Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12.
CVE-2026-115418 is a high-severity SQL injection vulnerability in the AWS Cloud Development Kit (CDK) module @aws-cdk/aws-redshift-alpha prior to version 2.274.0-alpha.0. It allows an attacker who can influence construct property values to execute SQL statements with Amazon Redshift superuser privileges. This includes the ability to grant access to all cluster users. The vulnerability arises from unsafe handling of user names, comments, or passwords in database-query custom resource handlers. AWS has fixed this issue in version 2.274.0-alpha.0 and recommends upgrading and reviewing existing table grants to PUBLIC.
CVE-2026-115909 is a denial of service vulnerability in the zip-rs zip2 library affecting versions from 1.3.0 up to but not including 9.0.0. The vulnerability arises because the library allocates memory based on an attacker-controlled ZIP64 uncompressed_size field before validating the entry data, which can cause the process to abort due to an impossible allocation request. This issue is fixed in version 9.0.0.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
A path traversal vulnerability exists in the zip-rs zip2 library versions 7.2.0 through 8.x, fixed in 9.0.0. The flaw allows an attacker to craft symbolic link chains that bypass lexical path validation, enabling files to be created or overwritten outside the intended extraction directory. On Windows, this can be exploited with certain privileges to escape extraction boundaries with a single symlink.
CVE-2026-115907 is a high-severity vulnerability in the zip-rs zip2 library for Rust, affecting versions from 5.1.0 up to but not including 9.0.0. The issue involves uncontrolled resource consumption due to unbounded preallocation of output capacity based on attacker-controlled ZIP64 uncompressed sizes before validating the compressed stream. This can cause a panic due to capacity overflow in certain decoder paths, potentially terminating an archive-processing service. The vulnerability is fixed in version 9.0.0.
A vulnerability in the zip-rs zip2 Rust library versions from 0.6.0 up to but not including 9.0.0 allows improper validation of the AES entry reader's HMAC authentication tag. Under certain conditions, such as when the encrypted entry has no payload or the data counter does not reach zero before the end of the archive, the reader may return a clean end of stream without verifying the authentication tag. This can cause applications using certain decryption methods to accept modified plaintext without detecting authentication errors. The issue is fixed in version 9.0.0.
CVE-2026-116371 is an improper authentication vulnerability in Akuvox Akubela HyPanel PS51 version 51.130.40.26. The flaw involves manipulation of the 'engrmode' argument in the /login endpoint, which can allow an attacker to bypass authentication remotely. The vendor has not responded to disclosure requests, and no patch or mitigation guidance is currently available. The vulnerability has a medium severity rating with a CVSS score of 5.3.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (6e5799fe2d2da1697418d26bfa3ed7bfde41e3e8f3d07003b04c3237950f91b1)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (910dd2c3846dd989ee98147187c379760a3d055ffe413f85d36def235d6a7cf7)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (529f7b16fb0c62ee71033377d3aebf3048f045e18f982b99224a584be9c264f6)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
CVE-2026-115905 is a critical vulnerability in the zip-rs zip2 Rust library affecting versions prior to 9.0.5. The flaw arises from inconsistent handling of filenames between the Central Directory File Header and the Local File Header during ZIP archive extraction. This discrepancy allows a crafted archive to appear safe when inspected via the central directory but to cause a streaming extractor to write files to attacker-chosen paths, potentially overwriting important files used by downstream services. The issue is fixed in version 9.0.5.
CVE-2026-71456 is a vulnerability in Johnson Controls Kantech Entrapass before version 9.20 involving the use of a hard-coded cryptographic key. This flaw enables a Padding Oracle Crypto Attack, compromising cryptographic security. The issue is fixed in version 9.20.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (d188bb5d3c330ed5c438865b3787cca124861eefe2c8e094e58511bbca437e09)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (55ac470ab3260611fd8b69f59b1d1faae26e80e1c7e9c243cb0b65db56d5c231)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (8b980eedd59eb558f39a2675ea8570fe97d02c7b586e2a5c7f980e058d313601)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
CVE-2026-71455 is a vulnerability in Johnson Controls Kantech Entrapass before version 9.20 that involves cleartext storage of sensitive information in memory. This flaw allows retrieval of embedded sensitive data, potentially exposing confidential information. The vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in version 9.20.
Pyrus Sync for Windows has a local privilege escalation vulnerability due to missing authorization controls in its PyrusSyncService Windows service. This flaw allows an attacker with unprivileged access to create files via the ISyncService contract, potentially escalating their privileges on the affected system. The vulnerability affects versions prior to 1.8.745.0, which contains the fix.
CVE-2026-116370 is a type confusion vulnerability in the loadstring function of the Lua sandbox component in 2K Games Sid Meier's Civilization IV version 1.0.12.68. This flaw can be exploited remotely and has publicly available exploit code. The vulnerability has a medium severity rating with a CVSS score of 5.3.
This report summarizes multiple cyber threats and incidents observed in late October 2026, including large-scale breaches, supply-chain attacks, AI-enabled cybercrime tools, and critical software vulnerabilities. Notable incidents include a cyberattack on Japanese cloud provider Onamae Desktop Cloud affecting over 26,000 servers, a data breach at India's State Bank of India exposing nearly 3,900 customer records, and a supply-chain compromise of the LiteLLM AI gateway. AI-enabled tools are facilitating large-scale fraud and ransomware attacks targeting critical sectors in the United States. Critical PHP vulnerabilities enabling remote code execution are being widely exploited, with most instances unpatched. Oracle and GitLab have released patches for numerous critical vulnerabilities, including a critical remote code execution flaw in GitLab and a privilege escalation vulnerability in Arista VeloCloud Orchestrator that has been exploited in the wild.