The `nix-nar` crate's `Decoder::unpack` function improperly handles path containment when extracting archive entries, allowing a malicious NAR archive to write files outside the intended destination directory via path traversal. This occurs because symlink targets are not validated and the containment check only compares path strings without considering symlinks created earlier during unpacking. An attacker can craft an archive that creates symlinks pointing outside the destination and then writes files through these symlinks, potentially enabling code execution by placing files in attacker-controlled locations.
A highly critical access bypass vulnerability (CVE-2026-118539) in the Drupal Commerce Core module is actively exploited in the wild. This flaw allows unauthenticated attackers to bypass access controls on certain routes and entity fields, potentially leading to financial impact for online store vendors. The vulnerability affects Commerce Core 3.x versions prior to 3.3.13 and earlier 8.x-2.x releases before 8.x-2.41. Drupal urges administrators to update to fixed versions and audit their store orders for inconsistencies. The module is widely used on over 42,000 sites. Drupal assigned a high risk score of 21 out of 25 to this vulnerability. No detailed exploitation methods or attacker identities have been disclosed.
CVE-2026-116366 is a critical integer overflow or wraparound vulnerability in ClickHouse Server that allows unauthenticated remote attackers to execute arbitrary code. The flaw affects multiple versions prior to fixed releases in the 26.x series. The vulnerability has a high CVSS 4.0 score of 9.5, indicating severe impact if exploited. No known exploits are reported in the wild at this time.
CVE-2026-22110 is a high-severity vulnerability in Delta Electronics Delta UFC500 chargers where the web server fails to authenticate POST or PUT requests. This allows unauthenticated attackers to reboot the charger or, by brute-forcing the configid, set the service password and modify any settings. The issue affects versions prior to 2.4.18 and 4.4.1, where fixes have been applied.
Delta Electronics Delta UFC500 charging stations use default credentials for the Service account that are derived from specific character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct or exhaust the password keyspace, allowing unauthorized login to read and modify sensitive settings such as the OCPP backend configuration. This vulnerability affects versions prior to 2.4.18 and 4.4.1, where fixes have been applied.
Delta Electronics Delta UFC500 devices up to version 1.4.6 contain a vulnerability where the WebUI template database retains factory default passwords for all five account types in cleartext. These default passwords are identical across devices and were not changed on the tested unit. This issue allows attackers with local access to potentially gain unauthorized access using these default credentials.
CVE-2026-22114 is a vulnerability in Delta Electronics Delta UFC500 devices where HTTP basic authentication does not enforce any retry limit or backoff mechanism. This allows an attacker to exhaust the authentication keyspace, especially when combined with the default service password. The issue affects versions prior to 4.4.2 and has been assigned a medium severity rating.
CVE-2025-31704 is a critical OS command injection vulnerability in Dahua Intelligent Connection Center. It allows a remote attacker to execute arbitrary commands without authentication by sending specially crafted requests. This leads to remote code execution on the affected system. The vulnerability affects versions from 1.000.0000000.1 up to 1.000.0000005.0 and from 5.000.0000000.6 up to but not including 5.000.0000000.15. A fix is available in version 5.000.0000000.15.
CVE-2026-85268 is a high-severity Cross-Site Scripting (XSS) vulnerability in the auth/handler component of Google Cloud Identity Platform and Firebase Authentication on iOS. This flaw affects versions prior to 2026-08-14 and allows an unauthenticated remote attacker to execute arbitrary JavaScript by leveraging a malicious iOS bundle ID. The vulnerability has been fixed as of version 2026-08-14. The service is cloud-hosted, and Google manages remediation server-side.
The stdid-nyxprobe package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command to execute this code, serving no legitimate purpose beyond data exfiltration. The risk is limited but present due to the unauthorized data collection.
