crawlseo versions before 0.2.5 store Google OAuth access and refresh tokens in cleartext within the User.googleTokens database column. This vulnerability allows attackers who have read access to the Postgres database to obtain long-lived refresh tokens in plaintext. With these tokens, attackers can gain indefinite, unauthenticated access to all registered users' Google Search Console data. The vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information).
Next.js versions 13.0.0 up to but excluding 15.5.28, and 16.0.0 up to but excluding 16.4.1, have a vulnerability in App Router applications using Server Actions. Crafted requests can cause excessive CPU usage and block processing of further requests in the same process. Applications using the Pages Router or App Router without Server Actions are not affected. The issue is fixed in versions 15.5.28 and 16.4.1.
CVE-2026-16477 is a high-severity vulnerability in CleanShot X for macOS where the application insecurely deserializes untrusted data embedded in .cleanshot project files. An attacker can craft a malicious .cleanshot file that, when opened by a user, triggers automatic execution of arbitrary code with the current user's privileges. This issue affects versions prior to 4.5.2, 4.6.3, 4.7.8, and 4.8.10, which contain the fixes.
Multiple security issues were identified in the libXi client-side library for the X Input Extension, leading to a high severity vulnerability (CVE-2026-109089). These issues affect versions of libXi prior to 1.8-5.oe2203sp4. The vulnerabilities have a CVSS 3.1 base score of 7.5, indicating high impact on confidentiality, integrity, and availability. Official security fixes have been released to address these problems.
A vulnerability in MIT Kerberos 5 (krb5) through version 1.22.2 allows authenticated clients to cause a denial of service by triggering a NULL pointer dereference. This occurs when mismatched KRB-CRED arrays are sent, specifically when forwarded credentials contain more tickets than ticket_info entries, crashing GSS-API acceptor services.
Two critical remote code execution vulnerabilities in PHP, collectively named PHP2Shell, were disclosed on October 21, 2026. CVE-2026-109618 involves out-of-memory handling corruption that can interrupt PHP while internal request data is partially initialized, leading to invalid data treatment. CVE-2026-109619 exploits stale global state where request-owned internal state survives after memory is freed. Both vulnerabilities can be exploited successfully on ARM64 systems and x86 systems without ASLR. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Over 2.6 million internet-facing hosts running PHP were identified as vulnerable, with 42% on end-of-life branches receiving no official patches. Early exploitation attempts were observed from multiple sources, including scanning activity and webshell deployment attempts targeting the upload-progress vulnerability path.
A vulnerability in multer versions 2.0.0 through before 2.5.0 allows a Node.js process to crash when using an asynchronous fileFilter. If a request is aborted while the asynchronous fileFilter is pending, an unhandled error event occurs due to a resumed parsing stream without an error listener, causing the process to exit. This issue is fixed in multer 2.5.0.
CVE-2026-89410 is a vulnerability in Silicon Labs Z-Wave SDK versions up to and including 8.1.1. It involves improper validation of specified index, position, or offset in input, where a malformed NCP SPI command can cause out-of-bounds reads that leak sensitive information. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.
CVE-2026-85079 is a stack-based buffer overflow vulnerability in Silicon Labs EmberZNet versions 9.1.1 and earlier. It occurs when a malformed Simple_Desc_req response is processed, leading to an out-of-bounds write. Exploitation requires the response to come from a device already joined to the network and the attacker must wait for a Simple_Desc_req before launching the attack. The vulnerability has a high severity with a CVSS 4.0 score of 7.5.
AWS Threat Intelligence detected exploitation attempts of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) starting on October 17, 2026, four days before the public disclosure and patch release on October 21, 2026. Multiple actors used anonymized infrastructure to target honeypots and real systems, with proof-of-concept exploits appearing immediately after the embargo lifted. Fixed PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address these vulnerabilities, with backports available for versions 7.4 through 8.1. The event highlights the shrinking window between patch release and exploitation and the need for proactive detection and investigation starting before public disclosure.
CVE-2026-115246 is a cross-site scripting (XSS) vulnerability in the subhajitkhan online-clinic-management-system affecting the patdocmsg.php file. It results from improper handling of the 'Query' argument, enabling remote attackers to execute script code. The vulnerability has been publicly disclosed with available exploit code, but no fix or response has been issued by the project. It has a medium severity rating with a CVSS 4.0 score of 5.1.
A critical vulnerability (CVE-2026-102785) affects the YOOtheme Pro extension for Joomla versions 5.0.0 through 5.0.52. The flaw involves an unauthenticated remote code execution via an image transformation handler that improperly validates request signatures. Attackers can reuse legitimate signatures to inject additional image operations, traverse directories, and upload a malicious PNG/PHP polyglot file to a publicly accessible media directory.
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. These bugs were discovered in August 2026 and patched by PHP on October 21, 2026, with updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Exploitation attempts were detected before and after the patch release, including mass exploitation attempts shortly after fixes were published. Multiple vendors and governments have issued advisories urging immediate patching and thorough discovery of PHP installations, including those embedded in other software. Some organizations temporarily took affected sites offline to mitigate risk. Security firms have released detections and mitigations, and many vendors are reviewing their products for exposure. The vulnerabilities require precise conditions for exploitation but have been actively targeted in the wild.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
A missing authorization vulnerability exists in Cozmoslabs Paid Member Subscriptions plugin versions up to 3.1.2. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation information is provided in the available data. There are no known exploits in the wild at this time.
fzf versions 0.36.0 through 0.74.5 contain an inefficient algorithmic complexity vulnerability in the maskActionContents function. This flaw allows local attackers to exhaust the single-threaded --listen HTTP server by sending large POST requests, causing it to block for about 30 seconds per request due to quadratic string concatenation.
PHP2Shell refers to two critical remote code execution vulnerabilities in PHP disclosed in October 2026. Exploitation attempts began days before official patches were released, with mass scanning and exploitation activity observed immediately after patch publication. Although multiple proof-of-concept exploits circulated rapidly, many were ineffective or caused crashes rather than successful exploitation. The vulnerabilities affect a large number of internet-facing PHP servers, many running end-of-life versions. US cybersecurity authorities have urged immediate patching to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to mitigate the risk. The vulnerabilities have been compared in impact potential to Log4Shell due to widespread presence and forgotten PHP infrastructure. Mitigations include applying patches promptly and restricting web-facing process permissions as a temporary control.
A vulnerability in webpack-dev-server versions 5.1.0 up to but not including 5.2.7, and 6.0.0 up to but not including 6.1.0, allows unauthenticated attackers to cause the server to disclose sensitive information via error messages. This occurs because the open-editor endpoint improperly validates the Host header, leading to an exception that reveals absolute filesystem paths, module locations, and source line numbers in HTTP 500 responses. The server continues running without denial of service. The issue is fixed in versions 5.2.7 and 6.1.0.
A vulnerability in webpack-dev-server versions before 5.2.7 and in 6.0.0 allows malicious web pages visited by developers to open cross-origin WebSocket connections through the dev server. This occurs because the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating Host or Origin headers, bypassing allowedHosts protections. The issue is fixed in versions 5.2.7 and 6.1.0.
