CVE-2026-119298 is a vulnerability in croc versions prior to 11.5.2 where the receive-side file-readiness loop improperly trusts sender-controlled basenames starting with 'croc-stdin-'. This allows a remote sender, upon user acceptance of the transfer, to overwrite or truncate existing files or replace them with empty files or symlinks without confirmation. The issue is limited to predictable filenames in the 'croc-stdin-' namespace and does not affect dotfiles or symlink targets outside the receive directory. The vulnerability is fixed in version 11.5.2.
CVE-2026-119148 is a vulnerability in AWS aws-nitro-enclaves-sdk-c before version 0.4.6 involving incomplete string validation. This flaw may allow an attacker to impersonate the AWS KMS endpoint. The issue is fixed in version 0.4.6, and users are advised to rebuild any custom enclave images using the updated SDK version.
Microsoft Threat Intelligence analyzed two human-operated intrusion cases where attackers used Microsoft Teams to impersonate IT support and socially engineer users into granting remote access via Quick Assist. The attackers then staged portable runtimes, performed host and network discovery, and abused Active Directory Certificate Services (AD CS) to obtain authentication certificates for privileged accounts. Two distinct AD CS abuse techniques were observed: ESC1 template abuse allowing certificate issuance for privileged accounts, and ESC8 NTLM relay to AD CS Web Enrollment to obtain domain-controller certificates. These certificate-based authentications enabled persistent privileged access independent of passwords. The incidents highlight risks from social engineering combined with insecure or overly permissive AD CS configurations rather than software vulnerabilities. Microsoft Defender detections and containment effectiveness varied between cases, influencing the extent of attacker progression.
CVE-2026-104623 is an authentication bypass vulnerability in SUSE Rancher Manager versions 2.11.0 up to 2.11.19, 2.12.0 up to 2.12.15, 2.13.0 up to 2.13.11, 2.14.0 up to 2.14.7, and 2.15.0 up to 2.15.3. The flaw exists in the authorization handling of the local management cluster shell feature, where some API routes bypass the intended access checks. This allows any authenticated user to run a pod on the management cluster without proper authorization. The vulnerability has a medium severity with a CVSS score of 6.3. Fixed versions are available for all affected release lines.
CVE-2026-62055 is a missing authorization vulnerability in Liquid Web / StellarWP Event Tickets plugin versions before 5.30.3. It allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functions. The issue is fixed in version 5.30.3.
CVE-2026-119365 is a stored cross-site scripting (XSS) vulnerability in the Media Player Addons for Elementor – Media Player widget for WordPress. The flaw is due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Versions from initial release up to 1.1.10 are affected. The vulnerability has a medium severity with a CVSS score of 6.5. It was fixed in version 1.1.11.
CVE-2026-119116 is a high-severity use-after-free and double-free vulnerability in the SetClient command handler of the kmstool-enclave sample application within AWS aws-nitro-enclaves-sdk-c versions before 0.4.6. This flaw allows an application running on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave, potentially leading to arbitrary code execution within the enclave. AWS has fixed this issue in version 0.4.6 of the SDK. Users should rebuild any enclave images that include kmstool-enclave or derived code against the fixed version to mitigate the risk.
CVE-2026-119367 is a missing authorization vulnerability in Liquid Web / StellarWP The Events Calendar plugin affecting versions prior to 6.18.3. This flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized users with limited privileges to perform actions they should not be allowed to. The issue is fixed in version 6.18.3.
CVE-2026-61789 is a vulnerability in bytebase's dbhub prior to version 0.22.6 that allows bypassing read-only SQL validation on MySQL and MariaDB connectors. The issue arises from a mismatch in comment parsing between the SQL validator and the database connectors, enabling an attacker to hide write or destructive statements from validation. This can lead to unauthorized modification or deletion of database data if the attacker can influence SQL input. The vulnerability does not affect PostgreSQL due to consistent parsing and execution behavior. The issue is fixed in version 0.22.6.
Cybercriminals exploit the popularity of ebooks by distributing malware disguised as ebook files, using search result manipulation, phishing scams, and fake pirate library sites. These attacks can lead to malware infections such as cryptocurrency miners and infostealers, data leaks including personal and financial information, and fraudulent charges via fake bookstore sites. E-readers themselves are less commonly targeted, but vulnerabilities exist in advanced models. Users' reading histories and personal data can also be exposed through data leaks or account compromises. Safe practices include using official bookstores, keeping devices and apps updated, and avoiding unofficial firmware.
CVE-2026-119291 is a vulnerability in zuke-build's zuke automation system prior to version 1.4.0. It involves improper handling of symbolic links during setup and import operations, allowing an attacker to supply a malicious repository or template with symbolic links that cause files outside the intended directory to be overwritten with the user's permissions. This can lead to unauthorized modification of files. The issue is fixed in version 1.4.0.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.
CVE-2026-104615 is an authentication bypass vulnerability in SUSE Rancher Fleet's cluster registration flow affecting multiple versions before fixed releases. The flaw allows a registration request to claim a cluster identity without proper binding to the registration token, enabling association with a different managed cluster's identity. This could lead to unauthorized actions on clusters.
Zuke-build versions prior to 1.10.0 contain a vulnerability in the @zuke/gh githubWorkflow(...) gate where it insufficiently verifies the authenticity of dispatched workflow runs. The gate relies solely on a display-title marker visible in the workflow run list, which can be spoofed by an attacker with workflow_dispatch permission in an external repository. This allows an attacker to substitute a workflow run conclusion, potentially authorizing unvalidated releases or blocking valid ones. The issue is resolved in version 1.10.0.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.
CVE-2026-119287 is a missing authorization vulnerability in zuke-build's zuke prior to version 1.51.0. The vulnerability allows a registry writable by another party to specify commands and arguments that can be executed with the operator's environment and workspace access when using the mcp registry mode with the --allow-run option. This issue does not affect the local default registry or descriptors that enforce authorization. The flaw is fixed in version 1.51.0.
Python's ssl module has been updated to include a denylist of known compromised intermediate certificates. This enhancement ensures that these certificates are automatically rejected, improving security even if certificate revocation is not configured. The vulnerability affects multiple Python versions prior to their respective fixed releases.
Parse Server versions before 8.6.101 and from 9.0.0 up to but not including 9.10.4 have a missing authorization vulnerability affecting MongoDB deployments. This flaw allows unauthenticated attackers to delete the stored schema of any class by sending REST API delete requests to the internal _SCHEMA collection. Such unauthorized deletions can remove field definitions, class-level permissions, and protected fields, potentially exposing data to unauthorized reads and modifications. The issue is fixed in versions 8.6.101 and 9.10.4.
Parse Server versions before 8.6.100 and from 9.0.0 up to but not including 9.10.4 allow clients to write reserved internal field names in object writes. This vulnerability enables attackers to disrupt object reads on MongoDB by injecting reserved fields, affecting all users querying that class. Additionally, attackers can clear their own account lockout state and password history, bypassing lockout and password policies.
Parse Server versions before 8.6.102 and from 9.0.0 up to but not including 9.10.5 contain an authentication bypass vulnerability. This occurs because custom AuthAdapter subclasses do not have their validateSetUp, validateLogin, and validateUpdate methods called, causing the system to fall back to a default that accepts any authentication data. This flaw allows attackers to supply arbitrary authentication data to sign up, link identities, log in as existing users, or bypass additional authentication factors.