Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.
The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications.
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) executes code with unnecessary privileges. All processes run as root and the system lacks privilege separation. The compromise of any single service results in full administrative control of the device.
FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file.
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet.
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges.
CVE-2026-114594 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Sandisk Dashboard installer up to version 5.2.2.3. It allows a local, authenticated standard user to replace a binary in a user-writable temporary directory between validation and execution. This leads to execution of an attacker-controlled binary with elevated privileges, resulting in local privilege escalation to administrative level.
This report summarizes multiple cyber threats and vulnerabilities discovered in early November 2026, including ransomware attacks, supply-chain compromises, AI-powered exploitation frameworks, and several high-severity software vulnerabilities. Notable incidents include a ransomware attack on Queens Public Library, a destructive attack on Russian web hosting provider Beget, and a supply-chain attack on the Linux security tool cPGuard. AI-assisted threat actors targeted financial and cryptocurrency sectors, while multiple critical vulnerabilities were patched in SonicWall, Android, Barracuda Email Security Gateway, and OpenSSH. Some vulnerabilities have been linked to active exploitation.
The LaserGest mobile application version 1.0.18 uses a hardcoded AES encryption key and initialization vector (IV) to protect stored assistance portal credentials. This practice allows an attacker who can access the application package to extract these cryptographic parameters and decrypt the credentials, exposing them in cleartext. The vulnerability is identified as CWE-321 (Use of Hard-coded Cryptographic Key) and CWE-522 (Insufficiently Protected Credentials).
The am_club mobile application versions from 1.7.194 up to but not including 1.8.198 contain hard-coded MQTT credentials. This vulnerability allows an unauthenticated attacker to connect to the MQTT broker and potentially access or manipulate data across tenant boundaries. The issue is fixed in version 1.8.198.
Eclipse Langium versions 3.2.0 through 4.4.0 have an inefficient algorithmic complexity vulnerability (CWE-407) in the IndentationAwareTokenBuilder and IndentationAwareLexer. The issue causes quadratic time tokenization when processing documents with frequent indentation changes, leading to blocking of the Node.js event loop and denial of service. Languages using the default lexer and token builder are not affected.
CVE-2026-118492 is a cross-site scripting (XSS) vulnerability in Eclipse Langium versions 3.0.0 through 4.4.0. The langium-sprotty package fails to HTML-escape diagnostic messages before rendering them in hover popups. This allows attacker-controlled JavaScript to execute in the browser or webview when a malicious source file triggers an unresolved cross-reference error with embedded HTML markup.
A path traversal vulnerability exists in the simulation of actions in the Zypp backend of PackageKit versions before 1.4.1. This flaw allows local attackers to escalate privileges to root. The vulnerability is critical with a CVSS 4.0 score of 9.3, indicating high impact and exploitability under local attack conditions.
The loadIndex function in nmslib hnswlib and Spotify Voyager improperly validates the element count in a serialized HNSW index. This flaw allows an attacker to supply a crafted index file with an element count exceeding the stored capacity, leading to a heap buffer overflow and potential application crash during file loading.
A vulnerability exists in the ssl.get_server_certificate() function when the ca_certs parameter is supplied. In this case, the identity of the certificate is not checked, potentially undermining the trust model of SSL certificate validation.
A path traversal vulnerability exists in kevquirk PureBlog up to version 3.7.2 in the save_page function of includes/lib/content.php within the Page Editor component. This flaw allows remote attackers with high privileges to manipulate the page slug argument to perform path traversal. The issue is fixed in version 3.7.3.
PrestaShop has an authenticated PHP code injection vulnerability in its back-office Performance debug-mode configuration. A user with permission to modify debug settings can inject PHP code via crafted debug cookie parameters, which are written without proper escaping into a PHP configuration file. This injected code executes with web-server privileges when the configuration file is loaded.