CVE-2026-77055 is a critical vulnerability in boneIO black_debian_images where the boneio service account is granted excessive privileges, including passwordless sudo access and membership in the docker group. This allows a local attacker who compromises the boneio user to escalate privileges to root. The issue is fixed in version 1.6.0 by removing these privileges and enforcing command restrictions with cryptographic verification.
boneIO versions 1.2.0 up to but not including 1.6.0 store sensitive passwords, including MQTT broker and web panel passwords, in cleartext. The API endpoint GET /api/config exposes these passwords to any authenticated user. Due to a related vulnerability (CVE-2026-77053) disabling authentication by default, unauthenticated attackers on the local network can also access these passwords. Version 1.6.0 fixes this by hashing web panel passwords and restricting access to the MQTT broker password, which remains recoverable but is no longer exposed via the API.
boneIO Black firmware versions prior to 1.6.0 have authentication disabled by default on their management web API, exposing all endpoints without requiring credentials. This allows unauthenticated remote attackers to fully control the device, including causing denial of service, modifying configurations, and operating connected physical circuits. The issue was fixed in version 1.6.0 by requiring an administrator account creation during the first-run wizard and restricting API routes to authenticated roles. Versions before 1.2.0 are based on Debian 10, unsupported, and cannot be upgraded in place; affected devices must be re-flashed with the 1.6.0 system image.
boneIO Black versions from 1.3.0 up to but not including 1.6.0 expose a Node-RED instance without authentication via a Caddy reverse proxy at the /nodered/ path. This allows unauthenticated local network attackers to deploy malicious flows through the Node-RED Admin API, enabling remote code execution and full control over the home automation system. The vulnerability is fixed in version 1.6.0.
CVE-2026-116340 is an authorization bypass vulnerability in iFlytek astron-agent versions 1.1.0, 1.1.1, and 1.1.2. It affects the FileInfoV2Service.listKnowledgeByPage function in the Console Knowledge-List Endpoint by manipulating the argument space-id. The vulnerability can be exploited remotely without user interaction and requires low privileges. Public exploit code is available. The vendor has not responded to disclosure and no patch or fix information is provided.
A hardcoded static AES key vulnerability exists in the TTLock Android application before version 9.8.260718 and its associated smart-lock firmware. This flaw allows attackers within Bluetooth range to decrypt the per-pairing session key during BLE pairing. Exploiting this, attackers can forge authenticated BLE requests to unlock the device and perform administrative actions without user interaction.
CVE-2026-3322 is a vulnerability in Lobster DATA GmbH's Lobster_pro product where improper permission checks allow attackers with limited privileges to access administrative endpoints. It affects version 4.12.12-LTS and possibly other versions prior to 25.1.3. The issue permits interaction with endpoints that should require administrative privileges, potentially leading to unauthorized actions. The CVSS 4.0 base score is 5.6, indicating a medium severity. No public exploits or patches are currently documented.
Genesys experienced a cyberattack involving unauthorized access to internal business systems, including a learning management system and a customer relationship management environment. The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not compromised, and customer and partner data within those platforms remain secure. The attackers accessed and likely downloaded business and account information used to manage customer relationships, including names, phone numbers, business emails, job titles, and company information. Genesys contained the incident by suspending the LMS platform and confirmed full containment by October 23, 2026. The investigation is ongoing, and customers are cautioned to watch for phishing attempts impersonating Genesys.
Apache SIS versions 0.7 through 1.6.0 are affected by a path traversal vulnerability (CWE-22) where the software opens linked files from data files without properly restricting file paths. This could allow an attacker to specify local file paths outside the intended directories. The vulnerability affects specific geographic data formats including GML, WKT, and Landsat GeoTIFF bands. The risk of sensitive information leakage is low due to strict file format expectations and parsing stopping at the first error. Version 1.7 of Apache SIS fixes this issue by restricting file references to the same directory or a predetermined directory for datum shift grids.
CVE-2026-92171 is a vulnerability in the Infinispan Operator for Red Hat Data Grid 8 that exposes keystore and truststore passwords in plain text as command-line arguments when cross-site TLS is enabled. These passwords are visible in the Pod specification to any user with get pods permission in the namespace, accessible via node-level process command lines, and often recorded in audit logs. This exposure increases the risk of unauthorized access to sensitive credentials.
