CVE-2026-63393 is a high-severity vulnerability in OpenSearch SQL affecting versions from 2.8.0.0 up to but not including 2.19.6.0, and from 3.0.0.0-alpha1 up to but not including 3.7.0.0. It allows a remote authenticated user with basic read/search permissions to exploit unsafe deserialization of untrusted data via the `cursor` parameter in the `plugins/sql` endpoint, leading to arbitrary code execution on the server. The issue is fixed in versions 2.19.6.0 and 3.7.0.0.
CVE-2026-63378 is a code injection vulnerability in TAKO AI Agent for Okta versions prior to 3.0.1-beta. Authenticated users with a valid session cookie can submit arbitrary Python code via a specific API endpoint, bypassing content filtering due to incomplete validation of dynamic code constructs. The injected code is executed with root privileges in the default container, risking full container compromise, exposure of sensitive environment secrets, and backend pivoting. The issue is fixed in version 3.0.1-beta.
CVE-2026-63377 is a critical authentication bypass vulnerability in TAKO AI Agent for Okta versions prior to 3.0.1-beta. It allows an unauthenticated network attacker to create the first administrator account by accessing the POST /api/auth/setup endpoint before the legitimate owner completes initial setup. The flaw arises because the setup endpoint does not require authentication or a bootstrap token and is exposed on all network interfaces by default. Exploitation grants full administrative control, enabling data access, user and configuration modification, and denial of legitimate setup. The issue is fixed in version 3.0.1-beta.
CVE-2026-63346 is a code injection vulnerability in the christianhelle refitter tool prior to version 2.1.2. The flaw arises because header parameter names in OpenAPI specifications are inserted verbatim into C# attribute strings without escaping quotation marks. This allows an attacker to inject malicious code that executes at assembly load time via a [ModuleInitializer] method, even if the generated client is never called. The issue is fixed in refitter version 2.1.2.
CVE-2026-63344 is a high-severity code injection vulnerability in the christianhelle refitter tool prior to version 2.1.2. The flaw arises because content-type keys from OpenAPI descriptions are inserted verbatim into Refit attribute strings without escaping, allowing crafted input to break out of the attribute context and inject a top-level class with a ModuleInitializer method. This method executes attacker code when the generated assembly loads, without requiring client calls. The issue affects refitter versions before 2.1.2 and is fixed in 2.1.2.
CVE-2026-63345 is a code injection vulnerability in the christianhelle refitter tool versions prior to 2.1.2. The vulnerability arises because OpenAPI path keys are inserted verbatim into Refit route attributes without proper escaping, allowing an attacker to inject malicious C# code. This injected code executes at application startup via a ModuleInitializer method when the generated assembly is compiled and loaded, even if the generated client is not explicitly called. The issue is fixed in version 2.1.2.
A malicious file identified by the SHA-256 hash fe06eb908f0b5c042ea623f4e30e822d498b1b410862528b9df59ca52a57e837 was observed by OffSeq Mirage honeypot sensors on 2026-10-30. This file was seen four times in attacker activity involving the T1105 technique (Ingress Tool Transfer) from attacker infrastructure located in Bulgaria. The file hash corresponds to a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.
CVE-2026-61725 is a path traversal vulnerability in hasenbanck's sevenz-rust2, a Rust-native 7z compressor and decompressor. Versions prior to 0.21.1 allow an attacker to craft a malicious 7z archive that, when extracted, can write or overwrite files outside the intended destination directory. This occurs because the decompression code does not normalize or verify the archive entry paths, allowing directory traversal or absolute paths to escape the extraction root. Exploitation can lead to overwriting critical files such as configuration, startup, cron, or build files, potentially resulting in code execution or persistence. The issue is fixed in version 0.21.1.
Aedes MQTT broker versions prior to 1.1.1 are vulnerable to an uncaught exception triggered by excessively deep MQTT topic structures. This exception occurs in the qlobber library when processing topics from PUBLISH, SUBSCRIBE, or Will messages, causing the broker process to terminate. An attacker able to establish an MQTT session can exploit this to disconnect all clients and prevent reconnections until the broker restarts. The issue is fixed in version 1.1.1.
CVE-2026-63121 affects kubewarden policies versions before 2.1.2. The vulnerability arises from improper case-sensitive comparison of image registry hostnames in the trusted-repos-policy. Since DNS hostnames are case-insensitive, an image with uppercase or mixed-case registry hostname can bypass rejection rules configured in reject lists, potentially allowing prohibited images to be admitted. Allow-list configurations do not have this bypass issue as they fail closed. The issue is fixed in version 2.1.2.
