Multiple vulnerabilities have been fixed in the FreeBSD bhyve hypervisor by the FreeBSD community. These vulnerabilities relate to issues such as heap-based buffer overflows, race conditions, and improper synchronization. No CVSS score is provided, and no specific affected versions are stated. There is no indication of known exploits in the wild.
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
A critical vulnerability in the open source RingRTC library used by Signal allowed malicious callers to prevent calls from ending properly. The flaw enabled attackers to flood the call's event queue with junk, causing the hang-up event to be delayed indefinitely and keeping audio and video tracks active even after the user hung up. This issue was fixed in RingRTC version 2.72.0. Users are advised to update Signal to the patched version to ensure calls terminate correctly.
Mattermost versions 11.7.x up to 11.7.11 contain a vulnerability where null elements are not properly validated when decoding playbook import conditions. This flaw allows an authenticated attacker to crash the Playbooks plugin instance-wide by submitting a crafted import request with a null condition. The issue results in a denial of service affecting availability but does not impact confidentiality or integrity.
Bytebase versions before 3.16.0 have an authorization bypass vulnerability in the UpdateIssueComment handler. This flaw allows users with low privileges, including Project Viewers, to modify comments in projects they do not have access to by supplying a foreign comment UID. Attackers can set their own project's issue as a parent and reference comments from other projects to overwrite them.
Bytebase versions prior to 3.16.0 have an authorization bypass vulnerability in the GetTaskRunLog, GetTaskRunSession, and PreviewTaskRunRollback functions. This flaw allows authenticated users with permission on one project to access task run data from other projects by supplying foreign task or task run UIDs. The exposed information includes execution logs, database session details, and rollback SQL statements. The vulnerability has a medium severity with a CVSS score of 4.3.
ACF Extended plugin versions up to 0.9.2.7 contain a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of affected users. The issue is rated high severity with a CVSS score of 7.1. No specific patch or remediation information is provided in the available data.
Retool versions before 3.88.0 have a cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to execute JavaScript by proxying malicious SVG files through the /api/imageProxy endpoint. The vulnerability arises because the attacker can supply an SVG hosted on an attacker-controlled server via the url parameter, which Retool serves from its own origin without a Content Security Policy. This enables script execution in the context of victims' sessions. Exploitation evidence was first observed on 2024-10-15.
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. These bugs were discovered in August 2026 and patched by PHP on October 21, 2026, with updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Exploitation attempts were detected before and after the patch release, including mass exploitation attempts shortly after fixes were published. Multiple vendors and governments have issued advisories urging immediate patching and thorough discovery of PHP installations, including those embedded in other software. Some organizations temporarily took affected sites offline to mitigate risk. Security firms have released detections and mitigations, and many vendors are reviewing their products for exposure. The vulnerabilities require precise conditions for exploitation but have been actively targeted in the wild.
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.
Security Fix(es):
* crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121)
* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple vulnerabilities have been addressed in the Cisco Expressway Series by Cisco. The specific details of these vulnerabilities, including affected versions and CVSS scores, are not provided. No known exploits are reported in the wild. The vulnerabilities cover a range of common weakness enumerations (CWEs) such as improper certificate validation, hardcoded credentials, path traversal, cross-site scripting, SQL injection, and others. Cisco is not a cloud service in this context, and no patch links or vendor advisory details are included.
Multiple vulnerabilities have been fixed in Snort 3, an open source intrusion detection and prevention system used in various Cisco products. These vulnerabilities were addressed by Cisco as reported by the Nationaal Cyber Security Centrum. No specific affected versions or detailed technical information about the vulnerabilities are provided. There is no CVSS score available for these issues, and no known exploits in the wild have been reported.
Red Hat has issued a security advisory for the grafana-pcp plugin used in Red Hat Enterprise Linux 8. This update addresses multiple vulnerabilities including denial of service issues in golang's crypto/tls and net/http packages, and a man-in-the-middle attack vector via untrusted intermediate certificates in crypto/x509. The vulnerabilities affect the handling of ECH outer extension references, excessive HTTP/2 SETTINGS frames, and certificate validation respectively. The update is rated as Important by Red Hat Product Security and is available for various Red Hat Enterprise Linux 8 architectures and extended life cycle versions.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
PHP2Shell is a critical security threat involving two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution via memory corruption and request lifecycle issues in PHP. The challenge for defenders lies in accurately identifying the PHP runtime environments serving web applications, as different builds and backported fixes may exist across containers, workers, and deployment images. Check Point has released emergency IPS protections and proactive WAF blocking to mitigate exposure, but virtual patching is only a temporary measure and does not remove vulnerable code or address existing compromises. Effective defense requires inventorying PHP runtimes, applying vendor patches, and reviewing access routes that bypass inspection. Investigations into suspicious activity should be conducted independently of patching efforts.
CVE-2026-112832 is a critical vulnerability in CozyThemes Rootblox up to version 1.0.6 that allows PHP Local File Inclusion due to improper control of filenames in include/require statements. This flaw can lead to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating a severe risk. No patch or remediation information is currently provided.
A missing authorization vulnerability exists in Cozmoslabs Paid Member Subscriptions plugin versions up to 3.1.2. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation information is provided in the available data. There are no known exploits in the wild at this time.
A SQL Injection vulnerability (CVE-2026-112822) exists in AmentoTech Workreap Core prior to version 3.4.4. This vulnerability allows an attacker with low privileges to perform blind SQL injection attacks, potentially leading to high confidentiality impact and limited availability impact. The vulnerability does not require user interaction and can be exploited remotely over the network.
Lotus versions up to 0.10.2 have an authorization bypass vulnerability in the ChangeUserOrganizationView.post endpoint. Authenticated users can supply any organization's UUID to join that organization without proper authorization. This allows attackers who self-register and know another organization's UUID to access that organization's tenant data and billing configuration.
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.