Trending Vulnerabilities

PwnEscape is a Linux kernel IPv4 checksum-validation vulnerability that can undermine guest-to-host isolation. Insufficient validation of CHECKSUM_PARTIAL metadata allows skb_checksum_help() to overwrite an already-validated IPv4 header during deferred checksum completion. Guest-influenced skb->csum_start and skb->csum_offset values can direct this write into header fields trusted by earlier parsing, routing, and policy decisions. In the demonstrated disclosure path, checksum completion changes the interpreted IPv4 header length from 20 to 60 bytes; subsequent fragmentation copies beyond the packet's valid linear data, exposing 32 bytes of host memory. This is a deterministic validation/use inconsistency, not a concurrency-dependent race. The vulnerable code dates to Linux 2.6.27 and resides in host networking rather than a specific hypervisor.

CVE-2026-106931 is an OS command injection vulnerability in the default-enabled statistics function of SiteGuard Server Edition, a host-based web application firewall. Exploitation can execute arbitrary OS commands with root or SYSTEM privileges. Affected Apache httpd, Nginx, and IIS editions on platforms other than FreeBSD include versions 2.20 through versions preceding 8.00 Update 5, except IIS versions 3.10 through 4.00 Update 4, which are unaffected. FreeBSD editions for Apache httpd and Nginx are affected from version 2.20 through versions preceding 7.00 Update 6. Exploitation in the wild has been confirmed.

CVE-2026-102764 is an authentication-bypass vulnerability in BeyondTrust Remote Support versions through 26.2.3. Internal messaging components inadequately validate the origin of received messages, allowing a remote, unauthenticated attacker to perform unauthorized file operations, including file uploads and modifications, without user interaction. The vulnerability has a CVSS v4.0 score of 9.3. Exploitation attributed to ARMORY CASTLE, previously tracked as UNC5221, began on August 29, 2026. Observed attackers used the file-operation capability to deploy the SAWFLY webshell and subsequently obtain root-level control; the vulnerability itself does not directly grant root privileges.

CVE-2026-112005 is a remotely exploitable path traversal vulnerability in Clidey WhoDB versions 0.104.0 through versions before 0.135.0. Attackers can connect to a DuckDB file without credentials and invoke DuckDB filesystem operations through the query editor. Functions and statements including read_text, read_blob, COPY ... TO, and ATTACH permit arbitrary host file reads and writes, potentially exposing session-signing secrets and stored database credentials or allowing file overwrites.

CVE-2026-108097 is a critical remote code execution vulnerability in Drupal core's Field UI module. During table pre-render processing, FieldUiTable invokes the PHP callable specified by a row's #region_callback property through call_user_func_array without validating the callable, passing the row array as its sole argument. Contributed modules or custom code that allow attacker-controlled row data can expose this behavior, bypassing Drupal's render-callback trust protections. Drupal core alone does not expose an exploitable input path. Multiple contributed-module exploitation paths are known, including at least one requiring no authentication. Fixed releases replace dynamic callback execution with declared region selection.

CVE-2026-109894 is an SQL injection vulnerability in the Arraytics Booktics WordPress plugin affecting versions through 1.0.29; the earliest affected version is unspecified. Improper neutralization of special elements in SQL commands allows attackers to manipulate database queries. The vulnerable function and input parameter have not been identified. The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L characterizes exploitation as network-accessible and low-complexity, requiring neither authentication nor user interaction.

Vanus versions 0.8.0 through 0.9.0 contain a hardcoded default administrative token that allows remote attackers without legitimate credentials to obtain cluster-admin access. Supplying the fixed Bearer token to the gateway gRPC proxy port grants access to administrative operations for namespaces, eventbuses, users, tokens, and role bindings, as well as event reading and publishing.

CVE-2026-112021 is a heap-based buffer overflow in the _xs_json_load_lexer() JSON parsing function in snac2 versions before 2.93. An unauthenticated remote attacker can trigger the vulnerability with a single crafted application/activity+json POST containing a JSON string with a \u0000 escape. The activitypub_post_handler() function parses the request before verifying its signature, allowing attacker-controlled input to overflow heap allocations, corrupt heap memory, and crash the server.

