CVE-2026-24269 is a server-side request forgery (SSRF) vulnerability in NVIDIA TensorRT-LLM version 1.3.0rc24. Exploitation could allow an attacker to cause unauthorized requests from the server, potentially leading to information disclosure and data tampering. The vulnerability has a high severity score of 7.1 CVSS v3.1. No public exploits or patches are currently documented.
CVE-2026-65119 is a high-severity vulnerability in NVIDIA TensorRT-LLM version 1.3.0rc24 affecting the KvCacheAwareRouter tokenizer loading. It allows an attacker to cause inclusion of functionality from an untrusted control sphere, potentially leading to code execution, information disclosure, data tampering, and denial of service.
Two critical use-after-free vulnerabilities in the PHP engine's session.upload_progress feature allow unauthenticated remote code execution by bypassing WAFs during multipart request parsing. Exploit code rapidly spread after the October 21, 2026 patch release, with UNC actors targeting over 70% of unpatched PHP infrastructure globally. Exploitation campaigns include mass scanning, Mirai botnet C2 infrastructure, and session poisoning via WordPress LFI vulnerabilities, affecting public, business, and educational sectors worldwide.
DarkCore is a remote access trojan (RAT) that steals credentials and hijacks user sessions by reusing stolen session cookies to access services like Gmail and WhatsApp. It routes traffic through victims' IPs to mimic legitimate activity and includes hidden virtual network computing (HVNC) for stealthy desktop access. Distributed via PDF-themed shortcuts that deliver decoy documents alongside malware, DarkCore communicates with its command-and-control servers over TCP and can load additional modules dynamically.
Three VBScript-based malware campaigns target victims primarily in Brazil and Portugal via phishing emails using fake legal and financial documents. These campaigns deliver Overlord RAT, Lampion trojan, and an unknown RAT through multi-stage execution chains involving obfuscated VBScript, batch files, and DLL side-loading with legitimate Windows components. The malware establishes persistence via scheduled tasks and registry modifications, evades detection by adding exclusions to Windows Defender and checking for virtual environments, and uses cloud services for payload delivery. Command and control infrastructure is based in Brazil.
CVE-2026-100164 is an observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd.'s Agentis product. This flaw allows attackers to perform account footprinting by observing differences in system responses. The vulnerability affects Agentis versions prior to 4.8. A fix is available in version 4.8. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.
DreamHost experienced an unexplained security incident affecting some of its systems, including its File Manager service and webmail. In response, the company suspended the File Manager service and reset passwords for some email and FTP/SFTP users as a precaution. DreamHost notified account owners to reset passwords and warned that it would not request password resets via email. The company has deployed a fix to the File Manager and restored service while monitoring the situation. Details about the root cause and the number of affected users have not been disclosed.
CVE-2026-106087 is a high-severity vulnerability in Hitachi Energy TRO600 Series Firmware versions 9.0.0.0 through 9.1.1.0. It allows an unauthenticated attacker to read or download arbitrary files from the device, including sensitive configuration and password files, due to missing authentication on a critical function.
The Hitachi Energy TRO600 Series Firmware versions 9.0.0.0 through 9.2.1.6 contain a vulnerability that allows an authenticated attacker to bypass network access restrictions. This flaw enables attackers to access services intended only for localhost by leveraging port forwarding, potentially exposing sensitive functionality and confidential information and impacting availability.
Eclipse KeyPont versions 2.0.0-rc3 through 2.0.0-rc8 contain a vulnerability in ML-KEM key-pair lookup functions where the public key is not verified against the private key. This allows an attacker with unauthenticated token access to substitute a public key and receive shared secrets intended for the legitimate private key owner, compromising confidentiality. The issue does not affect v1 module paths which lack ML-KEM support.
CVE-2026-13162 is an OS command injection vulnerability in Hitachi Energy's CoreTec 5 product. It affects the configuration daemon's time synchronization handler, which sets the system time-zone. Authenticated users with certain roles can exploit this flaw by supplying crafted input that is concatenated into shell commands without sanitization, allowing arbitrary system command execution with full device control. The vulnerability affects versions from 3.0.0 through 5.0.0 inclusive. The CVSS 4.0 score is 7.7, indicating high severity.
Apple released updates for iOS and macOS 27.2 addressing 286 vulnerabilities, including memory corruption bugs, privilege escalation flaws, sandbox escapes, and remote code execution issues. A critical zero-day vulnerability in CoreGraphics, exploited in the wild, was backported and fixed in iOS 18.7.11. The updates also patch numerous security holes in components such as WebKit, kernel, image handling, and network services. Additional patches were released for other Apple operating systems and software.
CVE-2026-113644 is an OS command injection vulnerability in Eclipse ioFog's iofogctl CLI tool versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1. The vulnerability arises because the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands executed locally and over SSH on remote agent hosts. An attacker who can modify the API response can inject shell metacharacters, causing arbitrary commands to run on the agent host during deployment or attachment. This issue is fixed in version 3.9.2.
CVE-2026-90728 is an improper privilege management vulnerability in Dell PowerProtect Data Domain affecting multiple feature release and LTS versions. A local attacker with high privileges could exploit this flaw to elevate their privileges further. The vulnerability is rated medium severity with a CVSS score of 6.3. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 depending on the release branch.
CVE-2026-105323 is a reflected cross-site scripting (XSS) vulnerability in Kulga News Software versions from 26.7.4 up to but not including 26.10.0. This flaw arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a CVSS 3.1 score of 6.1, indicating a medium severity impact primarily affecting confidentiality and integrity with no impact on availability. A fix is available in version 26.10.0.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and several LTS releases contain an improper privilege management vulnerability (CWE-269). A high privileged attacker with remote access could exploit this flaw to elevate their privileges. The vulnerability has a CVSS score of 6.7, indicating medium severity. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.
Eclipse ioFog Operator versions 3.8.0 up to but not including 3.9.2 disable TLS certificate verification when communicating with the Controller API and logging into an external OIDC issuer. This improper certificate validation allows an on-path attacker to present any certificate, potentially capturing sensitive credentials such as the OAuth client secret or the Controller bootstrap admin password. The vulnerability was fixed in version 3.9.2.
Eaton easySoft versions prior to 8.46 improperly validate TLS certificates from easyE4 devices, allowing a network-adjacent attacker to perform man-in-the-middle attacks. This vulnerability could enable interception or modification of communications between easySoft and easyE4 devices.
The Advanced Custom Fields: Extended WordPress plugin up to version 0.9.2.6 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to delete arbitrary media library attachments by submitting a crafted form with a numeric attachment ID, without verifying user ownership or capabilities. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action that includes a deletable attachment field bound to user input.
The Advanced Views – Display Framework for Gutenberg & Elementor WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter in all versions up to and including 3.9.6. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. These scripts execute whenever a user accesses a page containing the injected comment, including pages displaying pending or unapproved comments due to lack of approval-status filtering.
