Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and the partition trusts what it reads back. Another local user on the same host can exploit this during a mix deps.compile run that uses partitioned compilation.
Mix.Tasks.Deps.Partition.server/4 in lib/mix/lib/mix/tasks/deps.partition.ex creates the directory with File.mkdir_p/1, which accepts an existing directory without checking its owner, so a user who created it first can replace the file before client/0 reads it.
This issue affects mix: from 1.20.0-rc.4 before 1.20.5.
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.
JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.
This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.
URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.
This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
CVE-2026-59387 is a broken access control vulnerability in the Cloud Foundry Cloud Controller API (CAPI). The Nginx routing configuration blocks unauthenticated access to certain internal API endpoints but omits this protection for /internal/v3/. This allows unauthenticated access to staging callback endpoints, enabling attackers with a valid build or droplet GUID to forge staging callbacks, transition droplets to STAGED state, and persist arbitrary metadata without proper authorization. The vulnerability enables privilege escalation beyond intended role boundaries because a SpaceAuditor can enumerate GUIDs without write permissions.
CVE-2026-111585 is a high-severity integer overflow vulnerability in TeamViewer's remote-control screen processing component affecting Windows, macOS, Linux, and Android clients. It allows a malicious or compromised host to send crafted screen dimension data that causes a buffer overflow in the viewer application, potentially leading to denial-of-service or arbitrary code execution on the viewer's system. Exploitation requires the viewer to establish a remote session with the attacker-controlled host. TeamViewer has released patches in version 15.83 and for multiple legacy versions to address this and related vulnerabilities.
CVE-2026-59385 is a vulnerability in Cloud Foundry's CAPI (Cloud Foundry Controller) that allows a user with SpaceDeveloper privileges to indirectly extract space-scoped broker credentials. This is achieved by modifying the URL of a space-scoped broker to redirect credentials to a broker under their control, bypassing the CF API's restriction on direct credential reading. The vulnerability affects versions prior to 1.248.0 and 60.9.0, where fixes have been applied.
CVE-2026-59388 is a vulnerability in Cloud Foundry's Cloud Controller (CAPI) that causes sensitive information to be leaked in audit logs. Specifically, credentials for custom buildpacks, syslog drain URLs, and service binding parameters are exposed in various audit events related to application manifests, service instances, and service bindings. This exposure could allow unauthorized parties with access to audit logs to obtain sensitive credentials.
CVE-2026-59386 is a vulnerability in Cloud Foundry Controller (CAPI) that allows a SpaceSupporter to escalate privileges improperly. By modifying an application's start command and buildpack—actions normally restricted to SpaceDeveloper roles—an attacker can retrieve service credentials without authorization. This flaw affects versions up to 60.9.0, where it has been fixed.
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
CVE-2026-59396 is a denial-of-service vulnerability in Cloud Foundry UAA's private_key_jwt client-authentication mechanism. It arises from the handling of remote JWKS URI responses, which are cached and fully deserialized upon invalid authentication attempts. An attacker with write access to clients or a compromised endpoint can send anonymous requests that repeatedly trigger parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion, leading to service unavailability. The vulnerability affects UAA versions >=76.23.0 <79.9.0 and >=0 <60.11.0. Fixed versions are 79.9.0 and 60.11.0. The CVSS 4.0 score is 6.9 (medium severity).
CVE-2026-115456 is a low-severity vulnerability in the gcc compiler's libstdc++ library affecting Red Hat Enterprise Linux 10. It involves an out-of-bounds read triggered when std::from_chars() processes a non-null-terminated string, potentially causing application crashes or incorrect floating-point conversions. Exploitation requires an application built with libstdc++ to handle untrusted, improperly terminated input without bounds validation. There is no risk of memory corruption or code execution. Mitigation options are currently unavailable or do not meet Red Hat's criteria for deployment and stability.
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable.
Users are recommended to upgrade to 1.16.1 which fixes the issue.
Binance, the largest cryptocurrency exchange, suffered a record $6.3 billion crypto theft on October 29, 2026. The attack likely originated from a compromised DevOps engineer's laptop, allowing unauthorized withdrawal transactions without leaking wallet private keys. The attackers exploited multiple blockchains using valid signatures, indicating control over Binance's hot wallet signing system. Blockchain analysts attribute the attack with high confidence to North Korea's elite hacking unit, TraderTraitor. Approximately $3 billion of the stolen assets have been frozen by stablecoin issuers and security councils, while about $2.4 billion remain unfrozen. Binance is cooperating with law enforcement and has pledged to reimburse all losses using company funds and its Secure Asset Fund for Users (SAFU).
A critical authorization vulnerability exists in Teltonika Networks RUTOS and TSWOS devices within specified versions. An unauthenticated user can invoke LUA functions directly, bypassing normal API validation flows, potentially leading to operating system command execution. This affects multiple device models running RUTOS versions 7.22 through 7.24.2 and TSWOS versions 1.9 through 1.10.
The npm package 'claims-acct-unlock' version 25.2.1 has been identified as malicious by the OpenSSF Package Analysis project. It is flagged because it communicates with a domain linked to malicious activity and executes commands associated with malicious behavior. This package poses a security risk to users who install or use it.
A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS).
A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations.
A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).
Gravity Forms plugin for WordPress versions up to and including 3.1.2 is vulnerable to PHP Object Injection via a Post Custom Field of type List. This occurs because the plugin uses WordPress' maybe_unserialize() without restrictions instead of its own hardened deserialization function. An attacker can inject PHP objects into post meta, potentially leading to remote code execution if a suitable gadget chain exists in other plugins, themes, or WordPress itself.
The AI Engine – MCP Server & AI Chatbot for WordPress plugin (versions up to 3.8.6) contains a missing authorization vulnerability in its MCP module's OAuth 2.1 Dynamic Client Registration endpoint. This endpoint allows unauthenticated users to register OAuth clients with attacker-controlled redirect URIs. If an administrator approves the attacker's client on the OAuth consent screen, the attacker can gain administrator-level access through the MCP tools. The consent page lacks protections against clickjacking, enabling attackers to trick administrators into approving malicious clients.