A hardcoded static AES key vulnerability exists in the TTLock Android application before version 9.8.260718 and its associated smart-lock firmware. This flaw allows attackers within Bluetooth range to decrypt the per-pairing session key during BLE pairing. Exploiting this, attackers can forge authenticated BLE requests to unlock the device and perform administrative actions without user interaction.
CVE-2026-3322 is a vulnerability in Lobster DATA GmbH's Lobster_pro product where improper permission checks allow attackers with limited privileges to access administrative endpoints. It affects version 4.12.12-LTS and possibly other versions prior to 25.1.3. The issue permits interaction with endpoints that should require administrative privileges, potentially leading to unauthorized actions. The CVSS 4.0 base score is 5.6, indicating a medium severity. No public exploits or patches are currently documented.
Genesys experienced a cyberattack involving unauthorized access to internal business systems, including a learning management system and a customer relationship management environment. The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not compromised, and customer and partner data within those platforms remain secure. The attackers accessed and likely downloaded business and account information used to manage customer relationships, including names, phone numbers, business emails, job titles, and company information. Genesys contained the incident by suspending the LMS platform and confirmed full containment by October 23, 2026. The investigation is ongoing, and customers are cautioned to watch for phishing attempts impersonating Genesys.
Apache SIS versions 0.7 through 1.6.0 are affected by a path traversal vulnerability (CWE-22) where the software opens linked files from data files without properly restricting file paths. This could allow an attacker to specify local file paths outside the intended directories. The vulnerability affects specific geographic data formats including GML, WKT, and Landsat GeoTIFF bands. The risk of sensitive information leakage is low due to strict file format expectations and parsing stopping at the first error. Version 1.7 of Apache SIS fixes this issue by restricting file references to the same directory or a predetermined directory for datum shift grids.
CVE-2026-92171 is a vulnerability in the Infinispan Operator for Red Hat Data Grid 8 that exposes keystore and truststore passwords in plain text as command-line arguments when cross-site TLS is enabled. These passwords are visible in the Pod specification to any user with get pods permission in the namespace, accessible via node-level process command lines, and often recorded in audit logs. This exposure increases the risk of unauthorized access to sensitive credentials.
A NULL pointer dereference vulnerability exists in the gssproxy daemon of Red Hat Enterprise Linux 10. When a GSSX_INIT_SEC_CONTEXT request is received without the target_name field, the daemon crashes due to dereferencing a NULL pointer. This can be triggered by any local user without authentication via the Unix socket, causing a persistent denial of service as the daemon does not automatically restart. Dependent services such as Kerberized NFS and IdM are also affected while the daemon is down.
CVE-2026-116339 is a medium-severity vulnerability in iFlytek astron-agent versions 1.1.0, 1.1.1, and 1.1.2. It involves an incomplete blacklist implementation in the DDL Whitelist Handler component, specifically in the file core/memory/database/api/v1/exec_ddl.py. The flaw allows remote attackers to manipulate the blacklist, potentially bypassing intended restrictions. The vulnerability has been publicly disclosed with available exploit details, but the vendor has not responded or provided a fix.
A flaw in OpenAI's context compaction process allowed researchers to transfer reasoning traces between AI models, enabling the cheaper distillation of rival AI models. This technique, called compaction smuggling, bypassed initial mitigations and was fixed by OpenAI in October 2026. The vulnerability enabled extraction of proprietary reasoning data from advanced models and its reuse in weaker models, facilitating large-scale copying of AI capabilities. This has been exploited by Chinese entities to develop competitive AI systems, raising national security concerns.
CVE-2026-93848 is a Server-Side Request Forgery (SSRF) vulnerability in Mattermost versions 11.7.0 through 11.7.10. The issue arises because these versions do not properly filter outbound internal-connection requests to the OpenID discovery endpoint. This flaw allows a System Administrator to verify the reachability of internal addresses and ports from the server by triggering an unauthenticated login request that initiates the discovery fetch.
