Critical severity threats

CVE-2026-115943 is a critical code execution vulnerability in Spreadsheet::XLSX for Perl versions before 0.19. It arises from unsafe use of string eval on number format conditions in ExcelFmt, allowing arbitrary Perl code execution when parsing a crafted XLSX file. The issue is fixed in version 0.19.

Red Hat Satellite 6.19 has received a critical security update addressing multiple vulnerabilities across various components including python-django, yggdrasil-worker-forwarder, openvox-server, python3.12-urllib3, python3.12-gitpython, python3.12-pillow, and others. These vulnerabilities include remote code execution, denial of service, man-in-the-middle attacks, HTTP request smuggling, access control bypass, arbitrary code execution, and information disclosure. The update is intended to mitigate these issues by patching the affected packages.

A critical buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution via a crafted Brotli-compressed stream. Users should update affected Brotli libraries or binaries to versions 1.0.10, 1.1.1, or 1.2.1 to mitigate this issue.

CVE-2026-61707 is a critical code injection vulnerability in SOCFortress CoPilot prior to version 0.1.76. It arises from the ability of low-privilege users to upload Jinja2 templates that are later executed without sandboxing by privileged users, enabling remote code execution. The vulnerability allows attackers to execute arbitrary Python code on the backend with root privileges, exposing sensitive tenant data and credentials. The issue is fixed in version 0.1.76.

Docat versions prior to 1.6.0 contain an arbitrary file upload vulnerability in the Upload API due to lack of validation on uploaded file paths and types. This flaw allows attackers to overwrite sensitive configuration files or upload malicious files to the web server. While version 1.6.0 fixes filename-based path traversal, unrestricted file type uploads and their potential malicious effects remain unmitigated. Exploitation could lead to remote code execution or cross-site scripting depending on deployment context.

ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system, potentially enabling further unintended access. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

OpenBMB XAgent version 1.0.0 contains a directory traversal vulnerability in the main-upload_file function located in ToolServer/ToolServerNode/main.py at line 46. This vulnerability could allow an attacker to access files outside the intended directory structure.

DB-GPT versions 0.7.5 and 0.8.0 contain a directory traversal vulnerability in the use_example_file function. This flaw allows a remote attacker to write files outside the intended workspace or storage boundary by exploiting the path validation. No patch or remediation information is provided.

A vulnerability in OpenTracks versionCode 6751's io.file.importer.ImportActivity component allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message.

A vulnerability in AndBible versionCode 1111 allows attackers to execute arbitrary code by uploading a specially crafted module zip file. This could enable unauthorized code execution within the affected application.

A vulnerability in Shelter versionCode 445 allows attackers to register their own authentication key, enabling them to take over another user's binder service API and preference state. This issue could lead to unauthorized control over user-specific services within the affected application.

An insecure permissions vulnerability in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

An insecure permissions vulnerability in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside the app's sandbox.

A vulnerability in libretro RetroArch version 1.22.2 allows an attacker to force another user to load attacker-supplied code under their user ID, resulting in arbitrary code execution.

A vulnerability exists in the WebView rendering path component of MotionCreative Motion UI versionCode 101 that allows attackers to execute arbitrary code by sending a crafted POST request.

IBM Langflow OSS versions 1.0.0 through 1.12.8 contain a vulnerability that allows a remote attacker to bypass security restrictions due to improper authentication. This flaw could lead to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is rated critical with a CVSS score of 9.8.

Citrine v3.1.0 (versionCode 62) contains insecure permissions in its CitrineContentProvider component, which allows unauthorized attackers to read another user's Nostr event database.

Code Catcher versionCode 131 contains insecure permissions that allow unauthorized attackers to manipulate the app's SMS-code-capture mechanism.

An OS command injection vulnerability exists in Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker with limited privileges to execute arbitrary commands, potentially leading to full system compromise. The vulnerability is rated critical with a CVSS score of 9.9.