A double free vulnerability exists in the OpenSSH client shipped with Red Hat products when operating in FIPS mode during Diffie-Hellman Group Exchange (DH-GEX) key exchange. A malicious SSH server can exploit this flaw to cause the client process to terminate unexpectedly, resulting in a denial of service (DoS). The vulnerability requires the client to connect to a malicious or compromised SSH server and affects only the availability of the SSH client process, not broader system compromise. Mitigation involves disabling the vulnerable key exchange algorithm in the SSH client configuration.
The Cryptocurrency Donation Box – Bitcoin & Crypto Donations WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the data_object parameter in all versions up to and including 2.2.13. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. The vulnerability arises because the AJAX action cdbbc_payment_verify is accessible without authentication and the nonce check can be bypassed due to the nonce being publicly exposed in JavaScript.
A malicious file identified by the SHA-256 hash cc0e9d0184c0b930381446b6891769a35711b38c6a57303482e3115f921d4edc was observed 26 times in attacker activity between October 13 and October 21, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools or payloads into target environments. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Hong Kong, India, South Korea, Taiwan, and the United States. This indicator should be matched against files in environments and security tools to detect potential compromise.
Adobe ColdFusion 2025 contains an Improper Restriction of XML External Entity Reference (XXE) vulnerability (CVE-2026-106616) that allows an attacker to read arbitrary files on the system. This vulnerability can be exploited remotely without user interaction and affects versions up to 2025.0.13 and 2023.0.25. The vulnerability has a high severity with a CVSS score of 8.6. Exploitation changes the security scope and could lead to disclosure of sensitive information. No official patch or remediation details are provided in the available data.
Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-34633) that allows a low-privileged attacker to escalate privileges by making unauthorized internal requests. Exploitation does not require user interaction and affects versions up to 2025.0.13 and 2023.0.25. The vulnerability changes the security scope and can lead to high confidentiality impact without affecting integrity or availability.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to bypass security features and gain unauthorized write access without user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The scope of the impact is changed, indicating that the vulnerability affects resources beyond the initial security boundary.
Adobe ColdFusion 2025 contains a critical Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-106622) that allows an attacker to escalate privileges without user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and can lead to full confidentiality, integrity, and availability compromise.
Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that could allow an attacker to execute arbitrary code with the privileges of the current user. The vulnerability does not require user interaction and affects versions up to 2025.0.13 and 2023.0.25. Exploitation depends on conditions beyond the attacker's control. The vulnerability has a critical severity with a CVSS score of 9.0.
Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that allows a low-privileged attacker to execute arbitrary code without user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue could lead to full compromise of confidentiality, integrity, and availability in the context of the current user.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. Exploitation depends on conditions beyond the attacker's control and results in a changed scope. The issue has a high severity with a CVSS score of 7.8.
Adobe ColdFusion 2025 contains a critical code injection vulnerability (CVE-2026-106624) that allows an attacker to execute arbitrary code without user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue results from improper control of code generation, enabling arbitrary code execution in the context of the current user. The vulnerability has a maximum CVSS score of 10.0, indicating critical severity with high impact on confidentiality, integrity, and availability.
Adobe ColdFusion 2025 contains an Uncontrolled Resource Consumption vulnerability (CWE-400) that can lead to application denial-of-service. This vulnerability allows an attacker to exhaust system resources without requiring user interaction, causing the application to become unavailable. The issue affects versions up to and including 2025.0.13 and 2023.0.25. The vulnerability has a high severity rating with a CVSS score of 7.5.
Adobe ColdFusion 2025 contains a critical path traversal vulnerability (CVE-2026-90530) in its Remote Development Services (RDS) feature. This flaw allows an attacker to read arbitrary files on the file system outside the intended restricted directories without requiring user interaction. The vulnerability affects ColdFusion versions up to 2025.0.13 and 2023.0.25. RDS is intended only for development and is disabled when ColdFusion is set to Production Secure Profile. Disabling RDS or running ColdFusion in Production Secure Profile mitigates the risk.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and can lead to high impact on confidentiality, integrity, and availability.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows an attacker to execute arbitrary code with the privileges of the current user. The vulnerable component is by default restricted to an administrative network zone. Exploitation does not require user interaction and changes the security scope. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The CVSS score is 9.6, indicating critical severity.
Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-34634) that can lead to privilege escalation without requiring user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The scope of the vulnerability is changed, indicating that the impact extends beyond the vulnerable component. The CVSS score is 8.6, reflecting a high severity issue with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is high, while integrity and availability impacts are none.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to bypass security controls and gain unauthorized write access without user interaction. This vulnerability affects versions up to and including 2025.0.13 and 2023.0.25. The vulnerability changes the security scope and has a critical severity with a CVSS score of 9.6.