PhpSpreadsheet versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0 contain an XML External Entity (XXE) vulnerability due to improper restriction of XML external entity references. The XmlScanner::scan method fails to detect certain escape sequences in XLSX XML parts, allowing attackers to craft malicious XLSX files that can trigger entity expansion denial of service, local file access, or server-side request forgery (SSRF) on affected PHP versions. This vulnerability is fixed in the specified versions.
CVE-2026-108360 is an incorrect authorization vulnerability in PHPOffice PhpSpreadsheet affecting versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. The issue arises when the Worksheet\Drawing::setPath method validates only the initial external-image URL whitelist, allowing an attacker to exploit HTTP redirects to cause the server to make blind GET requests to internal or cloud metadata endpoints. The downloaded content is validated and removed, so no data is leaked to the attacker, but internal network reachability can be probed. The vulnerability is fixed in the specified versions.
Arista Networks patched a critical zero-day vulnerability (CVE-2026-114625) in VeloCloud Orchestrator (VCO) On-Prem deployments. The flaw allows authenticated users with basic privileges to escalate to operator-level privileges via low-complexity SQL injection attacks without user interaction. This enables access to internal functionality not intended for remote access, potentially compromising the confidentiality, integrity, and availability of the orchestrator and managed data. Hosted VCO deployments running versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later have been patched. Until patches are applied, Arista recommends restricting VCO web interface access, monitoring for suspicious activity, and blocking known malicious IP addresses involved in ongoing attacks.
Pylint versions from 0.15.2 up to 4.0.8 store module statistics in predictable cache files under PYLINT_HOME and load them using pickle.load. An attacker with write access to a shared or group-writable cache directory can replace these cache files with malicious serialized data, leading to arbitrary code execution with the privileges of the user running Pylint. The default per-user cache is typically not writable by others. This vulnerability is fixed in Pylint version 4.0.9.
dnspython versions prior to 2.9.0 contain a vulnerability in the dns.name.from_wire_parser function, which follows attacker-controlled DNS compression pointer chains without a hop limit. This can allow a malicious DNS message to cause excessive pointer traversal during name decompression, resulting in high CPU usage, application degradation, or denial of service. The issue is fixed in version 2.9.0.
GraphQL-core, a Python port of GraphQL.js, has a vulnerability in versions including 3.2.3 through 3.2.11 where the parser's max_tokens limit does not count comment tokens properly. This allows an unauthenticated remote attacker to craft a comment-padded GraphQL document that bypasses token limits and exhausts worker memory before depth or complexity controls execute. The issue is fixed in version 3.2.12.
A vulnerability in graphql-core versions from 3.0.0 up to but not including 3.2.12 and 3.3.0rc1 allows an unauthenticated remote attacker to cause excessive CPU consumption during query validation. The OverlappingFieldsCanBeMerged rule repeatedly compares fields and inline fragments inefficiently, leading to quadratic or worse CPU complexity. This can saturate worker processes and degrade service availability. The issue is fixed in versions 3.2.12 and 3.3.0rc1.
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.
A vulnerability in OpenTelemetry Python prior to version 1.45.1 allows specially crafted W3C tracestate headers with long runs of spaces or tabs to cause excessive CPU consumption due to quadratic backtracking in the header parser. This can degrade service availability by occupying synchronous workers or delaying asynchronous event loop tasks. The issue does not expose or modify telemetry data and does not allow code execution. It is fixed in version 1.45.1.
A memory-related vulnerability in an upstream library used by Next.js for Image Optimization can lead to unauthenticated remote code execution (RCE) when processing SVG files on glibc-based Linux systems. This affects Next.js versions from 10.0.0 up to but excluding 15.5.28, and from 16.0.0 up to but excluding 16.4.1. The vulnerability is critical and can be mitigated by upgrading the 'sharp' library to version 0.35.5 or later, which is included in patched Next.js releases.
CVE-2026-114487 is a missing authorization vulnerability in Devolutions Server versions up to 2026.2.20.0 and from 2026.3.5.0 through 2026.3.10.0. It allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing Active Directory providers by sending a crafted import request to the PAM AD computer import endpoint.
A security update for the Grafana plugin for Performance Co-Pilot (grafana-pcp) addresses multiple vulnerabilities including denial of service issues in Go's crypto/tls and net/http packages, and a man-in-the-middle attack via untrusted intermediate certificates in crypto/x509. These vulnerabilities affect Red Hat Enterprise Linux 10.2 Extended Update Support and related variants. The update is rated as Important by Red Hat Product Security. No CVSS score is provided in the advisory.
Devolutions Server versions 2026.3.10.0 and earlier contain a vulnerability that allows an authenticated attacker with delegated user view permissions to access multi-factor authentication (MFA) secrets of all users via the user list API. The issue arises from insufficient protection of sensitive information in the user list endpoint. This vulnerability is fixed in version 2026.3.11.
CVE-2026-16477 is a high-severity vulnerability in CleanShot X for macOS where the application insecurely deserializes untrusted data embedded in .cleanshot project files. An attacker can craft a malicious .cleanshot file that, when opened by a user, triggers automatic execution of arbitrary code with the current user's privileges. This issue affects versions prior to 4.5.2, 4.6.3, 4.7.8, and 4.8.10, which contain the fixes.
Multiple critical security vulnerabilities affecting Mozilla Firefox were fixed in Firefox ESR 153.4 and Firefox 157. These include sandbox escapes, use-after-free bugs, cryptography misuse, mitigation bypasses, same-origin policy bypass, denial-of-service, privilege escalation, and memory corruption issues across various components such as the JavaScript engine, DOM, graphics, and networking. The vulnerabilities could allow remote attackers to execute arbitrary code, escalate privileges, bypass security mitigations, or cause denial of service. The CVSS 3.1 base score is 10.0, indicating critical severity.
CVE-2026-92709 is a medium severity vulnerability affecting multiple specific versions of the rsyslog software package, primarily distributed in various Ubuntu releases. The exact nature and technical details of the vulnerability are not described in the available data. There is no CVSS score or detailed impact information provided. No patch or remediation guidance is currently available, and no known exploits in the wild have been reported.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Retool versions before 3.88.0 have a cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to execute JavaScript by proxying malicious SVG files through the /api/imageProxy endpoint. The vulnerability arises because the attacker can supply an SVG hosted on an attacker-controlled server via the url parameter, which Retool serves from its own origin without a Content Security Policy. This enables script execution in the context of victims' sessions. Exploitation evidence was first observed on 2024-10-15.
libyang versions through 6.4.13 have a vulnerability in the lydxml_env_netconf_rpc() function where an uninitialized pointer is freed during parsing of NETCONF rpc action envelopes. This flaw allows peers with a NETCONF session to send crafted action elements containing non-whitespace text via lyd_parse_op(), potentially causing server crashes or heap corruption in applications like netopeer2.