Authlib versions up to 1.7.2 accept an empty HMAC key for JWS/JWT HS256/HS384/HS512 signature verification, allowing attackers to forge tokens with arbitrary claims. The empty key produces a deterministic digest that anyone can reproduce, bypassing signature verification. This vulnerability affects OAuth 2.0 resource servers and OIDC relying parties using Authlib if the verification key can be empty at runtime. The issue is fixed in Authlib 1.9.1.
A vulnerability in rustls versions 0.23.44, 0.23.45, and certain 0.24.0-dev releases causes buffered application data to be sent to the server before the client sends the mandatory 'ech_required' alert when Encrypted Client Hello (ECH) is rejected. This violates RFC 9849 requirements that no application data be sent before the alert. The issue affects clients using EchMode::Enable that send application data before handshake completion and connect to servers rejecting their ECH config. The flaw was fixed in rustls 0.23.46 and 0.24.0-dev.2.
A vulnerability in rustls allows a network attacker to poison the client's per-server-name key-exchange record by sending an unauthenticated ServerHello selecting the X25519 group. This causes subsequent ClientHellos for that server name to carry only an X25519 share, potentially leading the handshake to complete with classical key exchange only, losing quantum-resistant confidentiality. No authentication bypass or key compromise occurs. The issue is fixed in rustls versions 0.23.46 and 0.24.0-dev.2.
A vulnerability in rustls versions prior to 0.23.46 and between 0.24.0-dev.1 and 0.24.0-dev.2 allows the TLS master secret or TLS 1.3 resumption PSK to be exposed when formatting a client session value with the Debug trait. This can lead to leakage of sensitive key material if a custom ClientSessionStore logs these debug outputs. Built-in diagnostics do not expose these secrets, and the session-store interface warns about the sensitivity of these values.
Rustls contains a vulnerability in its Brotli certificate decompression feature, which is disabled by default. The Brotli decoder accepts an input-specified history window size that can be up to 1 GiB, potentially causing large memory allocations. This can lead to denial of service via memory exhaustion if a malicious peer sends specially crafted Brotli-encoded certificates. Both clients and servers enabling Brotli decompression and client authentication are affected. The issue is fixed in rustls versions 0.23.46 and 0.24.0-dev.2.
A Brazilian Magecart group exploited a critical vulnerability (CVE-2026-8467) in Plausible Community Edition versions 3.0.0 through 3.2.0 to inject a card skimmer into the Plausible analytics script used by the Brazilian ecommerce platform Convertr. From October 24 to October 27, 2026, the malicious script stole payment card details, CVV, expiry dates, cardholder names, and CPF taxpayer numbers from shoppers during checkout. The stolen data was exfiltrated to the domain 1x0.is. Convertr removed the skimmer and patched the vulnerability on October 27. This Magecart group has targeted multiple Brazilian ecommerce platforms since 2024 using distinctive data exfiltration techniques.
Attackers compromised camera management software (CMS.exe) to gain initial access to multiple organizations. They deployed malware (rs.win32.exe) into user AppData directories and used DLL sideloading with the legitimate Windows binary WpcMon.exe and malicious DLLs to establish beaconing to a command-and-control server. Persistence was maintained via Run Key registry modifications. The affected camera management software, possibly linked to 3R Global and kvision.ai, lacked sufficient security controls and logging. Organizations are advised to treat camera systems and their management platforms as critical attack surfaces and implement access controls and monitoring to detect unusual activity.
CVE-2026-113775 is a high-severity vulnerability in Autodesk Fusion desktop application where a malicious dynamic library loaded via the TextCommands.LoadDll API command can lead to arbitrary code execution. The flaw is due to an exposed dangerous function that allows code execution in the context of the current process. Versions from 2705.1.30 up to but not including 2706.1.14 are affected. A fix is available in version 2706.1.14.
CVE-2026-109089 is a heap-based buffer overflow vulnerability in the X.Org libXi library versions before 1.8.4. The flaw occurs when handling the DEVICE_RESOLUTION property, which can be exploited by a malicious X server to overflow the heap. This vulnerability has a high severity rating and has been fixed in version 1.8.4.
