ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations.
CVE-2026-119147 is an authorization bypass vulnerability in ProFTPD versions before 1.3.9e and 1.3.10rc5. It affects the mod_sftp copy-file extension handler, allowing authenticated SFTP users to copy readable files to new locations in directories where write permissions are denied. This bypasses the intended Limit WRITE restrictions, enabling unauthorized file creation in protected directories.
ProFTPD versions before 1.3.9e and between 1.3.10rc1 and before 1.3.10rc5 contain a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap. This flaw allows remote attackers to send FTP command arguments longer than 1024 bytes, potentially overwriting static buffers and corrupting session memory, which can lead to session crashes. The vulnerability can be exploited without authentication if pre-login commands are rewritten.
A highly critical access bypass vulnerability (CVE-2026-118539) in the Drupal Commerce Core module is actively exploited in the wild. This flaw allows unauthenticated attackers to bypass access controls on certain routes and entity fields, potentially leading to financial impact for online store vendors. The vulnerability affects Commerce Core 3.x versions prior to 3.3.13 and earlier 8.x-2.x releases before 8.x-2.41. Drupal urges administrators to update to fixed versions and audit their store orders for inconsistencies. The module is widely used on over 42,000 sites. Drupal assigned a high risk score of 21 out of 25 to this vulnerability. No detailed exploitation methods or attacker identities have been disclosed.
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.
A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.
The stdid-nyxprobe package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command to execute this code, serving no legitimate purpose beyond data exfiltration. The risk is limited but present due to the unauthorized data collection.
An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the discussion thread, their browser automatically sends an HTTP/HTTPS request to the server controlled by the attacker, who can then collect information such as the source IP address, the User-Agent header, the date and time of access, and other metadata derived from the request, thereby compromising the user’s privacy.
A supply chain attack targeting Polymarket traders involved malicious code injected via a compromised third-party website monitoring tool, DebugBear. The malicious JavaScript hijacked logged-in user sessions to siphon funds by selling positions or transferring tokens to attacker-controlled addresses. Polymarket's international platform was affected, resulting in over $2 million in losses, while the US platform remained unaffected. Polymarket halted trading temporarily, removed the malicious script, and pledged to reimburse affected users. DebugBear confirmed the incident and advised users to remove its monitoring snippet.
Kairos is a newly documented Linux DDoS botnet written in Go that compromises machines via Telnet using default root credentials with empty passwords. It establishes hundreds to thousands of TCP connections to targeted services, maintaining them with minimal keepalive traffic to exhaust resources. The bot uses a simple three-command protocol and masquerades as a kernel worker thread. It supports multiple CPU architectures and uses a build-per-command-and-control distribution model.
CVE-2026-97229 is a critical code execution vulnerability in GitLab caused by insufficient validation in Ruby's Onigmo regular expression engine. It allows unauthenticated attackers to execute arbitrary code on the GitLab server via crafted CI/CD configurations. The vulnerability was exploited in an attempted attack against Alpine Linux's GitLab instance, which failed but prompted a full rebuild and password resets. The flaw is rooted in Ruby, not GitLab itself, requiring updates to Ruby versions 3.3.13, 3.4.12, 4.0.9 or later for full remediation. The US CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging rapid patching.
The Claude Code extension version 2.1.313 in the Cursor Marketplace was compromised with a malicious loader that installs an SSH backdoor. This backdoor adds an attacker-controlled SSH key to authorized_keys, attempts to enable local SSH services, and establishes a reverse SSH tunnel to a remote server. It collects system and user reconnaissance data and installs persistence mechanisms on macOS, Linux, and Windows. Communications with the command-and-control server are unencrypted, allowing persistent remote access.
A denial-of-service vulnerability in UAA's private_key_jwt client-authentication mechanism allows an attacker with write access to clients or a compromised endpoint to cause service unavailability. This occurs by triggering repeated parsing of large cached JSON Web Key Set (JWKS) objects, leading to excessive CPU usage and potential Java heap exhaustion resulting in OutOfMemoryError.
CVE-2026-59385 describes a vulnerability where a user with SpaceDeveloper privileges can modify the URL of a space-scoped broker without changing its credentials. This allows the user to indirectly extract existing broker credentials by redirecting them to a broker they control. The Cloud Foundry API does not allow direct reading of broker credentials, so this method bypasses that restriction. The vulnerability has a low severity score of 2.7 and does not impact integrity or availability.
Cloud Controller (CAPI) has multiple instances where sensitive data is leaked into audit logs. Specifically, credentials for custom buildpacks appear in audit events related to app manifest application, creation, and updates. Additionally, syslog drain URL credentials are exposed in user-provided service instance audit events, and service binding parameters are leaked in app manifest and service binding audit events. This exposure could lead to unauthorized access to sensitive credentials if audit logs are accessed by unauthorized parties.