Threat briefs

A vulnerability in SourceCodester Human Resource Management System 1.0 allows remote attackers to bypass authentication through input manipulation in the session_start function.

An authentication bypass vulnerability in the Online-Examination-System Session Handler allows remote attackers to gain unauthorized access via incorrect comparison of session cookies.

SourceCodester Performance Indicator System 1.0 contains an unauthenticated SQL injection vulnerability via the prodcategory parameter, allowing remote attackers to execute arbitrary SQL queries.

A vulnerability in the D-Link DCS-930L Emergency HTTP Recovery Server allows remote attackers to bypass cryptographic firmware verification through manipulation of the firmware update argument.

GitLab released security updates for 24 vulnerabilities, including a critical unauthenticated RCE via integer overflow (CVE-2026-97229) in the CI/CD regular expression compiler.

CVE-2025-9267 is a DLL hijacking vulnerability in Seagate Toolkit installer versions prior to 2.35.0.6, allowing local attackers to achieve SYSTEM-level privilege escalation.

An integer overflow in the OpenS100 S-102 parser allows remote attackers to trigger heap-based buffer overflows and potential arbitrary code execution via malicious HDF5 metadata.

Roundup of SAP security advisories published in October 2026.

IBM DataStage in Cloud Pak for Data 5.4.0.0 contains a vulnerability (CVE-2026-82103) allowing a remote authenticated attacker to access sensitive information.

IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 are vulnerable to a denial of service attack due to uncontrolled resource consumption, allowing remote unauthenticated attackers to disrupt service availability.

IBM Planning Analytics versions 2.0 and 2.1 are vulnerable to an improper functional level access control flaw, enabling remote authenticated attackers to delete folders and applications belonging to other users.

Frappe ERPNext versions before 14.92.1 and 15.x before 15.83.0 are susceptible to reflected XSS, allowing unauthenticated attackers to execute arbitrary JavaScript in authenticated sessions.

Open WebUI versions 0.7.0 through 0.11.3 contain a cross-origin message handling vulnerability that allows unauthenticated websites to steal a user's session JWT via a crafted postMessage payload.

IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 contain a path traversal vulnerability during archive extraction that allows remote authenticated attackers to execute arbitrary code.

Frappe versions 14.x and 15.x contain a privilege management vulnerability allowing authenticated Website Users to escalate to System Manager privileges via document action manipulation.

The cbor-sync library through version 1.0.4 is vulnerable to resource exhaustion via a crafted CBOR payload that causes uncontrolled iteration, leading to potential denial of service.

IBM has released security patches addressing multiple vulnerabilities across DataStage on Cloud Pak for Data, Guardium Data Protection, and IBM i, including an incorrect permission assignment in the IBM i Network Authentication Service (CVE-2026-84414).

Attackers achieve persistence and privilege escalation by modifying the Print Monitors registry key to force the system to load an arbitrary malicious DLL under SYSTEM privileges.

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 contain a configuration parsing vulnerability that allows authenticated attackers to cause memory corruption and boot stack crashes.

IBM Maximo Application Suite IoT Component versions 9.0.0, 9.1.0, and 9.2.0 are susceptible to a remote denial of service vulnerability triggered by an infinite parsing loop.

An authentication flaw in the Netherman Portal del Hermano password-recovery flow allows attackers to perform account takeovers by exploiting rate-limit gaps and error-message oracles.

IBM Maximo Application Suite Location Service for Esri Component versions 9.0, 9.1, and 9.2 are vulnerable to improper access control due to a schema-less Custom Resource Definition, potentially allowing unauthorized access.

CVE-2026-109569 is a container escape vulnerability in sandboxed.sh versions up to 1.3.0, allowing containerized code to bypass isolation and access the host filesystem via misconfigured nsenter calls.

Shaark versions 1.2.13 through 1.2.44 contain a missing authorization vulnerability in multiple API controllers, allowing authenticated non-admin users to modify or delete content belonging to other users.

Rapyd Admin versions 9.0.0 through 9.19.x contain a hard-coded credential vulnerability that allows remote unauthenticated attackers to gain global super-admin access.

Continue CLI versions up to 1.5.47 are vulnerable to a command injection flaw that allows attackers to execute arbitrary commands by chaining them after permitted shell commands.

EdgeEver Desktop versions 1.92.0 through 1.112.0 contain a remote code execution vulnerability in the desktop:acp-probe IPC handler that allows arbitrary command execution via an insecure probeAcpAdapter function.

EdgeEver versions 1.112.0 and earlier contain a stored XSS vulnerability in the setMemoDragPreview function that allows for session token theft via malicious notebook or memo titles.

Telegram-Stremio versions 5.1.0 and earlier store Telegram session strings using a reversible encoding transform, enabling attackers with database or log access to perform full account takeover.

The modern-tar library versions 0.3.5 through 0.8.5 are susceptible to a memory exhaustion denial-of-service vulnerability triggered by crafted, compressed archives.