A heap-based buffer overflow vulnerability exists in Opengear IM72XX, CM71XX, and ACM70XX console server appliances running firmware versions 4.8.0 through 5.5.2. This flaw can be triggered by an unauthenticated remote attacker sending a specially crafted multipart/form-data POST request with an excessively long Content-Disposition name field, causing the index.cgi process to crash.
CVE-2026-118147 is a vulnerability in Microsoft Visual Studio 2017 version 15.9 involving improper certificate validation. This flaw allows an unauthorized attacker to perform network spoofing attacks. The vulnerability affects multiple versions of Visual Studio 2017 and later branches, with fixes available in specific patched releases. The issue has a high severity rating with a CVSS score of 7.4. No known exploits in the wild have been reported. Microsoft has issued official fixes for the affected versions.
An attacker URL linked to CVE-2021-42013 was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-31. The URL was seen five times in attacker activity originating from infrastructure in India. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the URL was used for payload delivery or exploitation. Organizations are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.
FFmpeg versions 5.0 through 9.0.2 contain a path traversal vulnerability in the IMF demuxer. This flaw allows attackers to craft IMF packages with specially designed ASSETMAP Path elements containing '..' or absolute paths, enabling access to files outside the intended directory. Exploitation can lead to reading local MXF files, probing their existence and size, or triggering server-side requests.
AJ-Report versions up to 1.7.1 use a hard-coded JWT secret to sign share tokens, enabling attackers to forge valid tokens offline. This allows unauthorized access to the testTransform endpoint, which can execute arbitrary code via GroovyClassLoader without authentication.
A heap-based buffer overflow vulnerability exists in libheif versions 1.18.0 through before 1.23.3 in the function unc_decoder_mixed_interleave::processTile(). This flaw allows attackers to craft malicious HEIF files with chroma components of unequal bit depths, leading to out-of-bounds heap writes. Exploitation could potentially result in code execution within image-processing pipelines. The issue is fixed in libheif version 1.23.3.
The Thelia Page Module before version 2.0.4 contains a cross-site request forgery (CSRF) vulnerability. This flaw allows remote attackers to delete page tags, documents, and images by exploiting back-office delete routes that lack CSRF tokens and permission checks. An attacker can trick a logged-in administrator into visiting crafted GET requests that sequentially delete TheliaLibrary images and associated files across pages, products, and categories. The vulnerability is fixed in version 2.0.4.
Thelia versions prior to 3.2.0 contain a cross-site request forgery (CSRF) vulnerability in the back office. This vulnerability arises because per-session CSRF tokens leak via URL query strings, allowing attackers to reuse these tokens or exploit unprotected actions. Specifically, attackers can target the setToggleVisibilityAction and updatePositionAction to perform unauthorized administrative actions such as deleting, hiding, or reordering catalogue and configuration objects. The issue is fixed in Thelia versions 3.2.0 and 1.2.0.
Thelia versions prior to 3.1.0 contain a stored cross-site scripting (XSS) vulnerability in the ForSomeCustomers::getSummary() function. This flaw allows unauthenticated attackers to inject malicious scripts via unescaped customer names. When administrators view coupons related to these customers, the injected scripts execute, potentially stealing CSRF tokens and enabling attackers to create administrator accounts.
DeepInfer versions up to 0.1.0 have a path traversal vulnerability in the unauthenticated /profile endpoint. This flaw allows remote attackers to create arbitrary directories via the output_dir parameter. Exploitation can lead to writing chrome trace files that exhaust disk space or inodes and can leak filesystem information through error messages.
ShowDoc versions from 2.8.14 up to but not including 3.9.6 contain a code injection vulnerability in the Mock feature. Authenticated users can exploit this flaw by storing specially crafted mockjs templates that execute shell commands with root privileges in the official Docker image. The vulnerability is fixed in version 3.9.6.
Highflame ramparts versions 0.8.1 through 0.8.10 have a vulnerability that allows attackers to bypass security scans by hiding malicious .pyc files in nested __pycache__ directories. The affected functions skip nested directories and .pyc files, enabling execution of unchecked malicious code when the skill runs.
Jpom versions 2.10.0 through 2.11.12 have an authentication bypass vulnerability. This flaw allows unauthenticated attackers to gain super-administrator access by injecting specially crafted query conditions into the JPOM-USER-TOKEN header. The vulnerability arises because the Hutool Condition parser interprets injected values like 'is not null' as operators, enabling unauthorized command execution via Jpom's script features.
Nexterm versions from 1.0.6-OPEN-PREVIEW through 1.2.2-BETA have an authorization bypass vulnerability. Authenticated users can manipulate session lifecycle endpoints to hibernate, resume, or terminate other users' remote sessions if they obtain a session ID. This affects SSH, RDP, VNC, and SFTP sessions, potentially disrupting active connections.
LearnHouse versions prior to 1.1.1 have an authorization bypass vulnerability in the assignment API. Authenticated users can exploit this flaw to access other users' grades, submissions, and instructor feedback by supplying a different user_id to the submissions grade endpoint or related read functions. This issue is fixed in version 1.1.1.
A URL associated with attacker activity linked to CVE-2021-42013 was observed multiple times in the wild on 2026-10-31. This URL was used in attacker payloads involving tool downloads or callbacks, indicating its role in ingress tool transfer (technique T1105). The attacker infrastructure was identified in India. Security teams are advised to block and monitor this URL and review proxy, web, and WAF logs for any access attempts.