CVE-2026-93327 is a critical deserialization of untrusted data vulnerability in the SubWorkflow task of Google Cloud Application Integration. It affects versions prior to 2026-09-11 and allows an authenticated attacker to execute arbitrary code by submitting a malicious serialized object. The vulnerability was patched on September 11, 2026, and no customer action is required as Google manages remediation for this cloud service.
CVE-2026-61627 is a high-severity vulnerability in libass, a subtitle renderer for ASS/SSA formats. Versions prior to 0.17.5 contain an out-of-bounds read and write in the wrap_lines_measure function when processing specially crafted subtitle content. This flaw can cause denial of service due to memory corruption. The issue is fixed in libass version 0.17.5.
CVE-2026-61626 is a high-severity out-of-bounds write vulnerability in libass versions 0.17.4 up to but not including 0.17.5. It arises from insufficient validation of negative Matroska ReadOrder values during event pruning, potentially allowing an attacker to clear bits near a NULL pointer. Exploitation requires a malicious Matroska stream processed with enabled read-order checking and explicit event pruning. The vulnerability is fixed in libass version 0.17.5.
CVE-2026-61739 is an improper authentication vulnerability in socfortress CoPilot versions prior to 0.1.77. The issue involves missing role and tenant authorization checks in Velociraptor Sigma exclusion-management endpoints, allowing attackers to create suppression rules without valid credentials. Low-privilege users can enumerate, modify, disable, or delete exclusion rules, potentially suppressing detections across all tenants. The vulnerability is fixed in version 0.1.77.
CVE-2026-116860 is a missing authorization vulnerability in Arraytics Timetics versions up to 1.0.65. This flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 1.0.66.
This report summarizes multiple cybersecurity incidents and vulnerabilities including a critical 16-year-old buffer overflow in UEFI firmware affecting most servers worldwide, a disputed AI-led intrusion at Anthropic, data breaches at the University of Copenhagen and ENGIE, and a Cloudflare AI data leak. The UEFI flaw allows local network attackers to execute code at high privilege during network boot. Anthropic disputes the scope of an AI-driven intrusion by a startup. The University of Copenhagen breach exposed personal and national ID data of over 500,000 individuals. Cloudflare fixed a cross-tenant data leak in its AI inference platform caused by a cache size mismatch and a bug in the inference engine. Other incidents include suspected Iranian cyberattacks on military freezers and attempts to breach the US Federal Election Commission systems.
CVE-2026-119370 is a stored cross-site scripting (XSS) vulnerability in The Events Calendar plugin by Liquid Web / StellarWP. It affects versions from initial releases up to 6.18.2. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to execute malicious scripts in the context of other users. A fix is available in version 6.18.3.
CVE-2026-65444 is a stored cross-site scripting (XSS) vulnerability in the Blocksy Companion plugin by Creative Themes. It affects versions from initial releases up to 2.1.60. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker with low privileges and user interaction to execute malicious scripts. A fix is available in version 2.1.61.
CVE-2026-61738 is a critical path traversal vulnerability in socfortress CoPilot versions prior to 0.1.77. The issue occurs in the POST /api/scoutsuite/generate-gcp-report endpoint, where user-supplied filenames from multipart uploads are used without proper sanitization or path containment checks. This allows an attacker with admin or analyst privileges to write files outside the intended directory, potentially overwriting application source files. The vulnerability was fixed in version 0.1.77 by removing caller-controlled filenames from the affected route.
ng-antd-admin versions prior to 22.0 contain a hardcoded default JWT secret key, which allows attackers to forge tokens if the default secret is not replaced. This vulnerability enables bypassing authentication and authorization, impersonation of any user including administrators, and unauthorized access to protected API endpoints. Version 22.0 addresses this issue by rejecting the default secret in production environments and issuing warnings in non-production environments.
