Attackers are actively searching for SAP NetWeaver webshells by exploiting a known vulnerability (CVE-2025-31324) that allows unauthenticated file uploads. This vulnerability has a critical CVSS score of 10 and has been used to upload webshells typically located in the /irj/servlet_jsp/irj/root/ directory. Multiple URLs related to SAP NetWeaver and other upload endpoints are being targeted in this campaign.
CVE-2026-125041 is a vulnerability in GStreamer's gst-plugins-good MOV/MP4 demuxer used in Red Hat Enterprise Linux 10. The flaw involves improper validation of declared row alignment and chroma geometry in uncompressed video tracks, leading to an out-of-bounds heap read. This can cause the application processing the crafted file to crash, resulting in a denial of service condition. The issue is addressed in gst-plugins-good version 1.28.3 and later.
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.
CVE-2026-123800 is a critical authorization bypass vulnerability in SuperTokens Core affecting multiple versions from 6.0.0 up to but not including various fixed releases. The flaw allows an attacker with a valid API key for one application in a licensed multi-tenant deployment to update the parent connection URI domain and manipulate sibling application keys and user sessions. This can lead to unauthorized access, modification of user data, persistence establishment, and denial of service to sibling applications. The issue is fixed in versions including 12.3.1, 12.2.1, 12.1.2, 12.0.11, 11.4.8, 11.3.8, 11.2.4, 11.1.4, 11.0.9, and 10.1.9.
A vulnerability in loggingredactor versions prior to 0.0.7 caused personally identifiable information (PII) to be exposed in logs. Specifically, PII contained in the string or representation output of non-primitive objects was not redacted when custom __str__ and __repr__ methods were used. This flaw was addressed in version 0.0.7.
CVE-2026-120834 is an Incorrect Privilege Assignment vulnerability in the Tobias WP2LEADS plugin, affecting versions from initial release up to 3.5.17. This flaw allows unauthorized privilege escalation. The issue is addressed in version 3.5.18.
CVE-2026-121769 is a high-severity SQL Injection vulnerability in the WP w3all phpBB integration plugin for WordPress, affecting versions prior to 3.2.0. This flaw allows an attacker with low privileges to execute SQL commands that can compromise confidentiality and availability. The issue is fixed in version 3.2.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.7.
SuperTokens Core is an open source authentication server. From 11.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2, Dashboard.isValidUserSession treats any stored session row as valid without comparing DashboardSessionInfo.expiry to the current time. DashboardQueries.getSessionInfoWithSessionId also selects by app and session identifier without an expiry predicate, leaving the periodic DeleteExpiredDashboardSessions cleanup as the only expiration enforcement. An attacker who obtains a dashboard administrator session after its 30-day lifetime can continue using POST /recipe/dashboard/session/verify until the row is removed, and frequent Core restarts can prevent the 12-hour cleanup sweep from running. The stale session retains full dashboard read and write access, but the flaw does not provide a way to guess or acquire the random session identifier. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2.
SuperTokens Core versions 11.3.0 through 11.3.6, 11.4.0 through 11.4.6, and 12.0.6 through 12.0.9 contain an improper authentication vulnerability due to incorrect SAML signature validation. The software accepts cryptographically valid signatures that reference different XML elements than those used for authentication, enabling XML Signature Wrapping attacks. This allows an attacker to impersonate another identity provider user. The issue affects both response-level and assertion-level signing and is fixed in versions 11.3.7, 11.4.7, and 12.0.10.
CVE-2026-84503 is a vulnerability in the ansible-core ansible.builtin.git module used by Red Hat Migration Toolkit for Applications 8. The module invokes git commands with a repository URL as a positional argument without a '--' separator, allowing a repository URL starting with a dash to be interpreted as a git command-line option. This can lead to argument injection and arbitrary command execution on the host running the module if an attacker controls the repository URL.
SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8.
A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length of the value. An authenticated user can submit a large token-free rrule through the REST API, including the schedule preview endpoint, which requires no resource-level permissions; validation runs synchronously in the API web worker, so a single such request occupies a worker for an extended time and repeated requests can exhaust the web worker pool, denying access to the API and web UI while the attack is sustained. The impact is limited to availability.
CVE-2026-60117 is a path traversal vulnerability in the Android implementation of the Flutter/Dart receive_sharing_intent package versions 1.4.1 through 1.9.0. It allows a malicious app to write files outside the intended cache directory by supplying a crafted _display_name value from an untrusted ContentProvider. This can lead to file overwrite within the receiving application's private sandbox without user interaction.
A vulnerability in compose-lint versions from 0.32.0 up to but not including 0.33.0 allows exposure of sensitive information from .env files. The issue arises because the tool's remediation for secret disclosure is incomplete when the number of findings exceeds 20,000, causing resolved secret values to be emitted in output formats such as text, JSON, SARIF, and Code Scanning. This can occur if a workflow writes secrets into a sibling .env file and lints untrusted changes. The vulnerability is fixed in version 0.33.0.
The npm package react-bootstrap-table2-toolkit-bg contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package react-bootstrap-table-next-bg contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious components, as the attacker may have gained full control of the system.
The npm package 'file-saver-bg' contains malicious code that fully compromises any computer on which it is installed or running. The compromise allows an attacker to gain full control over the affected system. Immediate rotation of all secrets and keys stored on the compromised computer is advised, using a different, clean machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affects compose.override.yml and a COMPOSE_FILE entry from 0.22.0, and an env_file target from 0.23.0. If an external Compose-related target fails YAML parsing, the error quotes an attacker-uncontrolled line into standard error, JSON errors, and SARIF notifications, while an external env_file can expose credential-like key names through CL-0020 and CL-0021 findings. The attacker selects the target path but not the exact parser-failure line, values from env_file are not printed, and the pass or fail result is unchanged. This issue is fixed in version 0.25.0.
The archetype-index-sdk npm package contains malicious code that fully compromises any computer on which it is installed or running. Immediate rotation of all secrets and keys stored on the affected computer is strongly advised. Removal of the package is recommended, but it may not eliminate all malicious software due to potential full system compromise.