The TwigView plugin for CakePHP versions prior to 1.3.3 and 2.1.2 contains a deserialization vulnerability due to unrestricted use of the unserialize filter. This flaw allows deserialization of untrusted data, potentially enabling remote code execution. The issue has been fixed in versions 1.3.3 and 2.1.2.
CVE-2026-61810 is a vulnerability in libspdm version 1.4.0 where the FINISH request and response messages include new fields (OpaqueDataLength and OpaqueData) that are not covered by the signature or HMAC verification. This omission allows an active attacker to modify the opaque data in transit without detection. The issue was addressed in libspdm version 1.4.1.
OpenSearch Dashboards versions 2.14.0 to before 2.19.6 and 3.0.0 to before 3.7.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the fetchDataSourceMetaData route. This flaw allows an authenticated user to supply internal or loopback endpoints to probe internal network resources because this route does not validate URLs against configured deny or allow lists. The vulnerability has been fixed in versions 2.19.6 and 3.7.0.
CVE-2026-64678 is a critical deserialization vulnerability in nitrite-java versions prior to 4.4.1. The vulnerability arises from unsafe deserialization of legacy database files without any class allowlist or filtering, allowing arbitrary classes on the application classpath to be instantiated during deserialization. This can enable remote code execution if a suitable gadget class is present. The issue is fixed in version 4.4.1.
The npm package 'chalks-log' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, secure machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package @solana-trade/core contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets and keys from a separate, uncompromised system is strongly advised.
The termchalk npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removal of the package alone does not guarantee elimination of the malicious software, as full control may have been granted to an external attacker.
The npm package 'prettlog' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate all malicious software introduced by its installation, as full control of the system may have been granted to an attacker.
AstroBlocks versions prior to 3.4.0 contain a critical vulnerability due to a hard-coded fallback JWT secret and a mismatched environment variable name. This flaw allows an attacker who knows the public fallback secret to forge admin session tokens with owner-level privileges, enabling full administrative control over the CMS. The vulnerability is patched in version 3.4.0.
CVE-2026-64669 is an improper authorization vulnerability in pam_usb versions 0.8.0 through before 0.9.3. The flaw arises from incorrect IPv6 address detection in the deny_remote feature, causing remote tmux sessions from compressed IPv6 addresses to be undetected. This allows remote clients to bypass the intended restriction. The issue is fixed in version 0.9.3.
The npm package 'kbmathlessons' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of the malicious software, as the attacker may have gained full control of the system.
CVE-2026-64667 is an out-of-bounds read vulnerability in pam_usb versions prior to 0.9.3. The flaw occurs in the function pusb_get_tty_from_display_server, which reads the /proc/<pid>/cmdline file into a fixed-size buffer without ensuring a null terminator when exactly 4096 bytes are read. This can cause subsequent string operations to read beyond the buffer boundary. The vulnerability is triggered during PAM authentication when the DISPLAY environment variable is set. The impact is limited to potential information disclosure and a possible crash (SIGSEGV) of the PAM process. The issue is fixed in pam_usb version 0.9.3.
A vulnerability in pam_usb prior to version 0.9.3 allows an attacker to bypass the XRDP session denial rule by manipulating the XRDP_SESSION environment variable. This occurs because pam_usb uses the insecure getenv(3) function instead of secure_getenv(3) to read XRDP_SESSION, enabling environment-based detection to be defeated. The issue is fixed in version 0.9.3.
CVE-2026-64668 is an improper authorization vulnerability in pam_usb versions 0.8.0 through before 0.9.3. The flaw arises from incorrect detection of remote tmux sessions due to a regex mismatch caused by IPv6 zone indices in multi-homed Linux systems. This leads to unauthorized access being granted when remote sessions are present. The issue is fixed in version 0.9.3.
Waline versions 3.15.2 and earlier contain a stored cross-site scripting (XSS) vulnerability in the comment editor's live preview feature. The vulnerability arises because the preview uses the marked library without sanitization and injects HTML via v-html. When an administrator edits a comment, the raw, unsanitized comment body is rendered, allowing an unauthenticated attacker to execute stored XSS in the administrator's session by tricking them into clicking Edit on a malicious comment. No patches are publicly available at the time of disclosure.
Waline versions 3.15.2 and earlier contain a stored cross-site scripting (XSS) vulnerability in the @waline/client UserList widget. The widget inserts commenter nicknames and links directly into the DOM without HTML escaping, allowing an unauthenticated attacker to inject malicious scripts via the link field. This script executes automatically in the browsers of all visitors viewing the UserList widget. No patches are publicly available at the time of disclosure.
This Red Hat Security Advisory addresses multiple security vulnerabilities in Mozilla Firefox and related components, including denial of service, privilege escalation, information disclosure, use-after-free, sandbox escapes, mitigation bypasses, spoofing, race conditions, integer overflows, and incorrect boundary conditions. The update is for Red Hat Enterprise Linux 9.6 Extended Update Support and includes fixes for a broad range of issues affecting Firefox and Thunderbird components. The advisory rates the security impact as Important and provides a comprehensive set of patches to remediate these vulnerabilities.
Padloc versions from 4.0.0 up to but not including 4.3.1 contain an authentication bypass vulnerability in the legacy retrieveMFAToken handler. This flaw allows unauthenticated attackers who know a victim's email address to brute force the 6-digit multi-factor authentication code without incrementing the attempt limit. Successful brute forcing can yield verification tokens that are usable in signup, login, and account recovery processes.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a denial of service vulnerability in the ElasticStore and SPARQLStore components. This flaw arises from the ConceptDescriptionInterpreter classes re-expanding concepts without memoization or limiting expansion, allowing users with page-edit rights to create acyclic chains of Concept: pages that cause excessive CPU and memory consumption during queries. The vulnerability can be triggered via concept page views, Special:Ask, or the api.php action=ask endpoint.
Padloc versions 4.0.0 up to but not including 4.3.1 contain a prototype pollution vulnerability. This flaw allows SCIM token holders to modify the Object.prototype by sending specially crafted SCIM PATCH requests to the ScimServer._handleScimUsersPatch() function. By manipulating paths such as __proto__.x or constructor.prototype.x, attackers can pollute the shared server process, potentially disrupting requests for all organizations served by that process. The vulnerability has a high severity rating with a CVSS score of 7.6.