CVE-2026-118147 is a vulnerability in Microsoft Visual Studio 2017 version 15.9 involving improper certificate validation. This flaw allows an unauthorized attacker to perform network spoofing attacks. The vulnerability affects multiple versions of Visual Studio 2017 and later branches, with fixes available in specific patched releases. The issue has a high severity rating with a CVSS score of 7.4. No known exploits in the wild have been reported. Microsoft has issued official fixes for the affected versions.
An attacker URL linked to CVE-2021-42013 was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-31. The URL was seen five times in attacker activity originating from infrastructure in India. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the URL was used for payload delivery or exploitation. Organizations are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.
FFmpeg versions 5.0 through 9.0.2 contain a path traversal vulnerability in the IMF demuxer. This flaw allows attackers to craft IMF packages with specially designed ASSETMAP Path elements containing '..' or absolute paths, enabling access to files outside the intended directory. Exploitation can lead to reading local MXF files, probing their existence and size, or triggering server-side requests.
AJ-Report versions up to 1.7.1 use a hard-coded JWT secret to sign share tokens, enabling attackers to forge valid tokens offline. This allows unauthorized access to the testTransform endpoint, which can execute arbitrary code via GroovyClassLoader without authentication.
A heap-based buffer overflow vulnerability exists in libheif versions 1.18.0 through before 1.23.3 in the function unc_decoder_mixed_interleave::processTile(). This flaw allows attackers to craft malicious HEIF files with chroma components of unequal bit depths, leading to out-of-bounds heap writes. Exploitation could potentially result in code execution within image-processing pipelines. The issue is fixed in libheif version 1.23.3.
The Thelia Page Module before version 2.0.4 contains a cross-site request forgery (CSRF) vulnerability. This flaw allows remote attackers to delete page tags, documents, and images by exploiting back-office delete routes that lack CSRF tokens and permission checks. An attacker can trick a logged-in administrator into visiting crafted GET requests that sequentially delete TheliaLibrary images and associated files across pages, products, and categories. The vulnerability is fixed in version 2.0.4.
Thelia versions prior to 3.2.0 contain a cross-site request forgery (CSRF) vulnerability in the back office. This vulnerability arises because per-session CSRF tokens leak via URL query strings, allowing attackers to reuse these tokens or exploit unprotected actions. Specifically, attackers can target the setToggleVisibilityAction and updatePositionAction to perform unauthorized administrative actions such as deleting, hiding, or reordering catalogue and configuration objects. The issue is fixed in Thelia versions 3.2.0 and 1.2.0.
Thelia versions prior to 3.1.0 contain a stored cross-site scripting (XSS) vulnerability in the ForSomeCustomers::getSummary() function. This flaw allows unauthenticated attackers to inject malicious scripts via unescaped customer names. When administrators view coupons related to these customers, the injected scripts execute, potentially stealing CSRF tokens and enabling attackers to create administrator accounts.
DeepInfer versions up to 0.1.0 have a path traversal vulnerability in the unauthenticated /profile endpoint. This flaw allows remote attackers to create arbitrary directories via the output_dir parameter. Exploitation can lead to writing chrome trace files that exhaust disk space or inodes and can leak filesystem information through error messages.
ShowDoc versions from 2.8.14 up to but not including 3.9.6 contain a code injection vulnerability in the Mock feature. Authenticated users can exploit this flaw by storing specially crafted mockjs templates that execute shell commands with root privileges in the official Docker image. The vulnerability is fixed in version 3.9.6.
Highflame ramparts versions 0.8.1 through 0.8.10 have a vulnerability that allows attackers to bypass security scans by hiding malicious .pyc files in nested __pycache__ directories. The affected functions skip nested directories and .pyc files, enabling execution of unchecked malicious code when the skill runs.
Jpom versions 2.10.0 through 2.11.12 have an authentication bypass vulnerability. This flaw allows unauthenticated attackers to gain super-administrator access by injecting specially crafted query conditions into the JPOM-USER-TOKEN header. The vulnerability arises because the Hutool Condition parser interprets injected values like 'is not null' as operators, enabling unauthorized command execution via Jpom's script features.
Nexterm versions from 1.0.6-OPEN-PREVIEW through 1.2.2-BETA have an authorization bypass vulnerability. Authenticated users can manipulate session lifecycle endpoints to hibernate, resume, or terminate other users' remote sessions if they obtain a session ID. This affects SSH, RDP, VNC, and SFTP sessions, potentially disrupting active connections.
LearnHouse versions prior to 1.1.1 have an authorization bypass vulnerability in the assignment API. Authenticated users can exploit this flaw to access other users' grades, submissions, and instructor feedback by supplying a different user_id to the submissions grade endpoint or related read functions. This issue is fixed in version 1.1.1.
A URL associated with attacker activity linked to CVE-2021-42013 was observed multiple times in the wild on 2026-10-31. This URL was used in attacker payloads involving tool downloads or callbacks, indicating its role in ingress tool transfer (technique T1105). The attacker infrastructure was identified in India. Security teams are advised to block and monitor this URL and review proxy, web, and WAF logs for any access attempts.
The npm package @mamans2973/maman versions 1.0.0 through 1.0.3 contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the system, necessitating immediate rotation of all secrets and keys from a different, uncompromised machine. Removal of the package alone may not eliminate all malicious software introduced by it.
A heap-based buffer overflow vulnerability exists in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2. This flaw allows an unauthenticated remote attacker to crash the index.cgi process by sending a specially crafted multipart/form-data POST request with an excessively long Content-Disposition name field.
WebDyne versions from 2.022 up to but not including 3.022 for Perl have a vulnerability that allows unauthenticated remote attackers to read application source code via the built-in viewer on the default index page. This includes Perl source files and embedded __PERL__ blocks in .psp pages, potentially exposing sensitive credentials.
WebDyne versions from 2.014 before 3.022 for Perl contain a cross-site scripting (XSS) vulnerability. This occurs because request parameters are reflected unescaped into form field values, specifically in textfield, password_field, and filefield tags. The default setting WEBDYNE_CGI_AUTOESCAPE is off, allowing injection of scripts via crafted links. From version 3.022, changes to the entity_encode method render enabling auto-escaping ineffective.
WebDyne versions from 2.031 up to but not including 3.022 for Perl execute files with .psp anywhere in the filename as Perl pages. This behavior allows an attacker to upload files with names like report.psp.pdf and have them executed as Perl code by the server.