CVE-2026-104066 is a heap buffer overflow vulnerability in Scribus versions before 1.6.7. It occurs in the Mac PICT image loader and import plugin when processing crafted 4-bit indexed pixel data with inconsistent width and row data. Exploitation can cause application crashes or potentially allow code execution.
Scribus versions before 1.6.7 have an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin. This flaw arises from using an unvalidated y offset to select image scanlines when importing crafted DRW files. Exploitation can lead to heap corruption, causing application crashes or potential code execution.
Scribus versions before 1.6.7 have an integer overflow vulnerability in the TIFF loader component. This flaw allows attackers to craft TIFF files with large tile dimensions that trigger a heap overflow when imported, potentially leading to application crashes or arbitrary code execution.
CVE-2026-104063 is an out-of-bounds read vulnerability in Scribus versions before 1.6.7. It affects the Mac PICT image loader and import plugin when decoding planar pixel data. A crafted PICT file with manipulated dimensions can cause heap over-reads, potentially leading to application crashes or disclosure of heap memory.
CVE-2026-104062 is a heap buffer overflow vulnerability in Scribus versions before 1.6.7. It occurs in the PICT image loader and import plugin when processing a crafted PICT file with an unchecked bytesPerLine value exceeding the QImage scanline size. This can cause Scribus to crash and potentially allow code execution with the user's privileges.
CVE-2026-104061 is a heap out-of-bounds write vulnerability in Scribus versions before 1.6.7. It occurs in the scimgdataloader_psd loader due to unchecked PSD file values used as array indexes. An attacker can exploit this by convincing a user to open or import a crafted PSD file, leading to heap corruption, application crashes, and potentially arbitrary code execution with user privileges.
CVE-2026-119369 is a stored cross-site scripting (XSS) vulnerability in The Events Calendar plugin by Liquid Web / StellarWP. It affects versions from initial releases up to 6.18.2. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 6.18.3.
CVE-2026-119479 is a medium severity vulnerability in Crocoblock JetFormBuilder versions prior to 3.6.8. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue that allows code injection. The vulnerability affects versions from initial releases up to 3.6.7.1 and has been fixed in version 3.6.8.
The PHP2Shell vulnerability involves critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that have been actively exploited for over a week. Attackers, notably a China-linked group, have successfully chained these PHP2Shell flaws with the Fragnesia Linux kernel privilege escalation bug to gain root access on Palo Alto Networks PAN-OS firewalls. Despite over 22.6 million exposed PHP instances potentially vulnerable, successful exploitation has been limited, with WordPress sites remaining largely unaffected. Palo Alto Networks has released patches for multiple PAN-OS versions and urges customers to restrict internet access to management interfaces. The attacks appear opportunistic and originate from a small number of IP addresses, targeting various sectors including healthcare and technology.
CVE-2026-116407 is a missing authorization vulnerability in Webba Plugins Webba Booking up to version 6.5.4. It allows attackers with limited privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure or modification. The issue is fixed in version 6.5.5.
The Tenda W18E router's web management server has an OS command injection vulnerability in its 'diagnose' packet-capture feature. This flaw arises from improper validation of JSON fields, allowing an attacker to inject shell metacharacters into the protocol or targetDevice parameters. Exploitation results in execution of arbitrary commands with root privileges. Notably, the vulnerability can be exploited without authentication if the device is in a factory-reset state.
CVE-2026-119368 is a Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar plugin. It affects versions from initial releases up to 6.18.2. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionalities. The issue has been fixed in version 6.18.3.
CVE-2026-119482 is a missing authorization vulnerability in Crocoblock JetFormBuilder versions prior to 3.6.8. This flaw allows attackers to exploit improperly configured access control, potentially leading to unauthorized modification of data. The issue has a medium severity rating with a CVSS score of 5.3 and does not impact confidentiality or availability but affects integrity. The vulnerability is fixed in version 3.6.8.
CVE-2026-46499 is an authorization vulnerability in Collabora Online before versions 24.04.18 and 25.04.11. It allows read-only users to bypass the read-only restriction by sending crafted WebSocket messages to execute document-modifying commands. Although these unauthorized changes cannot be saved directly by the attacker and are discarded when the session ends, they can mislead other collaborators or be saved unknowingly by authorized editors sharing the session. This issue has been fixed in the specified versions.
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective `Content Security Policy`, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the `Content Security Policy` header sent by `coolwsd` mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.
CVE-2026-93327 is a critical deserialization of untrusted data vulnerability in the SubWorkflow task of Google Cloud Application Integration. It affects versions prior to 2026-09-11 and allows an authenticated attacker to execute arbitrary code by submitting a malicious serialized object. The vulnerability was patched on September 11, 2026, and no customer action is required as Google manages remediation for this cloud service.
libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `ASS` content. In `wrap modes other than two`, a final line ending with a literal backslash-n sequence and otherwise consisting only of such sequences or spaces can remain after early trimming and make the line-measurement loops overshoot by one glyph. When the total text size exactly matches the allocated glyph-array capacity, the first loop reads an uninitialized 32-bit fixed-point `pos.x` value, although that value is not subsequently used. The second loop writes `pos.x` and `pos.y` beyond the array, zeroing the first and adding an attacker-controllable offset to the second. No actual exploitation beyond possible denial of service is known; broader exploitation is theoretical and constrained by the addresses, limited writes, and ASLR. This issue is fixed in version 0.17.5.
CVE-2026-61626 is a high-severity out-of-bounds write vulnerability in libass versions 0.17.4 up to but not including 0.17.5. It arises from insufficient validation of negative Matroska ReadOrder values during event pruning, potentially allowing an attacker to clear bits near a NULL pointer. Exploitation requires a malicious Matroska stream processed with enabled read-order checking and explicit event pruning. The vulnerability is fixed in libass version 0.17.5.
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in `backend/app/incidents/routes/incident_alert.py` omit role and tenant authorization, and `POST /api/incidents/alerts/create/velo-sigma/exclusion` does not validate credentials. Its `return_username_for_logging` dependency in `backend/app/auth/utils.py` calls `decode_token`, which returns ordinary Invalid token or Expired signature strings on failure, and the dependency passes these strings through instead of rejecting the request. A Bearer header is required, but an arbitrary invalid, expired or forged value can create a suppression rule without a valid account. The collection GET at /create/velo-sigma/exclusion lists exclusions; the read, update and delete routes under `/create/velo-sigma/exclusion/{exclusion_id}`, and the `/velo-sigma/exclusion/{exclusion_id}/toggle` route, use `get_current_user` without role checks, permitting any authenticated `customer_user` to manage every exclusion. In `backend/app/incidents/services/velo_sigma.py`, `process_sigma_alert` calls `check_exclusions` and drops matching enabled alerts before incident creation. A null `customer_code` applies a rule across all tenants. Attackers can suppress detections platform-wide through channel, title or field matching, while low-privilege accounts can enumerate detection-tuning data and modify, disable or delete legitimate exclusions. This issue is fixed in version 0.1.77.
Soft Serve, a Go-based Git server, improperly discloses the existence, exact names, and clone URLs of private repositories via HTTP responses. This occurs because the server responds to certain requests without verifying if the requester has read access, allowing enumeration of private repository names. Repository contents and metadata remain protected, and no write access is exposed. The issue affects versions from 0.5.0 up to but not including 0.12.3 and is fixed in version 0.12.3.