A NULL pointer dereference vulnerability exists in the gssproxy daemon of Red Hat Enterprise Linux 10. When a GSSX_INIT_SEC_CONTEXT request is received without the target_name field, the daemon crashes due to dereferencing a NULL pointer. This can be triggered by any local user without authentication via the Unix socket, causing a persistent denial of service as the daemon does not automatically restart. Dependent services such as Kerberized NFS and IdM are also affected while the daemon is down.
CVE-2026-116339 is a medium-severity vulnerability in iFlytek astron-agent versions 1.1.0, 1.1.1, and 1.1.2. It involves an incomplete blacklist implementation in the DDL Whitelist Handler component, specifically in the file core/memory/database/api/v1/exec_ddl.py. The flaw allows remote attackers to manipulate the blacklist, potentially bypassing intended restrictions. The vulnerability has been publicly disclosed with available exploit details, but the vendor has not responded or provided a fix.
A flaw in OpenAI's context compaction process allowed researchers to transfer reasoning traces between AI models, enabling the cheaper distillation of rival AI models. This technique, called compaction smuggling, bypassed initial mitigations and was fixed by OpenAI in October 2026. The vulnerability enabled extraction of proprietary reasoning data from advanced models and its reuse in weaker models, facilitating large-scale copying of AI capabilities. This has been exploited by Chinese entities to develop competitive AI systems, raising national security concerns.
CVE-2026-93848 is a Server-Side Request Forgery (SSRF) vulnerability in Mattermost versions 11.7.0 through 11.7.10. The issue arises because these versions do not properly filter outbound internal-connection requests to the OpenID discovery endpoint. This flaw allows a System Administrator to verify the reachability of internal addresses and ports from the server by triggering an unauthenticated login request that initiates the discovery fetch.
CVE-2026-93850 is a vulnerability in Mattermost versions 11.7.0 through 11.7.10, 11.8.0 through 11.8.5, 11.9.0 through 11.9.1, and 11.10.0 through 11.10.1. It involves improper handling of highly compressed PDF data, where the application fails to limit the volume of text extracted from uploaded PDFs. This flaw allows an authenticated user to cause a denial of service by uploading a crafted PDF whose compressed content expands into a very large amount of text, exhausting server memory.
Mattermost versions 11.7.0 through 11.7.10, 11.8.0 through 11.8.5, 11.9.0 through 11.9.1, and 11.10.0 through 11.10.1 contain a vulnerability in the WebSocket msgpack decoder. The software fails to enforce allocation limits on byte-string decode paths, allowing an authenticated remote attacker to trigger excessive memory allocation by sending a crafted binary WebSocket frame with a large declared payload length. This can lead to denial of service due to resource exhaustion.
CVE-2026-93328 is a critical vulnerability in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0. It involves path traversal and missing authorization in the cloud-storage source component, allowing unauthenticated remote attackers to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters. The issue is fixed in version 1.5.0.
A SQL Injection vulnerability exists in the sql-storage module of Apache SIS versions 1.0 through 1.6.0. The issue occurs when sorting a stream of features, where the ORDER BY clause copies the sort clause without quoting the identifier, allowing crafted input to inject SQL code. This vulnerability is fixed in Apache SIS version 1.7.
CVE-2026-93847 is an authorization vulnerability in Mattermost versions 11.7.0 through 11.7.10. It occurs because these versions fail to properly validate reserved system post types during scheduled post creation and publication. This flaw allows an authenticated channel member to publish messages that appear as trusted system events via the scheduled post endpoint.
CVE-2026-65184 is a critical OS command injection vulnerability in the Vertiv Avocent ACS8000 appliance. The root-privileged wsserver terminal-bridge daemon constructs shell commands from client-supplied WebSocket fields and executes them via system() and popen() calls without proper sanitization. This allows unauthenticated remote attackers to execute arbitrary commands with root privileges. The vulnerability affects versions from 0 up to and including 2.32.4. No public exploits or patches are currently documented.