A vulnerability in AIOHTTP's Max-Age processing can cause an overflow that prevents connections from closing properly. This may allow an attacker to temporarily exhaust the connection pool until garbage collection reclaims the connections. The issue affects ScoutSuite versions from 5.14.0_13 up to but not including 5.14.0_18. A fix is available in version 5.14.0_18.
Scoutsuite versions from 5.14.0_13 up to but not including 5.14.0_18 have a vulnerability where the aiohttp server does not enforce an initial request/header timeout. This allows an attacker to keep an idle connection open indefinitely before sending any data, potentially leading to resource exhaustion. A fix is available in version 5.14.0_18. The recommended mitigation is to use a reverse proxy with sensible keepalive limits, which is advised for all production deployments.
A vulnerability in scoutsuite versions >=5.14.0_13 and <5.14.0_18 allows the Secure attribute of shared cookies to not be enforced. This means a cookie marked as Secure could be sent over unencrypted requests, potentially exposing sensitive cookie data.
NLnet Labs Unbound up to and including version 1.26.1 contains a vulnerability identified as CVE-2026-109125. The vulnerability has a medium severity with a CVSS score of 5.3. It involves an observable issue that impacts the integrity of the system but does not affect confidentiality or availability. The affected versions include multiple specific builds primarily related to Ubuntu distributions. No public exploit code or known exploitation in the wild has been reported.
NLnet Labs Unbound versions from 1.22.0 up to and including 1.26.1 contain a vulnerability identified as CVE-2026-97206. This vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, and affects multiple Ubuntu package versions. The flaw does not impact confidentiality or integrity but results in a high impact on availability.
CVE-2026-96405 is a medium severity vulnerability affecting NLnet Labs Unbound versions up to and including 1.26.1. The vulnerability relates to limitations in compression handling, causing an availability impact without compromising confidentiality or integrity. No known exploits are reported in the wild. The affected versions include specific Ubuntu package versions of Unbound. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a moderate risk primarily due to potential denial of service.
A vulnerability exists in NLnet Labs Unbound up to and including version 1.26.1, affecting specific Ubuntu package versions. The flaw has a CVSS 3.1 base score of 6.5, indicating medium severity. It does not impact confidentiality but can cause integrity loss and high availability impact. No public exploits or known active exploitation are reported. The exact technical details of the vulnerability are not provided in the available data.
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
CVE-2026-70386 is a high-severity OS command injection vulnerability in OnePlus OxygenOS affecting versions from 15.0.0 before 15.0.0.2000 and from 16.0.0 before 16.0.5.1200. It allows any locally installed Android app, without declared permissions or user interaction beyond launch, to execute arbitrary shell commands as root in a specific SELinux domain. The flaw arises from an unauthorized binder interface accepting event data that is unsafely passed to a system command, leading to privilege escalation.
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.
This security update for Mozilla Firefox Extended Support Release 153.5.0 ESR addresses multiple vulnerabilities across various components including privilege escalation, sandbox escapes, use-after-free bugs, incorrect boundary conditions, information disclosure, mitigation bypasses, race conditions, integer overflows, spoofing, and denial-of-service issues. Additionally, a use-after-free vulnerability in libexpat is fixed. These issues collectively affect core browser functionality such as networking, graphics, JavaScript engine, DOM, storage, and security sandboxing.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.
Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclosed? On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr , the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo. A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. — The PHP Foundation (@ThePHPF) October 20, 2026 What are CVE-2026-109618 and CVE-2026-109619? CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release. CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory. Which PHP versions are affected? CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions: Affected Versions Fixed Version (expected) PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 PHP 5.x through 8.1.x End-of-life, no fix expected Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories. How widespread is PHP, and how many hosts are potentially affected? According to W3Techs , PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Has exploitation been observed in the wild? On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its miti…
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as pricing, commission, stock, SKU and tax internals, including unpublished products.
The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.
FreeRDP versions before 3.32.0 contain a null-pointer dereference vulnerability that can cause a denial of service. The flaw affects multiple Ubuntu package versions of FreeRDP. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with no confidentiality or integrity impact but potential availability impact.
FreeRDP versions before 3.32.1 contain a heap out-of-bounds read vulnerability that can lead to information disclosure. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity. It affects multiple specific Ubuntu package versions of FreeRDP. No public exploits or known active exploitation have been reported.