Chamilo LMS versions before 1.11.40 and from 2.0.0-alpha.1 up to but not including 2.0.1 contain multiple eval() calls in the PEAR HTML_QuickForm libraries that can lead to arbitrary PHP code execution if attacker-controlled data influences form element names. Standard Chamilo forms use hardcoded element names, so exploitation requires a developer-specific plugin or misconfiguration allowing user input to reach these element names. Successful exploitation can result in full server compromise. The vulnerability is fixed in versions 1.11.40 and 2.0.1.
Chamilo LMS versions prior to 2.0.1 contain a Cross-Site Request Forgery (CSRF) vulnerability in several actions within the skill.ajax.php script. These actions perform database changes without proper CSRF token validation, allowing an attacker to trick an authenticated administrator or DRH into executing unauthorized modifications to skill records, profiles, or skill-gradebook associations. The vulnerability is fixed in version 2.0.1.
Chamilo LMS versions prior to 2.0.1 contain a deserialization vulnerability in the handling of user_career.extra_data. The application unsafely calls PHP's unserialize() without restricting allowed classes, enabling attackers who can write crafted serialized objects to execute arbitrary OS commands as the web server user. This vulnerability is fixed in version 2.0.1.
Chamilo LMS versions 2.0.0 up to but not including 2.0.1 contain a stored cross-site scripting (XSS) vulnerability in the user profile page. The vulnerability arises because six user-editable profile fields are rendered without proper server-side sanitization, allowing a user with the ROLE_STUDENT role to inject malicious HTML. This malicious content executes in the browsers of visitors viewing the profile, including administrators, potentially enabling account takeover through session or token theft. The issue is fixed in version 2.0.1.
CVE-2026-61730 is a critical vulnerability in SOCFortress CoPilot versions prior to 0.1.77. It allows unauthenticated access to sensitive ScoutSuite security reports and, during GCP scans, exposes Google service-account JSON keys before they are deleted. This exposure can lead to unauthorized access to cloud permissions and detailed cloud security findings. The vulnerability is fixed in version 0.1.77.
CVE-2026-61729 is a critical vulnerability in socfortress CoPilot versions prior to 0.1.76. It involves missing authentication for critical webhook functions due to a publicly hardcoded fallback header value used for authentication. This allows an anonymous attacker to bypass JWT authentication and invoke sensitive API endpoints that can execute commands on Wazuh managers and submit forged alerts, potentially disrupting endpoint defenses and manipulating alert data. The issue is fixed in version 0.1.76.
CVE-2026-61728 is a critical stored cross-site scripting (XSS) vulnerability in socfortress CoPilot versions prior to 0.1.76. It allows authenticated portal users to inject malicious scripts via incident comments and other fields, which are rendered without proper sanitization. Exploitation can lead to theft of authentication tokens, enabling persistent privileged account takeover, cross-tenant data access, and manipulation of incidents. The vulnerability is fixed starting from version 0.1.76.
CVE-2026-111487 is an out-of-bounds write vulnerability in the Qt Framework's assimp scene import plugin within the Qt3D module. It affects multiple versions of Qt Framework starting from 6.5.0 up to but not including 6.8.10, 6.9.0 up to but not including 6.11.3, and 6.12.0 up to but not including 6.12.1. The vulnerability has a medium severity score of 4.3 and does not have known exploits in the wild. Fixed versions are available.
ManageEngine SharePoint Manager Plus versions from 450 up to but not including 4507 contain an improper access control vulnerability in the multi-factor authentication (MFA) functionality. A low-privileged authenticated user can bypass authorization checks to read and modify MFA settings, enable or disable MFA, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Exploitation could weaken authentication protections or cause denial of service by misconfiguring MFA, potentially locking out legitimate users. This vulnerability is fixed in build 4507.
CVE-2026-61708 is an improper access control vulnerability in SOCFortress CoPilot versions prior to 0.1.76. It allows low-privilege customer users to upload files to arbitrary buckets and object names without restrictions, enabling overwriting of cross-tenant data such as endpoint telemetry, case evidence, and report templates. This can lead to tampering with forensic artifacts, poisoning of report templates potentially leading to code execution, and denial of service by exhausting storage. The issue is fixed in version 0.1.76.