The twofactor_gauthenticator plugin for Roundcube has a vulnerability that allows bypassing two-factor authentication (2FA) by spoofing client address headers. An attacker who has obtained a user's password can spoof whitelisted IP addresses via the Client-IP and X-Forwarded-For headers, bypassing the second authentication factor. This issue has been fixed in commit 4640889.
A heap-based buffer overflow vulnerability exists in JP1/Automatic Job Management System 3 affecting both Manager and Agent components from version 11-00 up to but not including 13-50-31. The vulnerability has a critical severity with a CVSS score of 9.4, indicating it can be exploited remotely without privileges or user interaction, potentially leading to high confidentiality and integrity impact and low availability impact.
Docker Desktop versions from 4.39.0 up to but not including 4.97.0 could log third-party API keys and OAuth access tokens in cleartext within local application logs and diagnostic bundles due to insufficient inter-process communication payload redaction. This exposure allows an attacker with read access to these files to obtain sensitive credentials. Versions 4.94.0 and 4.95.0 partially addressed the issue by fixing known logging paths, but residual logs containing credentials may persist after upgrading. The issue is fully resolved in Docker Desktop 4.97.0, which also cleans up existing host logs and crash dumps containing sensitive data.
CVE-2026-107590 is an out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding within the Qt 5 Compatibility APIs module. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer, potentially causing application crashes and affecting data integrity. The vulnerability affects Qt versions from 4.5.0 up to and including 6.8.8, and from 6.9.0 up to and including 6.11.2. The CVSS 4.0 base score is 1.9, indicating low severity. No public exploits or patches are currently documented.
NVIDIA PhysX contains an out-of-bounds write vulnerability that could allow an attacker to execute code, tamper with data, cause denial of service, or disclose information. This vulnerability affects all platforms running PhysX. The flaw is identified as CWE-787 and has a high severity score of 7.8. No specific affected versions or patches are currently detailed.
CVE-2026-65145 is a critical vulnerability in the NVIDIA NeMo Agent Toolkit involving missing authentication for a critical function. This flaw allows an attacker to perform unauthorized actions without authentication, potentially leading to code execution, privilege escalation, data tampering, denial of service, and information disclosure.
CVE-2026-65151 is a high-severity SQL injection vulnerability in the NVIDIA NeMo Agent Toolkit. Exploitation could allow an attacker to tamper with data, cause denial of service, or disclose sensitive information. No affected versions or patch information are provided.
NVIDIA TensorRT-LLM version 1.3.0rc24 contains a server-side request forgery (SSRF) vulnerability. This flaw could allow an attacker to induce the server to make unauthorized requests, potentially leading to information disclosure. The vulnerability has a high severity rating with a CVSS score of 7.1. There is no indication of known exploits in the wild or available patches at this time.
CVE-2026-24269 is a server-side request forgery (SSRF) vulnerability in NVIDIA TensorRT-LLM version 1.3.0rc24. Exploitation could allow an attacker to cause unauthorized requests from the server, potentially leading to information disclosure and data tampering. The vulnerability has a high severity score of 7.1 CVSS v3.1. No public exploits or patches are currently documented.
CVE-2026-65119 is a high-severity vulnerability in NVIDIA TensorRT-LLM version 1.3.0rc24 affecting the KvCacheAwareRouter tokenizer loading. It allows an attacker to cause inclusion of functionality from an untrusted control sphere, potentially leading to code execution, information disclosure, data tampering, and denial of service.
Two critical use-after-free vulnerabilities in the PHP engine's session.upload_progress feature allow unauthenticated remote code execution by bypassing WAFs during multipart request parsing. Exploit code rapidly spread after the October 21, 2026 patch release, with UNC actors targeting over 70% of unpatched PHP infrastructure globally. Exploitation campaigns include mass scanning, Mirai botnet C2 infrastructure, and session poisoning via WordPress LFI vulnerabilities, affecting public, business, and educational sectors worldwide.
A security update for the Podman container management tool has been released by the SUSE Product Security Team. The update involves rebuilding Podman against the current Go language security release to address potential vulnerabilities.
CVE-2026-100164 is an observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd.'s Agentis product. This flaw allows attackers to perform account footprinting by observing differences in system responses. The vulnerability affects Agentis versions prior to 4.8. A fix is available in version 4.8. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.
CVE-2026-106087 is a high-severity vulnerability in Hitachi Energy TRO600 Series Firmware versions 9.0.0.0 through 9.1.1.0. It allows an unauthenticated attacker to read or download arbitrary files from the device, including sensitive configuration and password files, due to missing authentication on a critical function.
The Hitachi Energy TRO600 Series Firmware versions 9.0.0.0 through 9.2.1.6 contain a vulnerability that allows an authenticated attacker to bypass network access restrictions. This flaw enables attackers to access services intended only for localhost by leveraging port forwarding, potentially exposing sensitive functionality and confidential information and impacting availability.
Eclipse KeyPont versions 2.0.0-rc3 through 2.0.0-rc8 contain a vulnerability in ML-KEM key-pair lookup functions where the public key is not verified against the private key. This allows an attacker with unauthenticated token access to substitute a public key and receive shared secrets intended for the legitimate private key owner, compromising confidentiality. The issue does not affect v1 module paths which lack ML-KEM support.
CVE-2026-13162 is an OS command injection vulnerability in Hitachi Energy's CoreTec 5 product. It affects the configuration daemon's time synchronization handler, which sets the system time-zone. Authenticated users with certain roles can exploit this flaw by supplying crafted input that is concatenated into shell commands without sanitization, allowing arbitrary system command execution with full device control. The vulnerability affects versions from 3.0.0 through 5.0.0 inclusive. The CVSS 4.0 score is 7.7, indicating high severity.
Apple released updates for iOS and macOS 27.2 addressing 286 vulnerabilities, including memory corruption bugs, privilege escalation flaws, sandbox escapes, and remote code execution issues. A critical zero-day vulnerability in CoreGraphics, exploited in the wild, was backported and fixed in iOS 18.7.11. The updates also patch numerous security holes in components such as WebKit, kernel, image handling, and network services. Additional patches were released for other Apple operating systems and software.
CVE-2026-113644 is an OS command injection vulnerability in Eclipse ioFog's iofogctl CLI tool versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1. The vulnerability arises because the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands executed locally and over SSH on remote agent hosts. An attacker who can modify the API response can inject shell metacharacters, causing arbitrary commands to run on the agent host during deployment or attachment. This issue is fixed in version 3.9.2.
CVE-2026-90728 is an improper privilege management vulnerability in Dell PowerProtect Data Domain affecting multiple feature release and LTS versions. A local attacker with high privileges could exploit this flaw to elevate their privileges further. The vulnerability is rated medium severity with a CVSS score of 6.3. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 depending on the release branch.