Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
The npm package 'ourin-baileys' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.
The apex-fetch npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
Wekan versions prior to 11.11 contain a vulnerability where user-controlled input is passed to regular expressions without escaping, leading to inefficient regular expression complexity. This allows authenticated users with board membership or site-admin status to craft expressions that cause catastrophic backtracking, consuming excessive database CPU and potentially causing denial of service. The issue is fixed in version 11.11.
CVE-2026-119299 is an out-of-bounds read vulnerability in the gopacket library prior to version 1.7.2. It affects the SCTP chunk chain decoding in layers/sctp.go, where attacker-controlled lengths and counts are passed to sub-decoders without proper bounds checking. This can cause out-of-bounds or inverted slice panics, potentially terminating applications that disable decode recovery or have specific panic handling enabled. The vulnerability impacts availability only and does not lead to data disclosure or modification. The issue is fixed in gopacket version 1.7.2.
CVE-2026-115642 is an incorrect authorization vulnerability in OpenStack keystonemiddleware versions before 13.0.2. An attacker with access to a restricted application credential can bypass restrictions by supplying a custom X-Service-Token header, leading to privilege escalation.
The grizzly-baileys npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control.
CVE-2026-119466 is a Cross-Site Request Forgery (CSRF) vulnerability in the WPExperts APIExperts Square for WooCommerce plugin, affecting versions prior to 4.7.6. This flaw allows an attacker to trick authenticated users into performing unwanted actions without their consent. The vulnerability has been assigned a medium severity with a CVSS score of 5.4. A fix is available in version 4.7.6.
CVE-2026-65566 is a Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine versions prior to 3.8.9. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability affects AI Engine versions from the initial release up to 3.8.8 and has a high severity rating with a CVSS score of 8.8. A fix is available in version 3.8.9.
CVE-2026-119298 is a vulnerability in croc versions prior to 11.5.2 where the receive-side file-readiness loop improperly trusts sender-controlled basenames starting with 'croc-stdin-'. This allows a remote sender, upon user acceptance of the transfer, to overwrite or truncate existing files or replace them with empty files or symlinks without confirmation. The issue is limited to predictable filenames in the 'croc-stdin-' namespace and does not affect dotfiles or symlink targets outside the receive directory. The vulnerability is fixed in version 11.5.2.
CVE-2026-119148 is a vulnerability in AWS aws-nitro-enclaves-sdk-c before version 0.4.6 involving incomplete string validation. This flaw may allow an attacker to impersonate the AWS KMS endpoint. The issue is fixed in version 0.4.6, and users are advised to rebuild any custom enclave images using the updated SDK version.
Microsoft Threat Intelligence analyzed two human-operated intrusion cases where attackers used Microsoft Teams to impersonate IT support and socially engineer users into granting remote access via Quick Assist. The attackers then staged portable runtimes, performed host and network discovery, and abused Active Directory Certificate Services (AD CS) to obtain authentication certificates for privileged accounts. Two distinct AD CS abuse techniques were observed: ESC1 template abuse allowing certificate issuance for privileged accounts, and ESC8 NTLM relay to AD CS Web Enrollment to obtain domain-controller certificates. These certificate-based authentications enabled persistent privileged access independent of passwords. The incidents highlight risks from social engineering combined with insecure or overly permissive AD CS configurations rather than software vulnerabilities. Microsoft Defender detections and containment effectiveness varied between cases, influencing the extent of attacker progression.
CVE-2026-104623 is an authentication bypass vulnerability in SUSE Rancher Manager versions 2.11.0 up to 2.11.19, 2.12.0 up to 2.12.15, 2.13.0 up to 2.13.11, 2.14.0 up to 2.14.7, and 2.15.0 up to 2.15.3. The flaw exists in the authorization handling of the local management cluster shell feature, where some API routes bypass the intended access checks. This allows any authenticated user to run a pod on the management cluster without proper authorization. The vulnerability has a medium severity with a CVSS score of 6.3. Fixed versions are available for all affected release lines.
CVE-2026-62055 is a missing authorization vulnerability in Liquid Web / StellarWP Event Tickets plugin versions before 5.30.3. It allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functions. The issue is fixed in version 5.30.3.
CVE-2026-119365 is a stored cross-site scripting (XSS) vulnerability in the Media Player Addons for Elementor – Media Player widget for WordPress. The flaw is due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Versions from initial release up to 1.1.10 are affected. The vulnerability has a medium severity with a CVSS score of 6.5. It was fixed in version 1.1.11.
CVE-2026-119116 is a high-severity use-after-free and double-free vulnerability in the SetClient command handler of the kmstool-enclave sample application within AWS aws-nitro-enclaves-sdk-c versions before 0.4.6. This flaw allows an application running on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave, potentially leading to arbitrary code execution within the enclave. AWS has fixed this issue in version 0.4.6 of the SDK. Users should rebuild any enclave images that include kmstool-enclave or derived code against the fixed version to mitigate the risk.
CVE-2026-119367 is a missing authorization vulnerability in Liquid Web / StellarWP The Events Calendar plugin affecting versions prior to 6.18.3. This flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized users with limited privileges to perform actions they should not be allowed to. The issue is fixed in version 6.18.3.
CVE-2026-61789 is a vulnerability in bytebase's dbhub prior to version 0.22.6 that allows bypassing read-only SQL validation on MySQL and MariaDB connectors. The issue arises from a mismatch in comment parsing between the SQL validator and the database connectors, enabling an attacker to hide write or destructive statements from validation. This can lead to unauthorized modification or deletion of database data if the attacker can influence SQL input. The vulnerability does not affect PostgreSQL due to consistent parsing and execution behavior. The issue is fixed in version 0.22.6.