Threat briefs

The follow-redirects package (versions 1.16.0 - 1.16.1) fails to identify sensitive header arrays created in isolated JavaScript realms, leading to the accidental forwarding of sensitive credentials to attacker-controlled redirect destinations.

Prior to version 1.4.1, node-forge incorrectly parses deprecated certificate extensions, potentially allowing a certificate to be accepted as a CA and enabling impersonation.

The pyasn1 library is vulnerable to a denial-of-service attack due to inefficient handling of tag ID collisions during schemaless container decoding, allowing attackers to force quadratic CPU exhaustion.

The joi JavaScript validation library is vulnerable to a Regular Expression Denial of Service (ReDoS) attack when processing inputs via the email() rule with the multiple option enabled.

A coordinated wave of attacks against at least nine AI developer platforms has enabled mass LLMJacking, where stolen API keys are abused for large-scale inference traffic and resold via illicit markets.

Tailscale versions prior to 1.104.4 contain multiple vulnerabilities in SSH socket forwarding and service handling that could allow authenticated users to escalate privileges to root on targeted nodes.

Mail Mint versions 1.31.0 and earlier contain an unauthenticated PHP object injection vulnerability in the REST API endpoint /mint-form-submit that allows remote attackers to trigger arbitrary object instantiation.

CallBackery versions prior to 0.60.1 allow unauthenticated remote attackers to read arbitrary file contents via path traversal in the /doc route.

An authenticated instructor-level user can exploit a Zip Slip vulnerability in MarkUs assignment configuration uploads to write arbitrary files and achieve remote code execution.

An unauthenticated credential disclosure vulnerability in various DVR devices allows attackers to retrieve administrative credentials via the /device.rsp endpoint.

An unauthenticated file upload vulnerability in the Checkout Files Upload for WooCommerce plugin allows remote attackers to execute arbitrary PHP code due to improper file type validation and exposed AJAX handlers.

An authentication bypass vulnerability in the ASUSWRT infosvr daemon allows unauthenticated remote attackers to execute arbitrary system commands with root privileges via UDP port 9999.

Puwell IP cameras (firmware 2.x - 4.x) contain an unauthenticated remote code execution vulnerability in a DebugShell interface on TCP port 34567, which is currently being targeted by botnets.

Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string.

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames.

An unauthenticated stack-based buffer overflow in Thales Sentinel Keys Server allows remote attackers to achieve code execution with SYSTEM privileges by sending a maliciously crafted HTTP request.

The Innovative Form Builder - IvyForms plugin for WordPress contains an arbitrary file upload vulnerability via the filterFiletypeAndExt function.

An authenticated, low-privileged user can trigger a stack-based buffer overflow in the RouterOS mtget binary via a crafted TFTP fetch request to gain persistent administrative privileges.

XenForo versions prior to 2.3.13 contain an authorization bypass vulnerability (CVE-2026-73318) allowing low-privileged administrative users to trigger site-wide user re-agreement workflows.

LeafPad / Leaf Note v1.21 (versionCode 21) contains an insecure permissions vulnerability that allows unauthorized attackers to arbitrarily read another user's note data.

MONAI versions 1.6.0 before 1.6.1 contain a remote code execution vulnerability in Auto3DSeg's algo_from_json() function.

An unauthenticated access bypass vulnerability in the Drupal Commerce Core module is being actively exploited in the wild, leading to potential financial impact on affected e-commerce platforms.

Multiple vulnerabilities in MongoDB Database Tools, Java Driver, and Laravel MongoDB may lead to data integrity compromise, SQL injection, and security policy bypass.

Roundup of Microsoft security advisories published in October 2026.

A SQL injection vulnerability in the Trilogy library (versions prior to 2.13.2) allows unauthenticated attackers to execute arbitrary SQL via improperly escaped multibyte strings.

A vulnerability has been discovered in GitLab products that allows an attacker to cause a security policy bypass.

Multiple vulnerabilities in Veeam Management Pack for Microsoft System Center allow remote attackers to achieve arbitrary code execution on affected systems.

Google has released security updates for Chrome addressing a large number of vulnerabilities affecting Linux, Windows, and macOS installations.

Multiple vulnerabilities in Apple Xcode versions prior to 27.2 could allow an attacker to compromise data confidentiality.

A SQL injection vulnerability in Django allows unauthenticated attackers to execute arbitrary SQL commands via insufficiently validated column aliases in FilteredRelation features.