CVE-2026-102638 is a stored cross-site scripting (XSS) vulnerability in Autodesk Fusion desktop application. It occurs when a malicious HTML payload is embedded in the description of an electronic library (.lbr) file and displayed in the Library Manager after import. Exploitation can allow an attacker to read local files or execute arbitrary code within the context of the current process. The vulnerability affects versions from 2705.1.30 up to but not including 2706.1.14 and has been assigned a high severity score of 7.1. A fix is available in version 2706.1.14.
CVE-2026-102637 is a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. It occurs via a malicious HTML payload in the documentName parameter of a Fusion protocol URL. When a user invokes such a URL, the vulnerability can be triggered, potentially allowing an attacker to read local files or execute arbitrary code within the application's process context. The flaw affects versions from 2705.1.30 up to but not including 2706.1.14. A fix is available starting with version 2706.1.14.
CVE-2026-102636 is a stored Cross-site Scripting (XSS) vulnerability in Autodesk Fusion desktop application. It occurs when a malicious HTML payload is embedded in a design name and executed when another user opens the manipulated design. This vulnerability allows an attacker to read local files or execute arbitrary code within the context of the current process.
CVE-2026-107672 is a command injection vulnerability in Autodesk Fusion Post Processor Utility versions 5.0.1 up to but not including 5.0.2. It arises from a trusted Markdown injection triggered by a maliciously crafted .stack.json file, allowing an attacker to execute arbitrary commands with the current user's privileges. The vulnerability has a high severity with a CVSS score of 8.8. A fix is available in version 5.0.2.
CVE-2026-117511 is an OS command injection vulnerability in the desmondmorris node-tesseract library versions 0.2.0 through 0.2.7. The flaw exists in the process function of the lib/tesseract.js file within the Command Builder component, where manipulation of the image argument can lead to remote command injection. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). Public exploit code has been disclosed, but no official patch or vendor response is currently available.
CVE-2026-116863 is a critical Cross-Site Request Forgery (CSRF) vulnerability affecting Tribulant Software's Newsletters plugin (versions up to 4.18.2). This flaw allows attackers to perform unauthorized actions on behalf of authenticated users. The vulnerability impacts confidentiality, integrity, and availability of the affected system.
CVE-2026-115495 is a vulnerability in the WatchGuard Mobile VPN with SSL client for Windows that allows a local attacker who can capture loopback network traffic to obtain the user's VPN username and password due to cleartext transmission of sensitive information. This issue affects versions from 12.0 up to but not including 2026.4. A fix is available in version 2026.4. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.7.
CVE-2026-90465 is an authentication bypass vulnerability in WatchGuard Fireware OS affecting the FireCluster Sync processing. An attacker on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, can send specially crafted requests to perform privileged firewall management actions as root. The vulnerability affects multiple version ranges of Fireware OS and has been assigned a high severity score. Fixed versions are available.
CVE-2026-93862 is an out-of-bounds read vulnerability in WatchGuard Fireware OS affecting the FireCluster Sync processing. An attacker on the cluster interconnect can send crafted network traffic to repeatedly crash the cluster synchronization process, causing a sustained denial of service. The vulnerability affects multiple version ranges of Fireware OS and has been assigned a high severity rating with a CVSS score of 7.2. Fixed versions are available.
CVE-2026-112709 is a critical heap-based buffer overflow vulnerability in the WatchGuard Fireware OS authentication service. It affects versions 2025.1 up to but not including 2026.4, 12.0 up to but not including 12.12.4, and 12.0 up to but not including 12.5.22. An attacker who can control or intercept traffic to the configured Active Directory server can exploit this flaw by returning a specially crafted response, potentially causing denial of service or arbitrary code execution. The vulnerability has a CVSS 4.0 score of 9.2, indicating high impact on confidentiality, integrity, and availability. Fixed versions are available starting from 2026.4, 12.12.4, and 12.5.22 respectively.
CVE-2026-90464 is a high-severity vulnerability in WatchGuard Fireware OS that allows a remote, authenticated attacker with read-only Device Monitor privileges and CLI access to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges via a specially crafted diagnostic command. The vulnerability involves external control of file paths in a firewall diagnostic command. The issue is fixed in Fireware OS versions 2026.4, 12.12.4, and 12.5.22.
