CVE-2026-77173 is an improper access control vulnerability in Nextcloud Files Confidential affecting versions 3.3.0 through 5.0.0. It allows a user to create a .docx or .odt file with a '#' character in the filename containing confidential information, such as credit card numbers, without the file being marked as confidential.
CVE-2026-67400 is a low-severity vulnerability in Nextcloud Richdocuments where a missing token type check allows retrieval of additional WOPI configuration information using a user or guest token.
CVE-2026-77171 is an improper access control vulnerability in Nextcloud Collectives version 4.0.0 where a public shared collective link allowed recipients to create pages. This flaw could lead to unauthorized content creation by link recipients.
A vulnerability in Nextcloud Server versions 32.0.0 through 34.0.0 allows app passwords to bypass password confirmation on sensitive endpoints. This improper privilege management issue can lead to unauthorized actions without the usual password verification step.
CVE-2026-87897 is a server-side request forgery (SSRF) vulnerability in Nextcloud Whiteboard versions prior to 1.0.0. It allows a low privileged attacker to access internal Chrome Devtools Protocol APIs and leak JWT authentication tokens of other users. Exploiting this flaw can grant the attacker read/write access to the victim's Whiteboard session. The vulnerability has a medium severity score of 4.6 and was fixed in version 1.0.0.
A vulnerability in the Nextcloud Tables app allows users with read-data access to enumerate all share recipients and their permission levels for a table via a share-listing API endpoint. This exposure does not include the table's data itself, only metadata about sharing. The flaw affects versions from 0.8.1 through 2.0.0 and has a low severity rating.
CVE-2026-82986 is an improper access control vulnerability in Nextcloud Tables versions 0.6.4 through 1.0.0. It allows a user who is a member of a group to bypass group restrictions set by an administrator on link sharing, enabling them to create share links for tables without having the required permission.
CVE-2026-54462 is a resource exhaustion vulnerability in the knative.dev/pkg webhook admissionHandler prior to version 0.0.0-20260531000007-52dbd5ece63f. The webhook handler decodes attacker-supplied AdmissionReview requests without limiting the request body size, allowing a pod-network client to send an oversized POST request that causes memory exhaustion and pod termination. This affects all downstream consumers using the shared webhook server, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. The issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f.
Starting around October 20, 2026, unprotected Cairn AI pentesting harnesses have been targeted by automated campaigns from unknown actors. These attackers insert malicious tasks to manipulate AI agents, leading to host system compromise through profiling, credential theft including AI model API keys, Poseidon malware deployment, and unauthorized SSH key installation. Two distinct threat clusters, AIA0009 and AIA0010, conduct synchronized attacks focusing on persistence/malware deployment and exploration/credential extraction respectively. The campaigns use AI-driven automation to attack AI operations, including container escape attempts and reconnaissance. Poseidon RAT is deployed with Bunny.net CDN-based command and control infrastructure.
This is a credential phishing campaign targeting professionals through fake business bid invitations. It uses password-protected PDF attachments to evade automated security scans. The PDFs contain a fake OneDrive button that redirects victims to a fraudulent document-sharing site, prompting them to enter their email and then credentials on a counterfeit Microsoft login page. The campaign exploits trusted business workflows and familiar brand interfaces to bypass technical and human defenses.
The qs library version 6.7.0 through 6.16.0 has a vulnerability in its stringify function when using the arrayFormat 'comma'. If an array element has a non-callable own toString property, qs.stringify throws an uncaught TypeError. This can be triggered remotely by an unauthenticated attacker controlling input that is later serialized with this option, potentially crashing the Node.js process and causing a denial of service. There is no impact on confidentiality or integrity, and no prototype pollution occurs.
GFI KerioConnect before version 10.0.8 Patch 2 contains a stored cross-site scripting (XSS) vulnerability in its Webmail component. This flaw allows remote attackers to execute JavaScript in an authenticated user's Webmail session by uploading a specially crafted SVG email attachment that bypasses sanitization of event-handler attributes. Exploitation leverages the temporary-download endpoint's weak Content-Security-Policy sandbox, enabling script execution when the attachment is opened. This can lead to theft of user credentials and mailbox contents. The vulnerability is rated medium severity with a CVSS score of 6.2 and has been observed exploited in the wild by Proofpoint Threat Research. A fix is available in version 10.0.8 Patch 2.
