**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions.
Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.
CVE-2026-115721 is a high-severity vulnerability in Apache Vysper, an XMPP server library. It involves unbounded resource allocation during XML parsing, which can lead to an out-of-memory condition. This affects all versions of Apache Vysper. The project is retired and no fixes will be released. Users are advised to migrate to alternative solutions.
Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware.
Security Fix(es):
* golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate
certificates (CVE-2026-111943)
* net/url: Memory exhaustion in query parameter parsing in net/url
(CVE-2025-61726)
* Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* golang: golang crypto/x509: Denial of Service via excessive processing of
DNS SAN entries (CVE-2026-27145)
* crypto/tls: golang: Go: Denial of Service vulnerability in certificate
chain building (CVE-2026-32280)
* golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update
messages (CVE-2026-32283)
* golang: Go net package: Denial of Service via long CNAME response in
LookupCNAME (CVE-2026-33811)
* golang: Go encoding/asn1: Denial of Service via excessive recursion in
Unmarshal (CVE-2026-33818)
* golang: net/http: golang.org/x/net/idna: Privilege escalation via
incorrect Punycode label processing (CVE-2026-39821)
* golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial
of Service (CVE-2026-56853)
* golang: Go html/template: Cross-Site Scripting via pathological input
(CVE-2026-56858)
* golang: golang net/url: Denial of Service from quadratic complexity in
path resolution (CVE-2026-56860)
* golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate
messages (CVE-2026-56862)
* etcd: Denial of Service via unbounded TLS handshake goroutines
(CVE-2026-73500)
* net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of
Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.
Security Fix(es):
* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.
Open5GS versions 1.3.0 through 2.8.0 have a heap out-of-bounds write vulnerability in the parse_multipart() function. This flaw allows unauthenticated attackers to corrupt memory by sending a crafted multipart/related request with an empty multipart boundary to the SBI interface of any network function, causing a buffer overflow and potential crash.
CVE-2026-116542 is a vulnerability in netty-tcnative versions before 2.0.84.Final that allows remote unauthenticated clients to spoof SNI hostnames by exploiting improper handling of Unicode encoding in JNI NewStringUTF decoding. Attackers can use overlong encodings in the ClientHello server_name field to manipulate SNI-based certificate selection, access control decisions, and logging.
CVE-2026-116541 is a denial of service vulnerability in netty-tcnative versions before 2.0.84.Final. The flaw occurs in the tcn_write_to_bytebuffer BIO write callback, which incorrectly calculates bytes consumed. This can be exploited by remote TLS 1.3 peers sending queued post-handshake records such as NewSessionTicket or KeyUpdate, causing truncated flights, connection failures, or JVM process aborts.
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
CVE-2026-116539 is a heap buffer overflow vulnerability in netty-tcnative before version 2.0.84.Final. It occurs in the tcn_write_to_bytebuffer BIO callback due to improper handling of the ring buffer write index. Remote TLS peers can exploit this during handshake, renegotiation, or post-handshake messages to trigger an out-of-bounds memory copy, causing the JVM process to crash.
HtmlSanitizer versions before 9.2.1039 and prereleases before 10.0.1037-beta contain a cross-site scripting (XSS) vulnerability. The function SanitizeDom(string) does not sanitize attributes on the html and body wrapper elements, allowing attackers to inject a second html or body tag with event handlers such as onload. This can lead to script execution when the application renders the serialized document or body outer HTML. The vulnerability has a low CVSS score of 2.3 and is fixed in versions 9.2.1039 and 10.0.1037-beta.
CVE-2026-116489 is a type confusion vulnerability in timescale pgvectorscale versions before 0.9.1. It allows low-privileged database users with CREATE privilege on the vectorscale schema to corrupt memory by shadowing pgvector's vector type or operators. Exploitation involves pre-creating shadow objects and querying DiskANN indexes with crafted values, leading to out-of-bounds memory reads and writes. This can result in memory disclosure, server crashes, or privilege escalation. The vulnerability is fixed in version 0.9.1.
A malicious file identified by the SHA-256 hash 5bb52bd682510c1fdc91025512a92c0e2323c885664e65ad32f0fbb426940469 was observed by OffSeq Mirage honeypot sensors on 2026-10-26. The file was detected four times during attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The malicious activity was traced to attacker infrastructure located in PS. Organizations are advised to match this hash against their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash a863e21577e54cd763729803a621804da4b5030afa35bcf879ea3b3413488a66 was observed by OffSeq Mirage honeypot sensors during attacker activity on 2026-10-26. This file is associated with CVE-2026-109618 and linked to the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool used during the attack. The activity was traced back to attacker infrastructure in PS. Organizations are advised to match this hash against files in their environments and threat intelligence feeds.
CVE-2026-85297 is a vulnerability in Google Cloud Run MCP versions prior to 1.11.0 that allows bucket squatting. This flaw enables attackers to intercept and access proprietary source code, execute arbitrary code, and exfiltrate data. The issue is resolved in version 1.11.0 and later.
The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are critical flaws in the PHP engine allowing unauthenticated remote code execution. Multiple industrial vendors including Siemens, Schneider Electric, ABB, and others have confirmed that some of their products are affected. Patches for PHP were released on October 21, 2026, shortly after exploitation attempts began. Several vendors have released or are preparing patches for affected products, while some continue to assess impact or provide mitigations. The vulnerabilities have been actively targeted in the wild, with millions of exploitation attempts reported and confirmed attacks on honeypots.
CVE-2026-99099 addresses a vulnerability in the Linux kernel related to AMD processors where the processor may fail to invalidate a TLB entry when executing an INVLPGB/TLBSYNC instruction pair. This issue is known as AMD TLBI Erratum #1718. The Linux kernel has implemented a software workaround to detect this erratum and mitigate it when a microcode fix is not available.
A buffer overflow vulnerability in the Linux kernel's dm-integrity inline mode with large tag sizes has been fixed. The issue occurs because the checksum computation uses an on-stack buffer smaller than the tag size, causing an overflow when the tag size exceeds the buffer size. This overflow can cause kernel panics with stack protection enabled. The vulnerability requires root privileges to trigger and is not considered a security bug. Fixes have been applied in recent kernel commits.
A vulnerability in the Linux kernel's tee subsystem allows zero-sized allocations in tee_dyn_shm_alloc_helper(), leading to a kernel allocation failure and potential boot panic on systems with panic_on_warn enabled. This occurs because the function does not check for zero size before calling alloc_pages_exact(), which results in an invalid page order. The issue is triggered via TEE_IOC_SHM_ALLOC with a zero size parameter and has been fixed in specific commits.
A vulnerability in the Linux kernel's io_uring subsystem allowed disabled rings to bypass task restrictions on register operations until enabled. This could let a task with restricted register opcodes create a disabled ring, perform any register opcode on it, and then enable the ring without proper permission. The issue has been fixed by ensuring that rings inheriting restrictions from tasks are checked even while disabled, requiring explicit permission to enable them.