Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`.
CVE-2026-95316 is a low severity vulnerability in Google Chrome's Performance component prior to version 154.0.8037.57. It involves an unchecked return value that could allow a local attacker to potentially read memory via a local program. The vulnerability has a CVSS score of 2.9, indicating low impact. No known exploits are reported in the wild. The issue is fixed in Chrome version 154.0.8037.57.
CVE-2026-102759 is a medium severity vulnerability in Eclipse Foundation's NetX Duo where the NetX Secure TLS component improperly validates the integrity check value. Specifically, it accepts an empty TLS application-data record without verifying its message authentication code (MAC), treating such records as valid and advancing the receive sequence number without MAC comparison. Empty TLS application-data records are legal and commonly used in TLS 1.0 as a mitigation against the BEAST attack.
PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight controller.
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. `readUint8Array` never compares the wire-supplied length against the decoder's own view, so one over-long length prefix returns whatever the host process allocated next: other tenants' document content, personal data, and live bearer session tokens**, recovered in full and at will. An attacker who can supply bytes to a lib0 decoder which means any peer that can open a socket, including before authentication reads adjacent process memory and, where the consumer echoes, stores or re-serves the decoded value, receives it back. This is patched in version 0.2.118 and 1.0.0-rc.33.
A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.
Executive Threat Detection (ETD) is a proactive cybersecurity service launched by Cisco Talos Incident Response to protect high-value executive accounts from sophisticated, targeted attacks. It provides monthly human-led threat hunting and intelligence analysis focused on executives' corporate systems, addressing the gap left by enterprise-wide security tools tuned for average users. The service integrates open-source intelligence (OSINT) to identify emerging threats such as phishing kits and zero-day exploits targeting executives. ETD hunts for subtle, low-and-slow attack techniques and monitors corporate information for signs of compromise. It operates with minimal impact on executive productivity by leveraging existing security tools without requiring system changes. Monthly reports provide technical findings and strategic recommendations, enabling informed leadership decisions. ETD is designed to complement existing Talos IR retainer services, allowing rapid escalation to emergency response if needed.
The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a lower-trust role than the Dag author, and one that needs no Teradata credentials of its own - could therefore supply SQL fragments that execute under the connection the task runs as, and could additionally redirect the task at any other connection defined in the deployment, because the connection id was itself a free-text Param. Only deployments that run this example Dag, or a Dag copied from it, are affected; the provider's operator code is unchanged. Users of apache-airflow-providers-teradata are recommended to upgrade to version 3.7.0 or later, whose example constrains the Params to validated identifiers and a closed value set and removes connection selection and free-form option strings from trigger-time input. Upgrading does not change a Dag already copied from the example; users who copied it should apply the same constraints to their copy.
Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.snowflakecomputing.com/api/v2/statements`, so an `account` value containing `/`, `?` or `#` demotes the intended domain to a path, query or fragment and leaves the attacker in control of the request host.
The provider sends that request with an `Authorization: Bearer` header carrying a JWT minted from the connection's private key, or the configured OAuth or programmatic access token. A user who can edit the Snowflake connection but cannot read its secrets — Airflow gives connection-configuration users write-only access to stored credentials, and a `private_key_file` lives on the worker rather than in the connection — can therefore cause a valid token for the account to be delivered to a host of their choosing and replay it against the genuine Snowflake endpoint. No Dag-authoring ability is required: the attacker edits the connection and waits for an existing Dag to use it. The same unvalidated value was also used to build the OAuth token-request URL and the Cortex Agent base URL.
Affects deployments where Snowflake connections are editable by users who are not trusted with the connection's credentials. Users are advised to upgrade to `apache-airflow-providers-snowflake` `6.18.0` or later, which rejects `account` and `region` values containing anything other than letters, digits, `.`, `_` and `-` in every URL the provider builds from them.
