Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involving out-of-memory corruption during multipart/form-data parsing via session.upload_progress, were leaked before their scheduled patch date. These vulnerabilities have a CVSS v4.0 score of 9.2 but no confirmed successful exploitation in the wild as of October 21, 2026. Scanning activity began shortly after the patch release, linked to a Mirai-style IoT botnet targeting platforms like WooCommerce, WHMCS, and Magento. Despite exposure of over 683,000 IPs running vulnerable PHP versions, technical challenges such as address-space randomization limited reliable exploitation. No official patch information is provided in the data. The threat is currently categorized as a campaign involving php2shell tooling staged across multiple attacker workspaces.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2.
In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate.
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 6.0.0.2.
CVE-2026-92172 is a high-severity vulnerability in Meta Horizon OS prior to version 66.0.0.733.524. The flaw involves improper restriction of communication channels, allowing an application to receive a privileged PendingIntent with a com.oculus.horizon CallerIdentity via a broadcast receiver. This enables the application to impersonate the com.oculus.horizon package to any endpoint within the OS that relies on CallerIdentity authentication.
CVE-2026-92173 is a critical vulnerability in Meta Horizon OS prior to version 74.0.0.878.1682. It involves improper restriction of communication channels, allowing an arbitrary application with NotificationListenerService to receive a privileged PendingIntent containing a CallerIdentity from com.oculus.vrshell. This enables impersonation of the com.oculus.vrshell package and other packages signed with the same key for authentication within the OS.
CVE-2026-84894 is a use-after-free vulnerability in Meta Platforms, Inc's moxygen component. The issue occurs before commit 004123dd24c3, where MoQSession::dataStreamReadLoop continues to use a stream read handle after receiving a FIN signal, which invalidates the handle under proxygen's WebTransport API. A remote attacker can trigger this by opening a data stream with an unknown track alias and sending the FIN in the same write. This vulnerability has a high severity with a CVSS score of 7.5 and impacts confidentiality but not integrity or availability.
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.
The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form's target object_id from the GET parameter 'rwmb_frontend_field_object_id' without any authorization check, and Form::process() lacks the user_can_edit() check present in render(), allowing unauthenticated attackers to overwrite the post_content of any page with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then directly trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode with no role validation. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator. The standalone plugins Meta Box Frontend Submission (in versions up to 4.5.6) and Meta Box User Profile (versions up to 3.11.0) are also affected.
Metaphor Creations Ditty versions before 3.1.70 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users with Author-level privileges or higher can inject arbitrary HTML elements via malicious wrapper attribute values in layout tags. This occurs because the function ditty_layout_render_tag_wrapper() inserts user-supplied values directly as HTML element names without allowlist validation. The sanitization function wp_kses_post() is bypassed since it runs at save time, but the malicious attributes are resolved at render time, enabling execution of the payload in visitors' browsers.
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity.
ExploitedKEVEPSS 97%Check Point ResearchCVE-2026-72898
The threat intelligence report from September 14, 2026, details multiple cyber incidents including data breaches, vulnerabilities, and AI-related threats. Notably, a data breach at Mathspace was caused by exploitation of CVE-2026-72898, a SQL injection vulnerability in the self-hosted Metabase tool, exposing user names, emails, usernames, and locations. Other significant vulnerabilities include Microsoft’s Patch Tuesday addressing 974 flaws including privilege escalation zero-days, and GitLab’s critical path traversal vulnerability CVE-2026-85706 allowing unauthenticated arbitrary file reads. MikroTik RouterOS vulnerabilities enabling passwordless SSH and privilege escalation were also fixed. The report includes AI threats involving prompt evasion and sandbox escapes. Check Point IPS provides protections for several mentioned vulnerabilities. The report does not specify affected versions for CVE-2026-72898. No CVSS score is provided for this vulnerability.
CVE-2026-81274 is a medium severity vulnerability in metaphorcreations Ditty versions up to and including 3.1.67. It involves missing authorization controls, specifically a broken access control issue classified under CWE-862. This flaw allows unauthorized users to perform actions that should require proper authorization, potentially leading to integrity impacts. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.
OpenMetadata versions prior to 2.0.0 contain an open redirect vulnerability where the application accepts a user-supplied post-authentication redirect URL without validation. This allows an attacker to craft a URL that redirects users to an attacker-controlled site along with a valid JWT token tied to the user's account. Version 2.0.0 removes this vulnerable callback parameter, mitigating the issue.
The Post Duplicator WordPress plugin up to version 3.0.11 has a missing authorization vulnerability. The duplicate_post() function does not verify that the user has the 'edit_others_posts' capability before allowing duplication of posts with a specified author. This allows authenticated users with Contributor-level access or higher to create duplicated posts attributed to any user, including administrators.
The Post Duplicator plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 3.0.11. The flaw allows authenticated users with Contributor-level access or higher to duplicate posts with future or private status, bypassing editorial review. The REST endpoint also ignores administrator-configured restrictions on which post types can be duplicated.