The undici WebSocket client, when using HTTP/2 (enabled by default with allowH2: true), crashes the Node.js process if it connects to a malicious server that responds with a failed WebSocket handshake over HTTP/2. This occurs because the client aborts the request too late, leaving an open HTTP/2 stream that emits an unhandled error when the server closes the connection, causing a denial of service. Versions 8.11.0 and 8.11.1 are affected. A fix is available in version 8.11.2. Workarounds include disabling HTTP/2 for WebSocket connections or avoiding untrusted servers until patched.
Authlib versions up to 1.7.2 accept an empty HMAC key for JWS/JWT HS256/HS384/HS512 signature verification, allowing attackers to forge tokens with arbitrary claims. The empty key produces a deterministic digest that anyone can reproduce, bypassing signature verification. This vulnerability affects OAuth 2.0 resource servers and OIDC relying parties using Authlib if the verification key can be empty at runtime. The issue is fixed in Authlib 1.9.1.
A vulnerability in rustls versions 0.23.44, 0.23.45, and certain 0.24.0-dev releases causes buffered application data to be sent to the server before the client sends the mandatory 'ech_required' alert when Encrypted Client Hello (ECH) is rejected. This violates RFC 9849 requirements that no application data be sent before the alert. The issue affects clients using EchMode::Enable that send application data before handshake completion and connect to servers rejecting their ECH config. The flaw was fixed in rustls 0.23.46 and 0.24.0-dev.2.
A vulnerability in rustls allows a network attacker to poison the client's per-server-name key-exchange record by sending an unauthenticated ServerHello selecting the X25519 group. This causes subsequent ClientHellos for that server name to carry only an X25519 share, potentially leading the handshake to complete with classical key exchange only, losing quantum-resistant confidentiality. No authentication bypass or key compromise occurs. The issue is fixed in rustls versions 0.23.46 and 0.24.0-dev.2.
A vulnerability in rustls versions prior to 0.23.46 and between 0.24.0-dev.1 and 0.24.0-dev.2 allows the TLS master secret or TLS 1.3 resumption PSK to be exposed when formatting a client session value with the Debug trait. This can lead to leakage of sensitive key material if a custom ClientSessionStore logs these debug outputs. Built-in diagnostics do not expose these secrets, and the session-store interface warns about the sensitivity of these values.
Rustls contains a vulnerability in its Brotli certificate decompression feature, which is disabled by default. The Brotli decoder accepts an input-specified history window size that can be up to 1 GiB, potentially causing large memory allocations. This can lead to denial of service via memory exhaustion if a malicious peer sends specially crafted Brotli-encoded certificates. Both clients and servers enabling Brotli decompression and client authentication are affected. The issue is fixed in rustls versions 0.23.46 and 0.24.0-dev.2.
A Brazilian Magecart group exploited a critical vulnerability (CVE-2026-8467) in Plausible Community Edition versions 3.0.0 through 3.2.0 to inject a card skimmer into the Plausible analytics script used by the Brazilian ecommerce platform Convertr. From October 24 to October 27, 2026, the malicious script stole payment card details, CVV, expiry dates, cardholder names, and CPF taxpayer numbers from shoppers during checkout. The stolen data was exfiltrated to the domain 1x0.is. Convertr removed the skimmer and patched the vulnerability on October 27. This Magecart group has targeted multiple Brazilian ecommerce platforms since 2024 using distinctive data exfiltration techniques.
Attackers compromised camera management software (CMS.exe) to gain initial access to multiple organizations. They deployed malware (rs.win32.exe) into user AppData directories and used DLL sideloading with the legitimate Windows binary WpcMon.exe and malicious DLLs to establish beaconing to a command-and-control server. Persistence was maintained via Run Key registry modifications. The affected camera management software, possibly linked to 3R Global and kvision.ai, lacked sufficient security controls and logging. Organizations are advised to treat camera systems and their management platforms as critical attack surfaces and implement access controls and monitoring to detect unusual activity.