CVE-2026-101339 is a stack-based buffer overflow in NLnet Labs NSD's processing of specially formatted HIP resource records in directly supplied zone files. A HIP record whose RDATA reaches or approaches its size limit and contains an additional domain-name field identifying a HIP Rendezvous server can overwrite stack memory with up to 191 bytes of attacker-controlled data. The vulnerability is classified as a remote-code-execution-class stack overwrite. Zone files written by NSD itself, including those for secondary zones, do not use the triggering format. NSD 4.15.3 fixes the vulnerability; the complete affected-version range is not established.

CVE-2026-101337 is a stack-based buffer overflow in NLnet Labs NSD's zone-file base64 RDATA parsing. When base64 data is divided into tokens of three characters or fewer, NSD incorrectly calculates tokens as producing zero decoded bytes and reserves insufficient buffer space. Subsequent decoding can overwrite the stack with up to 64 KB of attacker-controlled data, potentially enabling arbitrary code execution. Exploitation requires a specially formatted zone file supplied directly to NSD; files written by NSD itself, including secondary-zone files, do not use the triggering format.

CVE-2026-101341 is a stack-based buffer overflow in NLnet Labs NSD's zone-file parser. Text tokens shorter than 32 bytes in resource-record data (RDATA), including TXT records, are processed without checking that they remain within the space reserved for RDATA. Specially formatted input permits arbitrarily sized out-of-bounds stack writes, including overwriting a callback function pointer invoked immediately after parsing, potentially enabling arbitrary code execution. Exploitation requires a crafted zone file to be supplied directly to NSD. Zone files written by NSD itself, including those maintained for secondary zones, do not use the triggering format.

CVE-2026-101338 is a stack-based buffer overflow in the NLnet Labs NSD authoritative DNS server's zone-file parser. A specially formatted SVCB or HTTPS resource record can fill the wire-format RDATA buffer to its limit, after which an additional ECH parameter can overwrite the stack. Once the limit is exceeded, the base64 decoder can write attacker-controlled data of unbounded size beyond the buffer. Triggering the vulnerability requires a crafted zone file supplied directly to NSD. Zone files written by NSD itself, including those for secondary zones, do not have the triggering format. The vulnerability is classified as a high-severity, remote-code-execution-class stack overwrite.

Plex Media Server versions before 1.43.3.10861 contain an authenticated server-side request forgery vulnerability in the universal transcoding request handler. An authenticated user can supply a request target that causes the server to initiate outbound requests to arbitrary internal or external addresses.

Plex Media Server before version 1.43.3.10861 improperly neutralizes URL values supplied to the searchOne function. An attacker can manipulate these values to invoke functions in other plugins with attacker-controlled parameters, potentially performing unauthorized plugin actions. This vulnerability is one component of the Plex2Shell exploit chain, which combines four vulnerabilities to achieve unauthenticated code execution.

CVE-2026-108983 is a remotely exploitable command injection vulnerability in the GeoVision GV-ASManager web server, associated with its default connection ports. It has a reported critical CVSS 3.1 base score of 9.8. Affected versions, the vulnerable function, the injection mechanism, and the precise exploitation requirements are not specified.

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 contain missing authorization and insecure-default-policy weaknesses in the HandleStreamPassThrough MCP proxy function and OIDC registration flow. Public discovery exposes OIDC configuration, and registration automatically enrolls holders of valid OIDC tokens without claim filtering or ban checks. The default policy grants authenticated mesh identities wildcard access to services and targets. Together, these weaknesses allow a remote attacker to obtain a mesh credential and invoke arbitrary tools across all connected MCP backend nodes.

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 contain missing authentication and authorization checks in the libp2p HTTP ingress implemented by StartIngressServer. Unlike the MCP protocol stream handler, which enforces WithBiscuitAuth and Authorize checks, the parallel HTTP ingress forwards requests directly to registered backend handlers without verifying Biscuit tokens or mesh enrollment. An unauthenticated remote libp2p peer can consequently bypass capability policies and invoke registered services, including command/stdio-backed MCP servers, A2A services, and inference endpoints. The weakness also constitutes missing authorization, classified as CWE-862.

