson Controls iSTAR Ultra series devices caused by a missing protection mechanism for an alternate hardware interface. This flaw affects multiple iSTAR Ultra product variants prior to version 6.9.2.CU02 and allows functionality bypass as described by CAPEC-554. The vulnerability has been fixed in version 6.9.2.CU02.
IBM webMethods Integration Server versions 10.15 through 10.15_Core_Fix2 and 11.1 through 11.1_Core_Fix11 contain a vulnerability that allows remote attackers to access sensitive server-side environment variables and Java runtime details. This exposure could lead to unauthorized disclosure of critical information.