A vulnerability in the Linux kernel for the parisc architecture has been addressed by increasing the kernel stack size to 32 KB for 64-bit kernels. This change prevents kernel crashes caused by stack overflows, which were observed during specific workloads such as building the Debian vtk9 package with gcc 17. The issue manifested as kernel panics triggered by low stack detection in interrupt handlers.
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry.
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.
AWS Threat Intelligence detected exploitation attempts of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) starting on October 17, 2026, four days before the public disclosure and patch release on October 21, 2026. Multiple actors used anonymized infrastructure to target honeypots and real systems, with proof-of-concept exploits appearing immediately after the embargo lifted. Fixed PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address these vulnerabilities, with backports available for versions 7.4 through 8.1. The event highlights the shrinking window between patch release and exploitation and the need for proactive detection and investigation starting before public disclosure.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Amazon Threat Intelligence detected exploitation attempts of the PHP2Shell vulnerability in MadPot honeypot telemetry on October 17, 2026, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619. The initial exploit originated from a commercial anonymization network, indicating threat actor activity during the embargo period. Multiple proof-of-concept exploits appeared on the disclosure date with diverse payloads and infrastructure, suggesting involvement of multiple actors. After the embargo lifted on October 21, 2026, exploitation rapidly became widespread. This incident demonstrates that coordinated vulnerability disclosure does not guarantee zero-day protection and that AI-assisted exploit development has significantly reduced the time from patch release to active exploitation.
CVE-2026-114699 is a missing authorization vulnerability in the yoomoney ЮKassa plugin for WooCommerce. It affects versions from 0 up to and including 2.17.3. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality. The vulnerability has a medium severity rating with a CVSS score of 5.3. No public exploits or known active exploitation have been reported. No patch or remediation information is currently provided.
A critical security update has been released for Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17. This update addresses multiple vulnerabilities identified by several CVEs, including CVE-2024-38827 and numerous others. Users of Openshift Jenkins 4.17 are recommended to upgrade to the latest version to mitigate these security issues. No detailed technical information or specific vulnerability descriptions are provided in the advisory.
CVE-2026-112867 is a stored cross-site scripting (XSS) vulnerability in H5P versions prior to 1.17.10. It allows improper neutralization of input during web page generation, potentially leading to script injection. The issue affects H5P versions from 0 up to 1.17.9 and has been fixed in version 1.17.10.
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
CVE-2026-14288 is a vulnerability in GitLab Enterprise Edition affecting versions from 17.4 up to but not including 19.3.6, 19.4 up to but not including 19.4.3, and 19.5 up to but not including 19.5.1. It allows an authenticated user to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
A vulnerability in GitLab CE/EE versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 allowed an unauthenticated user to retrieve sensitive internal server credentials due to improper filtering of internal response headers. This issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-112378 is a vulnerability in GitLab EE versions from 17.8 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1. It involves insufficient server-side validation in billing eligibility checks, which could allow an authenticated user to access paid AI features without a valid subscription. GitLab has fixed this issue in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-112326 is a vulnerability in GitLab EE versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. It involves improper cleanup on thrown exceptions that could allow an authenticated user with read-only permissions to permanently delete existing vulnerability records. This occurs due to flawed error handling logic that fails to differentiate between pre-existing and newly created records. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.