Nodemailer versions from 5.0.0 up to 10.0.1 have a vulnerability in their process-global DNS cache that causes TLS server name indication (SNI) to be reused incorrectly across SMTP transports. This flaw allows one tenant in a multi-tenant environment to cause another tenant's SMTP transport to use the attacker's TLS server name and certificate, leading to potential SMTP credential disclosure. The issue arises because the DNS cache key is only the host, but the cached value includes the TLS server name, which is overwritten and reused improperly. No official patch was available at the time of this report.
PyJWT versions from 2.13.0 until 2.14.0 contain a vulnerability in the HMACAlgorithm.from_jwk function where the verification path uses a decoded key without proper prepare_key validation. This flaw allows an attacker to exploit a trusted JWK Set containing an oct entry with an empty key value, enabling the signing of HMAC tokens with a zero-length key that PyJWT accepts. As a result, attackers can forge tokens with arbitrary authenticated claims. The issue is fixed in PyJWT version 2.14.0.
CVE-2026-18416 is a low-severity vulnerability in the Zephyr project CoAP server subsystem. It involves a bounds over-read in the match_path_uri() function when comparing a registered resource path against a URI in a Uri-Query href= option. The flaw causes reading past the end of the option value buffer, leading to undefined behavior but no information disclosure or matching errors. The issue affects Zephyr versions from 1.8.0 up to but not including 4.3.2, and from 4.4.0 up to but not including 4.4.2. Fixed versions are 4.3.2 and 4.4.2.
Axios versions from 0.27.2 until 0.34.0 and 1.20.0 have a vulnerability where default-instance requests that omit an explicit HTTP method can inherit a method value from Object.prototype. This can cause requests such as axios.request({ url }) to send unintended state-changing HTTP methods if Object.prototype.method is polluted by another vulnerability. The issue is fixed in versions 0.34.0 and 1.20.0.
Axios versions from 1.15.2 up to but not including 1.20.0 have a vulnerability in the Node HTTP adapter where request options lack a dedicated createConnection property. This allows an attacker to exploit a prototype pollution flaw by placing a malicious createConnection function on Object.prototype. The attacker-controlled function can intercept and manipulate HTTP request headers and bodies, including credentials, while the URL appears legitimate. The issue is resolved in version 1.20.0.
CVE-2026-88816 is a high-severity vulnerability in Perl's DBI module versions before 1.654. It involves a type confusion issue where numeric values are incorrectly treated as strings in the FetchHashKeyName attribute. This leads to a segmentation fault when fetchrow_hashref attempts to use an invalid pointer as a hash key name. The flaw can be triggered by setting FetchHashKeyName to a numeric value such as an integer or floating-point number.
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was mis-structured in terms of mixing code running with higher privileges (single-use token generated with write permissions) and untrusted inputs (PR source branch). A malicious PR run from a fork could extract the GITHUB_TOKEN value. It could potentially be abused while it was valid (while the GHA job ran) to manipulate Git repository contents, commit checks/statuses, or issue/PR comments, according to permissions it was issued with. This issue has been patched via commits 658b24e and 1aa31d1.
CVE-2026-88815 is a type confusion vulnerability in Perl's DBI module versions before 1.654. It occurs when numeric values are incorrectly treated as strings during SQL type casting, leading to a segmentation fault. This flaw arises because the function sql_type_cast_svpv passes a string pointer without proper stringification, causing invalid memory access. The vulnerability can be triggered by calling sql_type_cast with a numeric value and SQL_NUMERIC type.
Operation Master is a sophisticated cybercrime campaign exploiting a GlobalProtect authentication bypass vulnerability (CVE-2026-0257) to compromise enterprise networks across multiple countries. The attackers conducted extensive network scanning to identify high-value targets, executed SQL injection attacks with privilege escalation to steal databases, and exfiltrated Active Directory credentials. They monetized stolen data by selling it on underground forums and operating a multi-tenant automated invoice fraud platform that sent millions of phishing messages and fraudulent links. The operation employed advanced phishing techniques including M365 OAuth device-code phishing and voice-based credential harvesting, with payments collected via PIX through serverless proxies.