CVE-2026-93850 is a vulnerability in Mattermost versions 11.7.0 through 11.7.10, 11.8.0 through 11.8.5, 11.9.0 through 11.9.1, and 11.10.0 through 11.10.1. It involves improper handling of highly compressed PDF data, where the application fails to limit the volume of text extracted from uploaded PDFs. This flaw allows an authenticated user to cause a denial of service by uploading a crafted PDF whose compressed content expands into a very large amount of text, exhausting server memory.
Mattermost versions 11.7.0 through 11.7.10, 11.8.0 through 11.8.5, 11.9.0 through 11.9.1, and 11.10.0 through 11.10.1 contain a vulnerability in the WebSocket msgpack decoder. The software fails to enforce allocation limits on byte-string decode paths, allowing an authenticated remote attacker to trigger excessive memory allocation by sending a crafted binary WebSocket frame with a large declared payload length. This can lead to denial of service due to resource exhaustion.
CVE-2026-93328 is a critical vulnerability in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0. It involves path traversal and missing authorization in the cloud-storage source component, allowing unauthenticated remote attackers to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters. The issue is fixed in version 1.5.0.
A SQL Injection vulnerability exists in the sql-storage module of Apache SIS versions 1.0 through 1.6.0. The issue occurs when sorting a stream of features, where the ORDER BY clause copies the sort clause without quoting the identifier, allowing crafted input to inject SQL code. This vulnerability is fixed in Apache SIS version 1.7.
CVE-2026-93847 is an authorization vulnerability in Mattermost versions 11.7.0 through 11.7.10. It occurs because these versions fail to properly validate reserved system post types during scheduled post creation and publication. This flaw allows an authenticated channel member to publish messages that appear as trusted system events via the scheduled post endpoint.
CVE-2026-65184 is a critical OS command injection vulnerability in the Vertiv Avocent ACS8000 appliance. The root-privileged wsserver terminal-bridge daemon constructs shell commands from client-supplied WebSocket fields and executes them via system() and popen() calls without proper sanitization. This allows unauthenticated remote attackers to execute arbitrary commands with root privileges. The vulnerability affects versions from 0 up to and including 2.32.4. No public exploits or patches are currently documented.
CVE-2026-115930 is a high-severity vulnerability in MongoDB Shell (mongosh) versions prior to 2.14.0. It involves improper certificate validation due to the inclusion of recoverable eMudhra intermediate CA certificates in the Node.js TLS root certificate store used by mongosh. This can be mitigated by updating mongosh to version 2.14.0 or later, which bundles a fixed Node.js runtime version 24.22.1 or newer. If mongosh is installed via npm, the Node.js runtime on the host must be updated separately.
Kameleo versions 5.3.0 and 5.3.1 contain an information disclosure vulnerability in the Local API component, specifically in the /general/user-info endpoint. This flaw allows remote attackers to obtain sensitive information without authentication. The vendor has not responded to disclosure attempts and no patch or fix is currently available.
Mattermost versions up to 11.9, 11.1.9, 11.5.8, and 11.10.7.0 contain a vulnerability where the Zoom chat line length is not properly validated before slicing. This improper check can be exploited by an authenticated attacker to crash the Agents plugin by summarizing a Zoom chat transcription with short continuation lines.
CVE-2026-97200 is a high-severity vulnerability in the benoitc hackney HTTP client library affecting versions from 2.0.0-beta.1 up to but not including 4.9.0. It involves improper handling of highly compressed or oversized HTTP response bodies, allowing a malicious server to exhaust client memory by sending a large or compressed response that is buffered and decompressed without limits. This can lead to resource exhaustion on the client side. The issue is fixed in version 4.9.0.
CVE-2026-115693 is an improper certificate validation vulnerability in the hackney_ssl module of benoitc hackney. It allows an on-path attacker to impersonate a server pinned to a private certificate authority by exploiting the acceptance of certificate chains ending in a publicly trusted root. The hostname check remains enforced, requiring the attacker to have a publicly trusted certificate for the pinned hostname. This affects hackney versions from 1.24.0 up to but not including 4.9.0.