CVE-2026-14467 is an information disclosure vulnerability in the Forocoches comments editor. It allows an attacker to embed an image with a malicious external URL in a comment. When users view the affected discussion thread, their browsers send HTTP/HTTPS requests to the attacker's server, leaking sensitive metadata such as IP address, User-Agent, and access time. This compromises user privacy. The vulnerability affects version 0 of the Forocoches comments editor and has a high severity score of 8.2. A fix was released in May 2026.
A supply chain attack targeting Polymarket traders involved malicious code injected via a compromised third-party website monitoring tool, DebugBear. The malicious JavaScript hijacked logged-in user sessions to siphon funds by selling positions or transferring tokens to attacker-controlled addresses. Polymarket's international platform was affected, resulting in over $2 million in losses, while the US platform remained unaffected. Polymarket halted trading temporarily, removed the malicious script, and pledged to reimburse affected users. DebugBear confirmed the incident and advised users to remove its monitoring snippet.
Kairos is a newly documented Linux DDoS botnet written in Go that compromises machines via Telnet using default root credentials with empty passwords. It establishes hundreds to thousands of TCP connections to targeted services, maintaining them with minimal keepalive traffic to exhaust resources. The bot uses a simple three-command protocol and masquerades as a kernel worker thread. It supports multiple CPU architectures and uses a build-per-command-and-control distribution model.
CVE-2026-97229 is a critical code execution vulnerability in GitLab caused by insufficient validation in Ruby's Onigmo regular expression engine. It allows unauthenticated attackers to execute arbitrary code on the GitLab server via crafted CI/CD configurations. The vulnerability was exploited in an attempted attack against Alpine Linux's GitLab instance, which failed but prompted a full rebuild and password resets. The flaw is rooted in Ruby, not GitLab itself, requiring updates to Ruby versions 3.3.13, 3.4.12, 4.0.9 or later for full remediation. The US CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging rapid patching.
The Claude Code extension version 2.1.313 in the Cursor Marketplace was compromised with a malicious loader that installs an SSH backdoor. This backdoor adds an attacker-controlled SSH key to authorized_keys, attempts to enable local SSH services, and establishes a reverse SSH tunnel to a remote server. It collects system and user reconnaissance data and installs persistence mechanisms on macOS, Linux, and Windows. Communications with the command-and-control server are unencrypted, allowing persistent remote access.
A denial-of-service vulnerability in UAA's private_key_jwt client-authentication mechanism allows an attacker with write access to clients or a compromised endpoint to cause service unavailability. This occurs by triggering repeated parsing of large cached JSON Web Key Set (JWKS) objects, leading to excessive CPU usage and potential Java heap exhaustion resulting in OutOfMemoryError.
CVE-2026-59385 describes a vulnerability where a user with SpaceDeveloper privileges can modify the URL of a space-scoped broker without changing its credentials. This allows the user to indirectly extract existing broker credentials by redirecting them to a broker they control. The Cloud Foundry API does not allow direct reading of broker credentials, so this method bypasses that restriction. The vulnerability has a low severity score of 2.7 and does not impact integrity or availability.
Cloud Controller (CAPI) has multiple instances where sensitive data is leaked into audit logs. Specifically, credentials for custom buildpacks appear in audit events related to app manifest application, creation, and updates. Additionally, syslog drain URL credentials are exposed in user-provided service instance audit events, and service binding parameters are leaked in app manifest and service binding audit events. This exposure could lead to unauthorized access to sensitive credentials if audit logs are accessed by unauthorized parties.
Apache Fineract versions up to and including 1.15.0 are vulnerable to a time-based blind SQL injection via the Center read endpoint and datatable entry read endpoints. The vulnerability arises because user-supplied ordering parameters are concatenated directly into the SQL ORDER BY clause, bypassing existing regex validation. This flaw allows any authenticated user with read access to exploit the injection. Upgrading to version 1.16.1 addresses this issue.
CVE-2026-59386 is a vulnerability where a SpaceSupporter can improperly modify an application's start command and buildpack, actions normally restricted to SpaceDeveloper privileges. This privilege escalation allows unauthorized retrieval of service credentials by leveraging malicious start commands or custom buildpacks.