A stored cross-site scripting (XSS) vulnerability exists in the Live Composer WordPress plugin before version 2.1.24. The plugin fails to properly sanitize and escape certain module settings before outputting them in an href attribute. This flaw allows high-privilege users, such as administrators, to inject malicious scripts even when the unfiltered_html capability is disabled, such as in multisite WordPress setups.
Able2Shell is a collection of 33 reported zero-day vulnerabilities in N-able N-central, disclosed publicly with proof-of-concept code. Among these, seven critical vulnerabilities have been officially recognized and patched by N-able in the N-central 2026.4 Hotfix 2 release. The vulnerabilities include high-severity issues such as XML external entity (XXE) attacks, server-side request forgery (SSRF), OGNL injection, local privilege escalation, remote code execution, and stored cross-site scripting (XSS). One exploit chain allows unauthenticated remote command execution as the nable user, and others can lead to root privileges through chained exploits. N-able has confirmed and patched the most critical issues but has not mapped all 33 findings individually. The affected versions are N-central prior to 2026.4.1.26. No confirmed customer compromises have been reported as of November 10, 2026.
Fenrir Inc.'s Sleipnir Mobile for iPhone / iPad, including the Black Edition, suffers from improper certificate validation. This vulnerability could allow a man-in-the-middle attacker to intercept encrypted communications. The issue affects versions up to and including 4.15.1. The CVSS score is 4.2, indicating a medium severity level.
Akaunting version 3.3.0 contains a stored cross-site scripting (XSS) vulnerability in its XLSX item-import workflow. An authenticated Manager can import an item with a name containing malicious HTML markup. When another authenticated user selects this item while creating a document, the stored name is rendered using Vue's v-html directive, leading to execution of attacker-controlled code within the victim's Akaunting session.
Sleipnir Mobile for iPhone and iPad, including the Black Edition provided by Fenrir Inc., is vulnerable to improper certificate verification. This vulnerability relates to the application's failure to correctly validate SSL/TLS certificates, which could undermine secure communications.
A path traversal vulnerability (CWE-22) exists in the TwigView plugin for CakePHP versions prior to 1.3.3 and 2.1.2. This flaw allows arbitrary file reading when unvalidated user input is passed to the FileLoader::findTemplate() function. The issue has been fixed in versions 1.3.3 and 2.1.2.
The TwigView plugin for CakePHP versions prior to 1.3.3 and 2.1.2 contains a deserialization vulnerability due to unrestricted use of the unserialize filter. This flaw allows deserialization of untrusted data, potentially enabling remote code execution. The issue has been fixed in versions 1.3.3 and 2.1.2.
CVE-2026-61810 is a vulnerability in libspdm version 1.4.0 where the FINISH request and response messages include new fields (OpaqueDataLength and OpaqueData) that are not covered by the signature or HMAC verification. This omission allows an active attacker to modify the opaque data in transit without detection. The issue was addressed in libspdm version 1.4.1.
OpenSearch Dashboards versions 2.14.0 to before 2.19.6 and 3.0.0 to before 3.7.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the fetchDataSourceMetaData route. This flaw allows an authenticated user to supply internal or loopback endpoints to probe internal network resources because this route does not validate URLs against configured deny or allow lists. The vulnerability has been fixed in versions 2.19.6 and 3.7.0.
CVE-2026-64678 is a critical deserialization vulnerability in nitrite-java versions prior to 4.4.1. The vulnerability arises from unsafe deserialization of legacy database files without any class allowlist or filtering, allowing arbitrary classes on the application classpath to be instantiated during deserialization. This can enable remote code execution if a suitable gadget class is present. The issue is fixed in version 4.4.1.
The npm package 'chalks-log' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, secure machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package @solana-trade/core contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets and keys from a separate, uncompromised system is strongly advised.
The termchalk npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removal of the package alone does not guarantee elimination of the malicious software, as full control may have been granted to an external attacker.
The npm package 'prettlog' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate all malicious software introduced by its installation, as full control of the system may have been granted to an attacker.
AstroBlocks versions prior to 3.4.0 contain a critical vulnerability due to a hard-coded fallback JWT secret and a mismatched environment variable name. This flaw allows an attacker who knows the public fallback secret to forge admin session tokens with owner-level privileges, enabling full administrative control over the CMS. The vulnerability is patched in version 3.4.0.
CVE-2026-64669 is an improper authorization vulnerability in pam_usb versions 0.8.0 through before 0.9.3. The flaw arises from incorrect IPv6 address detection in the deny_remote feature, causing remote tmux sessions from compressed IPv6 addresses to be undetected. This allows remote clients to bypass the intended restriction. The issue is fixed in version 0.9.3.
The npm package 'kbmathlessons' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of the malicious software, as the attacker may have gained full control of the system.
CVE-2026-64667 is an out-of-bounds read vulnerability in pam_usb versions prior to 0.9.3. The flaw occurs in the function pusb_get_tty_from_display_server, which reads the /proc/<pid>/cmdline file into a fixed-size buffer without ensuring a null terminator when exactly 4096 bytes are read. This can cause subsequent string operations to read beyond the buffer boundary. The vulnerability is triggered during PAM authentication when the DISPLAY environment variable is set. The impact is limited to potential information disclosure and a possible crash (SIGSEGV) of the PAM process. The issue is fixed in pam_usb version 0.9.3.
A vulnerability in pam_usb prior to version 0.9.3 allows an attacker to bypass the XRDP session denial rule by manipulating the XRDP_SESSION environment variable. This occurs because pam_usb uses the insecure getenv(3) function instead of secure_getenv(3) to read XRDP_SESSION, enabling environment-based detection to be defeated. The issue is fixed in version 0.9.3.
CVE-2026-64668 is an improper authorization vulnerability in pam_usb versions 0.8.0 through before 0.9.3. The flaw arises from incorrect detection of remote tmux sessions due to a regex mismatch caused by IPv6 zone indices in multi-homed Linux systems. This leads to unauthorized access being granted when remote sessions are present. The issue is fixed in version 0.9.3.