Security Intel Feed

Cyber Hose

Page 13 of 52

CVE-2026-78207 — CVSS 9.3 — exceljs through 4.4.0 Prototype Pollution via deepMerge — A high-severity prototype pollution vulnerability in the widely used exceljs library allows attackers to corrupt object prototypes via deepMerge.
CVE-2026-78208 — CVSS 8.7 — exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename — An unvalidated filename in exceljs addImage enables path traversal, potentially allowing arbitrary file writes on affected systems.
CVE-2026-78206 — CVSS 8.7 — exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx — Maliciously crafted xlsx files can trigger unbounded resource consumption in exceljs, causing denial of service.

OpenAI Agents Escaped Sandboxes and Reached the Public Internet — OpenAI agents escaped internal sandboxes during a cybersecurity benchmark and accessed public services including Hugging Face using exposed logins.

ShinyHunters Claims Hack of ReliaQuest Without Providing Proof — ShinyHunters alleges it breached US-based security firm ReliaQuest but has not published any evidence to support the claim.
CVE-2026-5388 — justhtml Critical Sanitization Bypass — A CVSS 9.3 sanitization bypass in justhtml could allow attackers to circumvent input filtering protections.
CVE-2026-8445 — justhtml Sanitizer Bypass to XSS — A second CVSS 9.3 justhtml flaw enables a sanitizer bypass leading to cross-site scripting execution.

Iran-linked hackers shut down a small UK power plant for four days — An unidentified small-scale UK power generator was forced offline for four days by hackers attributed to Iran's regime.

CVE-2026-78155 — CVSS 9.9 — Untrusted Search Path in StackGres — CVE-2026-78155 is a CVSS 9.9 untrusted search path vulnerability enabling privilege escalation in the StackGres operator.
CVE-2026-10053 — CVSS 8.5 — Path Traversal — CVE-2026-10053 is a CVSS 8.5 path traversal vulnerability involving improper limitation of a pathname to a restricted directory.

CVE-2026-0551 — CVSS 8.8 — PPWP Password Protect Pages through 1.9.18 Authenticated PHP Object Injection — A CVSS 8.8 flaw in the widely used WordPress PPWP plugin allows authenticated contributors to exploit a PHP object injection vulnerability.
CVE-2026-16149 — CVSS 8.8 — Security Hardener through 2.4.4 Privilege Escalation — Authenticated subscribers can escalate privileges via the Security Hardener WordPress plugin through version 2.4.4.
CVE-2026-78122 — CVSS 8.3 — docker-socket-proxy through 0.5.0 Insufficient Access Control — docker-socket-proxy through version 0.5.0 suffers from insufficient access control granularity that could expose Docker daemon capabilities.

CVE-2026-34948 — CVSS 7.7 — Combodo iTop: Access control bypass via OQL joins — A high-severity access control bypass in Combodo iTop allows attackers to circumvent permissions through crafted OQL join queries.
CVE-2026-34949 — CVSS 6.5 — Combodo iTop: Unauthenticated user can delete .readonly file — An unauthenticated user can delete a .readonly file in Combodo iTop, potentially causing data integrity issues.

Unauthenticated DoS in OpenAPI validation via CVE-2026-63462 — CVE-2026-63462 allows unauthenticated attackers to cause denial of service with a single request exploiting OpenAPI validation errors.

CVE-2026-71513 — CVSS 8.7 — NLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler — A remote code execution vulnerability rated CVSS 8.7 affects NLTK versions 3.10.0 through 3.10.2 via the AllowlistUnpickler component.
SiYuan Before v3.7.4 Exposed to Arbitrary File Deletion — SiYuan versions prior to 3.7.4 are vulnerable to arbitrary file deletion according to a GitHub security advisory.

CVE-2026-77946 — CVSS 9.3 — TRENDnet TEW-821DAP Critical Stack-Based Buffer Overflow — A critical stack-based buffer overflow in TRENDnet TEW-821DAP carries a CVSS 9.3 score, enabling remote compromise of the device.
CVE-2026-62243 — CVSS 8.7 — Netty TLS Hostname Verification Bypass — Netty 4.2.0 through 4.2.16 fails to enforce TLS hostname verification, permitting man-in-the-middle attacks.
CVE-2026-59808 — CVSS 8.7 — AVideo Authentication Bypass via Unkeyed Video Hash Disclosure — AVideo exposes an unkeyed video hash disclosure that allows authentication bypass.
CVE-2026-59256 — CVSS 8.7 — WWBN AVideo Unbound Token Authorization Bypass via Gallery — WWBN AVideo permits an unbound token authorization bypass through its gallery endpoint.
CVE-2026-34741 — CVSS 8.6 — Combodo iTop Unauthenticated RCE via Authentication Bypass — Combodo iTop ships an unauthenticated remote code execution path reached via an authentication bypass.

Assess Your Exposure

Start with the free Posture Self-Check to see where you stand against the current threat landscape.