CVE-2026-64618 is a critical SQL Injection vulnerability in Apache Fineract through version 1.15.0. It affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing attackers to inject malicious SQL commands due to insufficient input neutralization. The vulnerability is fixed in version 1.16.1.
CVE-2026-82104 is a critical vulnerability in Teltonika Networks RUTOS and TSWOS devices that allows unauthenticated users to bypass authorization and directly invoke LUA functions. This flaw affects multiple device models running specific versions and can lead to operating system command execution due to improper validation of API requests.
Gravity Forms plugin for WordPress versions up to 3.1.2 is vulnerable to PHP Object Injection via a Post Custom Field of type List. This occurs because the plugin uses WordPress' global maybe_unserialize() without restrictions instead of its own hardened deserialization function. An attacker can inject PHP objects into post meta, potentially leading to remote code execution if a suitable gadget chain exists in other plugins, themes, or WordPress core. The vulnerability is critical with a CVSS score of 9.8.
CVE-2026-107249 is a critical vulnerability in the Drupal Block AJAX module that allows improper modification of dynamically-determined object attributes, leading to object injection. This affects versions from 0.0.0 up to but not including 3.0.2. The vulnerability has a high CVSS score of 9.8, indicating it can be exploited remotely without authentication and results in full confidentiality, integrity, and availability impact. A fix is available in version 3.0.2.
CVE-2026-114523 is a critical OS Command Injection vulnerability in the Drupal Ffmpeg Image Toolkit. It affects versions from 0.0.0 up to but not including 1.0.3. The flaw allows an attacker to execute arbitrary operating system commands due to improper neutralization of special elements in OS commands. This vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. A fix is available in version 1.0.3.
CVE-2026-74912 is a critical vulnerability in Imagination Technologies Graphics DDK involving an out-of-range pointer offset due to integer truncation when mapping GPU buffer pages within the 0GB to 4GB range. This issue arises after applying the fix for CVE-2026-49746, which limits the mapping range of graphics buffers and causes errors when mappings occur outside this range, impacting the kernel mode driver's functionality.
Spreadsheet::XLSX versions before 0.19 for Perl contain a vulnerability that allows arbitrary code execution. The flaw arises from the use of string eval on number format conditions in ExcelFmt during workbook parsing. An attacker can craft a malicious XLSX file with a specially formatted number condition to execute arbitrary Perl code when the file is processed.
CVE-2026-119263 is a use-after-free vulnerability in the GarbageCollection component of Google Chrome prior to version 156.0.8078.79. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by crafting a malicious HTML page. The vulnerability has a high severity rating and has been fixed in Chrome version 156.0.8078.79.
A buffer overflow vulnerability exists in the Skia component of Google Chrome prior to version 156.0.8078.79. This flaw allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted HTML page. The vulnerability has a critical severity rating with a CVSS score of 9.6.
CVE-2025-49602 is a critical vulnerability in Keyfactor EJBCA 9 where an administrator removed from their role may retain access due to insufficient session expiration. The system may cache authentication beyond the configured maximum time, allowing continued access that should have been revoked.
Authlib versions prior to 1.9.0 contain a critical signature verification bypass vulnerability in the JsonWebSignature.deserialize_json() method. This flaw allows an attacker to submit a JSON Web Signature (JWS) object with an empty 'signatures' array, which the method incorrectly accepts as valid without verifying any signature or requiring a cryptographic key. This results in an authentication bypass where attacker-controlled payloads are accepted as legitimately signed. The issue arises because the validation flag is initialized to true and only set to false inside a loop that does not execute if the signatures array is empty. This vulnerability is fixed by rejecting empty signatures arrays or properly initializing the validation flag based on the presence of signatures.
A critical buffer overflow vulnerability exists in the Brotli decoder in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows remote unauthenticated attackers to corrupt adjacent memory, potentially disclosing sensitive information, causing denial of service, or executing arbitrary code via crafted Brotli-compressed streams. Fixed versions include 1.0.10, 1.1.1, and 1.2.1.