Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.
CVE-2026-104061 is a heap out-of-bounds write vulnerability in Scribus versions before 1.6.7. It occurs in the scimgdataloader_psd loader due to unchecked PSD file values used as array indexes. An attacker can exploit this by convincing a user to open or import a crafted PSD file, leading to heap corruption, application crashes, and potentially arbitrary code execution with user privileges.
CVE-2026-119369 is a stored cross-site scripting (XSS) vulnerability in The Events Calendar plugin by Liquid Web / StellarWP. It affects versions from initial releases up to 6.18.2. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 6.18.3.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
The PHP2Shell vulnerability involves critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that have been actively exploited for over a week. Attackers, notably a China-linked group, have successfully chained these PHP2Shell flaws with the Fragnesia Linux kernel privilege escalation bug to gain root access on Palo Alto Networks PAN-OS firewalls. Despite over 22.6 million exposed PHP instances potentially vulnerable, successful exploitation has been limited, with WordPress sites remaining largely unaffected. Palo Alto Networks has released patches for multiple PAN-OS versions and urges customers to restrict internet access to management interfaces. The attacks appear opportunistic and originate from a small number of IP addresses, targeting various sectors including healthcare and technology.
CVE-2026-116407 is a missing authorization vulnerability in Webba Plugins Webba Booking up to version 6.5.4. It allows attackers with limited privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure or modification. The issue is fixed in version 6.5.5.
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.
Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.
CVE-2026-46499 is an authorization vulnerability in Collabora Online before versions 24.04.18 and 25.04.11. It allows read-only users to bypass the read-only restriction by sending crafted WebSocket messages to execute document-modifying commands. Although these unauthorized changes cannot be saved directly by the attacker and are discarded when the session ends, they can mislead other collaborators or be saved unknowingly by authorized editors sharing the session. This issue has been fixed in the specified versions.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective `Content Security Policy`, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the `Content Security Policy` header sent by `coolwsd` mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object.
This vulnerability was patched on 11 September 2026, and no customer action is needed.
libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.
joserfc versions prior to 1.7.6 have a vulnerability in their compact JWS size guard. The library allocates attacker-controlled segments by splitting the input bytes before validating their size, causing an additional large memory allocation before rejecting oversized inputs. This can lead to increased memory usage and potential denial of service due to memory exhaustion. A fix is available in version 1.7.6 that adds size checks before splitting the input.
The joserfc library's decrypt_json() function for JWE General JSON Serialization accepts an unbounded recipients array, performing an RSA private-key decryption for each recipient without limit. This allows an unauthenticated attacker to cause CPU exhaustion (Denial of Service) by sending a single JWE with many recipients. The library caps other JWE structural elements but does not limit recipient count. The documented mitigation option verify_all_recipients=False does not reduce CPU usage, as all recipients are decrypted regardless. This vulnerability is fixed in joserfc version 1.7.5.
A race condition in charmbracelet/soft-serve's SetPrivate function causes a private repository to remain readable by unauthenticated users until the server restarts. The issue arises because the repository visibility cache is cleared before the database commit, allowing a stale public record to be cached and used for access checks after the repository is made private. This stale cache persists until eviction or server restart, enabling continued unauthorized read access over HTTP, SSH, and git protocols. The flaw affects versions 0.6.0 through 0.12.2 and is fixed in version 0.12.3.
CVE-2026-61626 is a high-severity out-of-bounds write vulnerability in libass versions 0.17.4 up to but not including 0.17.5. It arises from insufficient validation of negative Matroska ReadOrder values during event pruning, potentially allowing an attacker to clear bits near a NULL pointer. Exploitation requires a malicious Matroska stream processed with enabled read-order checking and explicit event pruning. The vulnerability is fixed in libass version 0.17.5.
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in `backend/app/incidents/routes/incident_alert.py` omit role and tenant authorization, and `POST /api/incidents/alerts/create/velo-sigma/exclusion` does not validate credentials. Its `return_username_for_logging` dependency in `backend/app/auth/utils.py` calls `decode_token`, which returns ordinary Invalid token or Expired signature strings on failure, and the dependency passes these strings through instead of rejecting the request. A Bearer header is required, but an arbitrary invalid, expired or forged value can create a suppression rule without a valid account. The collection GET at /create/velo-sigma/exclusion lists exclusions; the read, update and delete routes under `/create/velo-sigma/exclusion/{exclusion_id}`, and the `/velo-sigma/exclusion/{exclusion_id}/toggle` route, use `get_current_user` without role checks, permitting any authenticated `customer_user` to manage every exclusion. In `backend/app/incidents/services/velo_sigma.py`, `process_sigma_alert` calls `check_exclusions` and drops matching enabled alerts before incident creation. A null `customer_code` applies a rule across all tenants. Attackers can suppress detections platform-wide through channel, title or field matching, while low-privilege accounts can enumerate detection-tuning data and modify, disable or delete legitimate exclusions. This issue is fixed in version 0.1.77.
Soft Serve, a Go-based Git server, improperly discloses the existence, exact names, and clone URLs of private repositories via HTTP responses. This occurs because the server responds to certain requests without verifying if the requester has read access, allowing enumeration of private repository names. Repository contents and metadata remain protected, and no write access is exposed. The issue affects versions from 0.5.0 up to but not including 0.12.3 and is fixed in version 0.12.3.