Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
The PHP2Shell vulnerability involves critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that have been actively exploited for over a week. Attackers, notably a China-linked group, have successfully chained these PHP2Shell flaws with the Fragnesia Linux kernel privilege escalation bug to gain root access on Palo Alto Networks PAN-OS firewalls. Despite over 22.6 million exposed PHP instances potentially vulnerable, successful exploitation has been limited, with WordPress sites remaining largely unaffected. Palo Alto Networks has released patches for multiple PAN-OS versions and urges customers to restrict internet access to management interfaces. The attacks appear opportunistic and originate from a small number of IP addresses, targeting various sectors including healthcare and technology.
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.
CVE-2026-119368 is a Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar plugin. It affects versions from initial releases up to 6.18.2. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionalities. The issue has been fixed in version 6.18.3.
CVE-2026-119482 is a missing authorization vulnerability in Crocoblock JetFormBuilder versions prior to 3.6.8. This flaw allows attackers to exploit improperly configured access control, potentially leading to unauthorized modification of data. The issue has a medium severity rating with a CVSS score of 5.3 and does not impact confidentiality or availability but affects integrity. The vulnerability is fixed in version 3.6.8.
CVE-2026-46499 is an authorization vulnerability in Collabora Online before versions 24.04.18 and 25.04.11. It allows read-only users to bypass the read-only restriction by sending crafted WebSocket messages to execute document-modifying commands. Although these unauthorized changes cannot be saved directly by the attacker and are discarded when the session ends, they can mislead other collaborators or be saved unknowingly by authorized editors sharing the session. This issue has been fixed in the specified versions.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective `Content Security Policy`, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the `Content Security Policy` header sent by `coolwsd` mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.
CVE-2026-93327 is a critical deserialization of untrusted data vulnerability in the SubWorkflow task of Google Cloud Application Integration. It affects versions prior to 2026-09-11 and allows an authenticated attacker to execute arbitrary code by submitting a malicious serialized object. The vulnerability was patched on September 11, 2026, and no customer action is required as Google manages remediation for this cloud service.
libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.
CVE-2026-61626 is a high-severity out-of-bounds write vulnerability in libass versions 0.17.4 up to but not including 0.17.5. It arises from insufficient validation of negative Matroska ReadOrder values during event pruning, potentially allowing an attacker to clear bits near a NULL pointer. Exploitation requires a malicious Matroska stream processed with enabled read-order checking and explicit event pruning. The vulnerability is fixed in libass version 0.17.5.
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in `backend/app/incidents/routes/incident_alert.py` omit role and tenant authorization, and `POST /api/incidents/alerts/create/velo-sigma/exclusion` does not validate credentials. Its `return_username_for_logging` dependency in `backend/app/auth/utils.py` calls `decode_token`, which returns ordinary Invalid token or Expired signature strings on failure, and the dependency passes these strings through instead of rejecting the request. A Bearer header is required, but an arbitrary invalid, expired or forged value can create a suppression rule without a valid account. The collection GET at /create/velo-sigma/exclusion lists exclusions; the read, update and delete routes under `/create/velo-sigma/exclusion/{exclusion_id}`, and the `/velo-sigma/exclusion/{exclusion_id}/toggle` route, use `get_current_user` without role checks, permitting any authenticated `customer_user` to manage every exclusion. In `backend/app/incidents/services/velo_sigma.py`, `process_sigma_alert` calls `check_exclusions` and drops matching enabled alerts before incident creation. A null `customer_code` applies a rule across all tenants. Attackers can suppress detections platform-wide through channel, title or field matching, while low-privilege accounts can enumerate detection-tuning data and modify, disable or delete legitimate exclusions. This issue is fixed in version 0.1.77.
Soft Serve, a Go-based Git server, improperly discloses the existence, exact names, and clone URLs of private repositories via HTTP responses. This occurs because the server responds to certain requests without verifying if the requester has read access, allowing enumeration of private repository names. Repository contents and metadata remain protected, and no write access is exposed. The issue affects versions from 0.5.0 up to but not including 0.12.3 and is fixed in version 0.12.3.
The @nx/maven and @nx/gradle plugins for Nx have an OS command injection vulnerability due to unsafe interpolation of plugin options from nx.json into shell commands. This allows execution of arbitrary commands when running nx commands that construct the project graph. The vulnerability affects specific versions of these plugins and has been fixed in versions 22.7.9 and 23.1.2. Users should upgrade both the nx package and the affected plugins to these versions or later to remediate the issue.
This report summarizes multiple cybersecurity incidents and vulnerabilities including a critical 16-year-old buffer overflow in UEFI firmware affecting most servers worldwide, a disputed AI-led intrusion at Anthropic, data breaches at the University of Copenhagen and ENGIE, and a Cloudflare AI data leak. The UEFI flaw allows local network attackers to execute code at high privilege during network boot. Anthropic disputes the scope of an AI-driven intrusion by a startup. The University of Copenhagen breach exposed personal and national ID data of over 500,000 individuals. Cloudflare fixed a cross-tenant data leak in its AI inference platform caused by a cache size mismatch and a bug in the inference engine. Other incidents include suspected Iranian cyberattacks on military freezers and attempts to breach the US Federal Election Commission systems.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60.