Threat briefs

NVIDIA PhysX for all platforms contains an out-of-bounds write vulnerability that could lead to code execution, data tampering, denial of service, or information disclosure.

An authentication and authorization bypass vulnerability in @fastify/express versions 4.0.5 through 4.0.8 occurs when the non-default ignoreDuplicateSlashes option is enabled, allowing attackers to access restricted handlers by misaligning path normalization between Fastify and Express middleware.

Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis versions before 4.8 contain an observable response discrepancy vulnerability that allows account footprinting.

The Advanced Views - Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting via the comment parameter, allowing arbitrary script execution on pages containing affected layout blocks.

The svg-sanitizer library, versions 0.5.3 through 1.0.x, contains a denial-of-service vulnerability in the Sanitizer::sanitize method that allows unauthenticated attackers to exhaust CPU resources via crafted SVG files.

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin, allowing an attacker to trigger unauthorized administrative actions.

REDAXO core versions 5.3.0 through 5.21.3 contain an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge administrative login tokens and achieve code execution.

A heap-based buffer overflow vulnerability has been identified in multiple Hitachi JP1 products.

A missing authentication vulnerability in Hitachi HiRDB Server allows unauthenticated actors to access critical database functions, warranting immediate patching.

The Qode Membership WordPress plugin is vulnerable to authentication bypass via a typographic error in the Facebook OAuth token verification guard, allowing unauthenticated account takeover.

A critical unauthenticated remote code execution vulnerability in SPIP, involving the X-Spip-Filtre header, has available public proof-of-concept exploits, presenting a high risk for unpatched web servers.

A public proof-of-concept exploit for CVE-2021-31166, a use-after-free vulnerability in the Windows http.sys driver, demonstrates remote code execution via a malformed Accept-Encoding header.

An authenticated attacker can exploit a stored Cross-Site Scripting vulnerability in Tribalsystems Zenario CMS version 9.4.59197 by injecting malicious JavaScript via the Page Layout administration feature.

An unauthenticated remote attacker can exploit CVE-2026-93328 in Google Cloud MCP Toolbox for Databases to perform arbitrary file exfiltration or local file overwriting due to insufficient path validation.

The Analytics Insights - Google Analytics Dashboard for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping.

Transmission versions prior to 4.1.3 contain a permissive CORS vulnerability in the RPC server that allows unauthorized origins to capture the X-Transmission-Session-Id token and execute arbitrary RPC commands.

Esri ArcGIS Server versions 12.0 and prior contain a denial of service vulnerability that may allow a remote, unauthenticated attacker to exhaust worker threads.

The School Fees Management System version 1.0 is vulnerable to stored cross-site scripting (XSS) via the tname parameter in the new_term administrative component.

A stored Cross-Site Scripting (XSS) vulnerability exists in the Computer Laboratory Management System 1.0. The vulnerability allows remote attackers to inject arbitrary web scripts or HTML via the 'name' and 'shortname' parameters in the '/admin/?page=system_info' endpoint.

Craft CMS has released security updates for multiple products to address vulnerabilities in the core CMS platform and the Commerce-mollie plugin.

Another Redis Desktop Manager versions up to 1.6.6 are vulnerable to remote code execution via XSS in the font_faq setting field due to unsafe v-html usage and enabled nodeIntegration in its Electron configuration.

An authorization bypass vulnerability in Simple Machines Forum 3.0 allows authenticated users to access other members profile settings, presenting an account takeover risk via unauthorized password changes.

Roundup of Apple security advisories published in October 2026.

An authorization bypass vulnerability in the Admin Interface of code-projects Simple Content Management System 1.0 allows remote attackers to manipulate the addnews argument to perform unauthorized actions.

Tencent RapidJSON versions up to 1.1.0 contain an out-of-bounds read vulnerability in the GenericStringStream function within the Regex Parser component.

OpenPanel versions prior to 3.0.0 contain an SQL injection vulnerability in the profile.values endpoint that allows authenticated attackers to bypass cross-tenant controls and exfiltrate data from other projects.

Kener versions 3.0.0 through 4.1.9 contain an authentication bypass vulnerability allowing attackers to forge administrative session tokens using a hardcoded fallback secret.

The libiec61850 library v1.6 fails to sufficiently reject replayed or outdated GOOSE messages, which can cause subscribers to update state or trigger callbacks with stale data.

A server-side request forgery vulnerability in Zylon PrivateGPT versions 1.0.0 and 1.0.1 allows remote attackers to perform unauthorized requests via the URI Artifact Loader component.

Onyx Craft versions through 5.0.0 contain a stored Cross-Site Scripting vulnerability in the output preview panel caused by insecure iframe sandbox configuration, allowing malicious preview content to access the parent document DOM.