The internet is broken right now.

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a path traversal vulnerability.

Disclosure IBM Api Connect

Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.

Other OS & kernel

OS Command Injection Vulnerability in Hitachi Dynamic Link Manager for VMware. This issue affects Hitachi Dynamic Link Manager for VMware: from 8.7.3-00 before 9.0.4-01.

Injection

In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection

Code execution Server

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution.

Injection

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

Injection

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1.

Disclosure Library Ronf Asyncssh

Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

Disclosure

A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument langType results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Memory safety

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

XSS Server

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network.

Memory safety OS & kernel

Stack-based buffer overflow in Windows Client for NFS allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.

Other OS & kernel

Untrusted pointer dereference in Windows NTFS allows an unauthorized attacker to execute code over a network.

Other OS & kernel

Heap-based buffer overflow in Windows Storage allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7_wpcf7_mail_components function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the PDF Generator addon to be active and an administrator-configured PDF body template to be enabled for the targeted contact form.

Disclosure Web app

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.

Disclosure

INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.

Auth & access

Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel

Use after free in Windows Hyper-V allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel

Release of invalid pointer or reference in Windows DHCP Server allows an authorized attacker to execute code over a network.

Other OS & kernel

Exposure of sensitive system information to an unauthorized control sphere in Windows DHCP Server allows an unauthorized attacker to disclose information over a network.

Disclosure OS & kernel

Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. Prior to 8.1.4.1 and 8.0.5.2, when constant lookup raises LoadError, ActiveSupport::Inflector#safe_constantize (and String#safe_constantize) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests could keep the application unavailable. Action Cable passes the channel value of each subscribe command to safe_constantize before any channel lookup, so an unauthenticated client can reach this code when the application mounts Action Cable and accepts connections from untrusted clients without an added authentication check. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

Injection Web app

Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information locally.

Injection Web app

Use of uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network.

Memory safety

Out-of-bounds read in Graphic Fonts allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Insufficiently protected credentials in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.

Auth & access Library

Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally.

Auth & access OS & kernel

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.

Injection Server

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Memory safety Server

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Memory safety Server

Improper input validation in Windows Message Queuing allows an authorized attacker to deny service over a network.

Memory safety OS & kernel

Improper access control in Windows FileCrypt Driver allows an authorized attacker to bypass a security feature over a network.

Other OS & kernel

Out-of-bounds read in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.

Memory safety OS & kernel

Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker to disclose information over a network.

Disclosure OS & kernel

Heap-based buffer overflow in Windows Performance Counters allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Other

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

Memory safety Server

Missing authorization in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

Auth & access

Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries.

Injection Network gear

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.

Denial of service Network gear

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

XSS Server

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.

Injection OS & kernel

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.

Code execution Library IBM Api Connect