CVE-2026-62277 is an authorization bypass vulnerability in hargata lubelog prior to version 1.6.8. The flaw allows an authenticated user to access vehicle maintenance records belonging to other users by exploiting insufficient validation of record IDs in the PrintRecordStickers function. This leads to unauthorized disclosure of sensitive vehicle maintenance data including descriptions, costs, notes, mileage, and attachment metadata. The issue is fixed in version 1.6.8.
OpenRemote versions prior to 1.26.0 contain an SQL injection vulnerability in the datapoint export API. This flaw arises from unsafe concatenation of asset and attribute names into a SQL COPY query using crosstab, allowing an authenticated user with asset creation or renaming permissions to inject SQL code. Exploitation can lead to unauthorized data exfiltration via the exported CSV without needing direct database or filesystem access. The vulnerability is fixed in version 1.26.0.
CVE-2026-63201 is a format string vulnerability in CESNET netopeer2 versions prior to 2.8.21. A low-privileged authenticated NETCONF user can remotely crash the netopeer2-server by sending a malformed get RPC with an invalid subtree filter containing format specifiers. The flaw arises because an already formatted log message is incorrectly reused as a format string, leading to unsafe interpretation of attacker-controlled percent sequences. This causes a denial of service but remote code execution was not confirmed. The issue is patched in version 2.8.21.
CVE-2026-55614 is a medium-severity vulnerability in the openwrt uhttpd HTTP server. It involves improper handling of the Transfer-Encoding header in HTTP requests, where mixed-case transfer-coding tokens are accepted without proper processing. This leads to HTTP request smuggling and boundary desynchronization on keep-alive connections, allowing an attacker to manipulate how requests are parsed.
CVE-2026-55612 is a vulnerability in the uhttpd HTTP server used by OpenWrt. It involves improper handling of invalid chunk-length lines in HTTP requests, leading to HTTP request smuggling and request-boundary desynchronization. This occurs because the server clears certain request state variables without properly draining the request body or signaling connection closure, allowing attacker-controlled data to be parsed as a separate request on the same connection. The issue has been patched in specific commits.
CVE-2026-55613 is an HTTP request smuggling vulnerability in the uhttpd server used by OpenWrt. The flaw occurs when a POST /ubus JSON body arrives in multiple TCP segments, causing desynchronization of HTTP request boundaries. This leads to the server processing an embedded HTTP request in the unread body suffix as a new request on the same keep-alive connection. The issue affects deployments with ubus enabled, including default OpenWrt configurations. Repository patches have been made to address this vulnerability.
Refitter versions prior to 2.1.1 contain a vulnerability where the tool uses unsafe defaults for JSON schema $ref resolution when processing attacker-controlled OpenAPI descriptions. This allows remote HTTP(S) references to be fetched and inlined, and local file paths including directory traversal to be resolved and included, leading to server-side request forgery, remote file inclusion, and local file disclosure. The issue does not lead to code execution due to runtime URL setting and string escaping. The vulnerability is fixed in version 2.1.1.
LightSAML versions prior to 4.7.1 and between 5.0.0 and before 5.0.1 contain a vulnerability in the verification of cryptographic signatures on SAML assertions. The flaw allows an attacker to bypass authentication or escalate privileges by exploiting a mismatch in how LightSAML and xmlseclibs validate which assertion a signature covers. This occurs because the signature validation can be tricked into validating a hidden genuine assertion while LightSAML processes an attacker-controlled unsigned assertion. The issue is fixed in versions 4.7.1 and 5.0.1.
Element Call versions from 0.16.0 up to but not including 0.20.3 log the password URL query parameter in error reports (rageshakes). These logs are shared with the application operator, potentially exposing the encryption password and compromising call confidentiality. The issue is fixed in version 0.20.3. Upgrading prevents future disclosures but does not remove secrets from previously collected logs, which require manual cleanup.
CVE-2026-63115 is an authentication bypass vulnerability in TryGhost's ActivityPub server versions 1.0.0 through 1.2.5. It allows a remote federated server to spoof the origin of an Undo activity, causing the service to remove a follow or repost relationship from another account without authorization. No private data is exposed, and content is not altered. The issue is fixed in version 1.2.6.