Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
A malicious file identified by the SHA-256 hash 1c0688bb8702fd6c977efffa5e9d1a5c2da77431d41bd6c31f86cbc3ce368700 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. The file was detected four times in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in Poland. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No known exploits or threat actors have been associated with this indicator yet. There is no information about affected software versions or patches.
A malicious file identified by the SHA-256 hash d53eda7a637c99cc7fb566d96e9fa109bf15c478410a3f5eb4d4c4e26cd081f6 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The payload could be a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in Poland. There is no information about active exploitation or affected software versions. This indicator should be matched against files in environments and security tools for detection purposes.
A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.
A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and could be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
The URL http://play.nopixel-rp.ir/ was observed twice in attacker activity on 2026-10-24 by OffSeq Mirage honeypot sensors. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating its use in attacker payloads such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified as originating from Great Britain. This URL serves as an indicator of compromise (IOC) and should be blocked and monitored in network defenses.
Golang 1.23 contains a vulnerability (CVE-2026-46600) where parsing an invalid SVCB or HTTPS resource record (RR) can cause a panic due to a parameter value size overflow in the message buffer. This issue affects multiple versions of Golang and related knative-serving versions prior to 1.22.1-r0. A patch is available to address this vulnerability. The CVSS score is 7.5, indicating a medium severity with an impact on availability.
ANAT (AI Network Anomaly Tracker) is an open-source, lightweight Intrusion Detection System (IDS) designed for real-time network traffic monitoring and anomaly detection. It captures packets, detects suspicious activities such as port scans, floods, and large packets, and visualizes alerts through a cyberpunk-themed dashboard. The tool supports alert logging, filtering, trusted source suppression, and integration with Discord for alert notifications. It is intended for educational and authorized security testing purposes only and requires elevated privileges for packet capture.
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
An attacker URL https://wrpddqm0rp.rbmock.dev/ was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-24. The URL was seen 4 times in attacker activity related to the T1105 technique (Ingress Tool Transfer), indicating its use for payload delivery or command and control. The attacker infrastructure was located in Colorado, USA. This URL is associated with attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software versions are affected, and no known exploits are reported in the wild for this indicator.
Postiz-app versions from 2.15.0 up to but not including 2.25.3 have a critical vulnerability (CVE-2026-115933) where session, invitation, and password reset tokens are signed with a single shared secret without distinguishing token types. This flaw allows an attacker with limited privileges to craft tokens with arbitrary claims that the application accepts as valid sessions, invitations with chosen roles, password resets, or provisioning tokens. The vulnerability stems from improper authentication design (CWE-290) and insecure token handling.
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.
Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.
An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.
The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
BookStack versions before 26.09.2 have an authorization vulnerability in the AttachmentController that allows authenticated users with attachment permissions to access draft page attachments of other users by enumerating attachment IDs. This can lead to unauthorized downloading, renaming, relinking, or replacing of files on unpublished draft pages.
Grav versions from 2.0.15 up to but not including 2.2.13 contain a vulnerability that allows attackers with page-edit permissions to bypass allowlist restrictions and invoke arbitrary public static methods. This can lead to unauthorized deletion of directories, overwriting of files, or reading files outside the intended page tree by embedding crafted fields in Flex form overrides within page frontmatter.