CVE-2026-110372 is an incorrect privilege assignment vulnerability in Brainstorm Force’s OttoKit WordPress plugin, also known as SureTriggers. It affects versions through 1.1.40, with no lower affected-version boundary specified. The flaw allows privilege escalation. The specific vulnerable function, exploitation mechanism, and resulting privilege level are not documented. The recorded CVSS v3.1 vector indicates network-based exploitation with low complexity, no prior privileges, and no user interaction.

CVE-2026-110886 is an untrusted-data deserialization vulnerability in QuantumCloud's Conversational Forms for ChatBot WordPress plugin affecting versions through 1.5.1. Deserialization of attacker-controlled data allows PHP object injection. The vulnerable function and request endpoint are not identified. The recorded CVSS v3.1 vector indicates unauthenticated network exploitation without user interaction and potentially high confidentiality, integrity, and availability impacts.

CVE-2025-61624 is a path traversal vulnerability in the command-line interpreter of Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. An authenticated attacker with an admin profile and at least read-write permissions can supply specially crafted arguments to existing CLI commands to write or delete arbitrary files outside the intended restricted directory. Affected releases include FortiOS 7.6.0–7.6.4, 7.4.0–7.4.9, and all 7.2, 7.0, and 6.4 releases; FortiPAM 1.7.0 and all 1.0–1.6 releases; FortiProxy 7.6.0–7.6.4, 7.4.0–7.4.11, and all 7.2 and 7.0 releases; and FortiSwitchManager 7.2.0–7.2.7 and 7.0.0–7.0.6. Exploitation through the FortiOS auto-script functionality can cross the restricted administrative interface boundary into the underlying operating system. The vulnerability has been exploited in the wild to deploy the PEERSTITCH implant.

CVE-2026-96951 is a command-injection vulnerability in Windows Shell caused by improper neutralization of special elements used in a command. An unauthenticated remote attacker can bypass Mark of the Web (MOTW) protections by persuading a user to interact with specially crafted content delivered through email, instant messaging, or a website. Affected products include Windows 10, multiple Windows 11 releases, Windows Server editions, and Outlook.com before its service-side correction. Microsoft rates the vulnerability Important, with a CVSS v3.1 base score of 8.8. Exploitation was detected before Microsoft released security updates on October 13, 2026.

CVE-2026-7273 is a stack-based buffer overflow in the CGI program of Zyxel GS1900-series switch firmware. Insufficient bounds checking of attacker-controlled HTTP request data can cause stack memory corruption, potentially allowing an unauthenticated attacker with LAN access to execute operating-system commands. Ten models are affected through their respective 2.90 model-specific firmware builds ending in .1)C0, including GS1900-48HPv2 through 2.90(ABTQ.1)C0. The vulnerability has a CVSS v3.1 score of 8.8 with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and has been actively exploited.

CVE-2026-111999 is a missing authentication vulnerability in the gateway CloudEvents HTTP receiver in Vanus versions 0.8.0 through 0.9.0. The affected event-publishing routes, including the legacy gateway route, bypass token authentication and authPublish authorization checks. Unauthenticated remote attackers can submit forged CloudEvents to any eventbus; these events are stored and delivered to subscription sinks.

CVE-2026-97689 is an unbounded memory allocation vulnerability in the Python HTTP client library urllib3, affecting versions 1.10.3 through versions before 2.8.0. The HTTPResponse.read_chunked() and HTTPResponse.stream() methods buffer the chunk-size field of a chunked HTTP response until a newline or end-of-file without enforcing a length limit. A malicious HTTP server can return a response with Transfer-Encoding: chunked followed by an excessively long, unterminated chunk-size line, causing uncontrolled memory consumption and potentially exhausting the client process. Version 2.8.0 fixes the issue by rejecting chunk-size fields exceeding 65,536 bytes.