Formwork versions prior to 2.3.13 contain a path traversal vulnerability in the BackupController. Authenticated users with backup download or delete permissions can exploit this flaw by supplying a specially crafted base64-encoded traversal payload. This payload bypasses PHP basename on Linux systems, allowing access to files outside the intended backup directory. The vulnerability enables reading or deleting arbitrary files on the server.
Kentico Xperience 13 versions prior to 13.0.216 have a vulnerability due to missing object-level authorization checks on administration API endpoints. This flaw allows users with limited privileges to perform direct requests that bypass intended access controls. The vulnerability is classified as CWE-425 (Direct Request or Forced Browsing).
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile direct dependency or a package introduced through a trusted package's packageGroup can supply .. segments or an absolute path, causing nx migrate to join an escaping destination onto its temporary directory. The migration archive can then write attacker-controlled bytes outside the temporary directory, while opening the destination stream can truncate an existing writable file even when no archive entry matches. This occurs during migration planning before review of the migration list or use of --run-migrations; the vulnerable installed Nx copy is reached when the normal nx@latest handoff is bypassed with NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION, --run-id, or fallback after a temporary-install failure. This issue is fixed in versions 22.7.10 and 23.2.1.
A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast_setting_internet_set of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Microsoft's official X (formerly Twitter) account, with over 13 million followers, was hijacked by attackers who used it to promote a Clippy-themed cryptocurrency scam. The attackers replaced the profile picture with a Clippy image and posted messages endorsing a fraudulent $Clippy token. Microsoft confirmed unauthorized access, removed the malicious posts, secured the account, and is investigating the incident. The exact method of compromise remains undisclosed, with possible attack vectors including phishing, SIM swapping, malware, or third-party tool compromise.
This update includes the following RPMs:
grafana13.2:
* grafana13.2-13.2.1-0.9.hum1 (aarch64, x86_64)
* grafana13.2-13.2.1-0.9.hum1.src (src)
Security Fix(es):
grafana13.2:
* CVE-2026-101903
On Thursday, unknown attackers hijacked the official Microsoft account on X, which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto token. [...]
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw in all versions up to and including 4.13.0. This vulnerability allows unauthenticated attackers with only a Facebook account to inject malicious scripts via Facebook comment messages, which execute when an administrator views the feed builder preview page. The vulnerability is worsened by the use of v-show instead of v-if, causing injected HTML to be evaluated even if not visible. Additionally, the lack of URL validation in an AJAX handler can enable arbitrary plugin installation, potentially leading to server-side code execution.
CVE-2026-102772 is a stored cross-site scripting (XSS) vulnerability in the CMB2 WordPress plugin affecting all versions up to and including 2.13.1. It arises from insufficient input sanitization and output escaping of the 'textarea_code' field parameters. Unauthenticated attackers can inject arbitrary scripts that execute when users access the affected pages. The vulnerability is easily exploitable because the front-end save path requires only a CMB2 box nonce, which is publicly accessible via a simple GET request, allowing attacks without credentials on sites exposing a public CMB2 form with a textarea_code field.
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an integrating plugin or theme registers a file_list field on a publicly accessible front-end form or a user meta box, as CMB2 is a developer library and does not expose these fields by default.
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This requires a site administrator to have configured an element block's Custom JS field to include a {{GET:...}} placeholder and for that JS to contain the token 'import', which routes the substituted value to the unescaped raw echo branch inside a <script type="module"> tag.
In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, which took the PBKDF2 iteration count and derived-key length straight out of PBMAC1Params (JcePBMac1CalculatorBuilder, and PKCS12PBEUtils.createPBMac1Calculator reached from PKCS12PfxPdu.isMacValid); the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost guards, which bounded only the cost parameter N and the block size r even though the scratch buffer scales with r times p, so the configured memory ceiling could be evaded entirely; the raw JCA PBKDF2 provider (org.bouncycastle.jcajce.provider.symmetric.PBEPBKDF2); and the bcrypt round count read from an encrypted OpenSSH v1 private key's own kdfoptions. Each now bounds the parameter before deriving, in line with the caps already applied elsewhere in the tree, with the OpenSSH round count configurable through the new org.bouncycastle.openssh.max_rounds property. This completes the bounding begun in 1.85 for the PKCS#8 / PBES2 decryptors (CVE-2026-15055). This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
Mooncake versions up to 0.3.13.post1 have a missing authentication vulnerability in the HTTP metadata server's /metadata handler. This flaw allows unauthenticated attackers to read, overwrite, and delete critical transfer engine metadata keys. Exploitation can lead to poisoning of segment descriptors or redirection of KV cache transfers to attacker-controlled listeners, as well as potential server memory exhaustion.
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.
CVE-2026-103761 is a high-severity memory exhaustion vulnerability in the kvcache-ai Mooncake transfer engine version 0.3.13.post1 and earlier. It allows unauthenticated attackers to send large notify frames repeatedly to the handshake RPC port, causing unbounded memory growth and potential process termination by the out-of-memory killer.
Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single listener thread in writeFully(), breaking all subsequent handshakes, metadata fetches, notify and probe requests.
FilamentPHP versions from 4.0.0 up to but not including 4.13.3 and from 5.0.0 up to but not including 5.8.3 contain a vulnerability where app-based multi-factor authentication (MFA) management actions do not consistently require confirmation of the current password. This allows an attacker with access to an authenticated user session to modify app-based MFA settings or obtain recovery codes without knowing the account password. Email-based MFA is not affected, and the vulnerability does not allow unauthenticated sign-in. The issue is fixed in versions 4.13.3 and 5.8.3.