Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership matching the target group, the authenticated user, and share_admin=True, but omits accepted=True. An authenticated remote attacker who has been invited to a group with share-admin privileges, and who knows a group share-right UUID, can therefore delete that group's share-right record without accepting the invitation or after declining it. Pending invitations have accepted=None, while declined invitations retain accepted=False and the share_admin flag. Deletion revokes the group's access to the affected share and its contained secrets for all accepted group members, without deleting the underlying data or disclosing secret contents. The issue was fixed in version 7.5.1 of both editions, released on 2026-10-13.
CVE-2026-109093 is a stack-based buffer overflow vulnerability in the ProcXTestFakeInput DeviceValuator handling of X.Org xwayland and X server. It affects versions of xwayland before 24.1.15 and X server before 21.1.26. Authenticated clients could exploit this flaw to crash the X server or execute arbitrary code within it.
CVE-2026-127102 is an authorization vulnerability in Eclipse BaSyx Go Components versions up to 1.1.2. In ABAC-enabled deployments, an authenticated user with read access to a single Submodel Element can read all elements of that Submodel via the list API route, bypassing intended access restrictions. The issue is fixed in version 1.1.3.
CVE-2026-109094 is an integer overflow vulnerability in the X.Org xwayland component affecting 32-bit systems. It occurs in the XRes QueryResourceBytes Swap Path and can lead to a buffer overread. Authenticated clients could exploit this flaw to crash the X server. The issue affects xwayland versions prior to 24.1.15 and X Server versions prior to 21.1.26. A fix is available in these versions.
Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance.
Eclipse BaSyx Go Components versions up to 1.1.2 contain an incorrect authorization vulnerability in ABAC-enabled deployments of the Submodel Repository and AAS Environment. Specifically, certain GET requests for single Submodels and their metadata do not apply access rule filters, allowing authenticated users with READ access to view fields that should be hidden. Additionally, when versioning is enabled, history endpoints return unfiltered data, exposing sensitive fields and entire Submodels or Asset Administration Shells that should be restricted. This issue is fixed in version 1.1.3.
CVE-2026-77706 is a vulnerability in FileOrbis NextGen FileServer prior to version 12.7 involving improper handling of highly compressed data, leading to data amplification. This flaw allows sustained client engagement that can cause denial of service by impacting availability. The issue is fixed in version 12.7.
CVE-2026-92241 is a denial-of-service vulnerability in the Zephyr project's Bluetooth AVRCP browsing channel. It occurs due to blocking buffer allocation from a limited pool when processing large segmented L2CAP packets, causing the Bluetooth host to hang permanently. This affects Zephyr versions from 4.4.0 up to but not including 4.5.0. The issue requires a paired BR/EDR peer with the AVRCP browsing channel enabled. The flaw does not cause memory corruption or data leakage but results in a complete halt of Bluetooth host processing until reboot. A fix is available in version 4.5.0 that changes buffer allocation to non-blocking behavior, allowing recovery from resource exhaustion.
Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability, potentially leading to information disclosure via requests to internal services.
The tailwindcss-animationkit npm package contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the affected system, potentially exposing all stored secrets and keys. Immediate removal of the package is advised, but due to the severity of the compromise, complete remediation may require rotating all secrets and keys from a different, trusted machine.
CVE-2026-91094 is a directory traversal vulnerability in the Debian dpkg tool when unpacking 3.0 (quilt) source packages. The issue arises because the packaging tarball can include the quilt database directory (.pc) containing attacker-controlled symbolic links. When patches fail to apply, the code that restores backup files may follow these symlinks, allowing modification or removal of arbitrary files pointed to by the attacker.
A integer overflow in glamor Xv Image Size handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash the X server or leak out data.
Microsoft experienced a global outage affecting multiple Microsoft 365 services including Outlook, Teams, and the AI assistant Copilot. The outage impacted users, businesses, and government operations worldwide, causing disruptions in email and communication services. Microsoft reported no indication of malicious activity and is using a measured approach to identify and repair the affected infrastructure. Recovery efforts showed incremental improvements but service health remained variable for some time. The outage caused operational delays in sectors such as healthcare, government, finance, and transportation across several countries.
Dell PowerStore 500T contains an authorization bypass vulnerability (CVE-2026-82179) that allows an authenticated administrator to bypass multi-approver controls on critical operations. This flaw involves improperly controlled modification of dynamically-determined object attributes. The vulnerability has a medium severity rating and a CVSS score of 4.9. A fix is available in version 5.1.0.0-2798105 or later.
Dell PowerStore contains an insecure-file-permissions vulnerability. A local low-privileged attacker could exploit this vulnerability to disclose administrative credentials.
P-Net before 1.0.4 aborts the Application Relationship of an RPC session when a fragment of a response has been resent without being acknowledged, without checking that the session has an Application Relationship. A request for an existing Application Relationship that is sent on another activity than its Connect, and gets a fragmented response, is handled on a session without one. If the response is not acknowledged, a NULL pointer is dereferenced and the device crashes. A conformant IO-controller does not send such requests. The attacker must have observed the AR UUID of an established Application Relationship and requires ADJACENT network access.
Dell PowerStore contains a use-of-broken-cryptography vulnerability. A low-privileged attacker could exploit it to impersonate another identity, potentially leading to unauthorized access.
P-Net before 1.0.4 keeps the RPC session that is allocated for a fragment of a request with an unknown activity UUID, without a timeout, when the rest of the request never arrives. A session that does not get an Application Relationship is also kept after the response. Repeated fragments or requests with different activity UUIDs exhaust the available sessions, one UDP packet per session. Once they are exhausted the device no longer answers a Connect request until it is restarted. An unauthenticated attacker with ADJACENT network access can use this to cause a denial of service.
P-Net before 1.0.4 releases the Application Relationship of an RPC session, without the abort procedure, when a fragment of a request has another data representation (endianness) than the first fragment of the call. The application is not told that the Application Relationship is gone, the cyclic data stops, and the resources of the Application Relationship are left referencing a cleared structure. Another host can then connect in its place. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can do this with one PDU.
P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast communication relations that an Application Relationship has room for (PNET_MAX_MC_CR, 1 by default). Each further block is written past the end of the array, into the rest of the Application Relationship and, with more blocks, into the following one. The written data comes from the request. No established Application Relationship is needed, and the attacker requires ADJACENT network access. Builds with PNET_OPTION_MC_CR disabled are not affected.