Vulnerabilities

XenForo before 2.3.13 contains an unauthenticated authentication bypass (CWE-697) in its OAuth2 token endpoint, rated critical (CVSS 4.0: 9.1). The flaw arises from PHP truthy evaluation: when an attacker submits empty values for the client_secret and code_verifier parameters, the empty strings are treated as false and both client-secret validation and PKCE code-verifier validation are skipped entirely. As a result, an attacker who obtains a valid authorization code (for example by intercepting it during a legitimate redirect) can exchange it for a token pair without proving client identity or honoring the PKCE commitment, gaining access and refresh tokens with the high confidentiality and integrity impact reflected in the CVSS scoring. Only XenForo deployments running versions before 2.3.13 that expose the OAuth2 token endpoint (i.e., act as OAuth2 authorization servers) are affected. No in-the-wild exploitation is documented so far: one public proof-of-concept exists on GitHub, the issue is not in CISA's KEV catalog, and EPSS assigns a 0.5% probability of exploitation within 30 days.

Do: Upgrade to XenForo 2.3.13 or later. Until patched, add a mitigation that rejects empty client_secret and code_verifier values at the OAuth2 token endpoint (e.g., via WAF rule or code patch) and monitor for tokens issued without proper client authentication. Also review OAuth2 client configurations and recently issued tokens, and enforce strict redirect-URI and TLS hygiene, since the bypass matters most when authorization codes can be intercepted.

Libcurl wrongly reuses an HTTP connection that was set up for a hostname using Negotiate authentication when the initial request to that host was made with empty credentials, so a connection already authenticated as one user can be handed to a different user's request (tracked as CWE-488, Exposure of Data Element to Wrong Session). The flaw is triggered when a client first contacts a host over Negotiate (Kerberos/SPNEGO) HTTP authentication with no credentials, and then subsequent requests as different users are sent over that reused, already-authenticated connection. An attacker gains cross-user identity mixups: user B's requests travel over user A's authenticated connection, so data can be disclosed to, or acted on under, the wrong identity, with the CVSS vector rating confidentiality, integrity and availability impact all high and the flaw critical (9.8) with no privileges or user interaction required. Any application or tool that uses libcurl is affected when it performs Negotiate HTTP authentication for multiple users against the same host; this includes the curl command-line tool and the very large ecosystem of operating systems and products that bundle or embed libcurl. No public proof of concept or in-the-wild exploitation is known, it is not in CISA KEV, and EPSS currently estimates a 0.8 percent probability of exploitation within 30 days.

Do: Upgrade curl/libcurl to the fixed release named in the curl project's security advisory, and audit which installed or embedded libcurl builds your estate carries. As mitigations, avoid making Negotiate-authenticated requests with empty credentials, or prevent connection reuse (for example, use fresh connections per user or disable the connection cache) when multiple users authenticate against the same host. Deployments that never use Negotiate/Kerberos HTTP authentication are not practically affected.

libxml2 before 2.15.4 fails to propagate parser flags in the xmlXIncludeProcess and xmlXIncludeProcessTree functions, so options such as XML_PARSE_NONET are not applied during XInclude processing. An application that relies on that flag to block network access, while using a custom resource loader that can reach the internet, can be tricked into fetching attacker-controlled external entities or remote resources. This enables XML external entity (XXE) injection, server-side request forgery (SSRF), and denial of service via deliberately slow attacker-controlled internet resources, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8). Any product that embeds a vulnerable libxml2 and calls the affected XInclude functions is affected, with the xmlsoft project as the maintaining vendor. No public proof-of-concept or confirmed in-the-wild exploitation is known, EPSS is low (0.2% in 30 days), and the issue is not listed in the CISA KEV catalog.

Do: Upgrade libxml2 to 2.15.4 or later, or apply your Linux distribution's backported security patch. Developers whose code calls xmlXIncludeProcess or xmlXIncludeProcessTree should audit whether they rely on XML_PARSE_NONET for network isolation, and mitigate by restricting or hardening custom resource loaders, disabling XInclude on untrusted XML input, and enforcing egress filtering. Remember that bundled or vendored copies of libxml2 inside language bindings and third-party software may need separate updates from the OS package.

multer 2.2.0 leaks a file descriptor each time a multipart upload using diskStorage is aborted or truncated before completion, because the destination write stream is never closed. An unauthenticated network client can trigger this simply by repeatedly starting uploads and interrupting them. Each failed request leaves an open file descriptor and retains its disk blocks until the process exits, so sustained repeated failures can exhaust the process's file descriptor limit and cause a full denial of service (availability impact only). Any Node.js application running multer 2.2.0 with disk storage enabled is affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.3%, so no confirmed exploitation is known; a fixed release (2.3.0) is available and no workarounds are provided.

Do: Upgrade multer to 2.3.0 or later, which closes the write stream on aborted uploads. Inventory your dependency tree (e.g., npm ls multer and lockfiles) to find applications pinned to or resolving to 2.2.0, and prioritize any that use diskStorage on internet-reachable upload endpoints. Since no workarounds exist, as an interim measure monitor file descriptor counts and recycle Node processes that handle high upload-failure volumes until the patch is deployed.

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability (CWE-288, 'using an alternate path or channel') that an unauthenticated remote threat actor can exploit. The flaw is triggerable when the appliance is configured as an AAA virtual server or as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments, allowing the attacker to bypass authentication without valid credentials. A successful bypass could give an attacker access to VPN-protected or AAA-gated resources as an authenticated user; no CVSS score has been published yet. Organizations running affected NetScaler appliances in these configurations are exposed, and affected version ranges are not specified in the available data, so defenders should consult Citrix advisory AL26-019. The flaw was added to CISA's KEV on 2026-09-09, indicating exploitation in the wild; ransomware use is unknown, no public PoC is known, and EPSS assigns a 3.4% probability of exploitation within 30 days (88th percentile).

Do: Prioritize applying vendor fixes or mitigations per Citrix advisory AL26-019 in line with CISA BOD 26-04, focusing first on internet-facing appliances configured as AAA virtual servers or Gateways (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Until patched, restrict internet exposure and review VPN/AAA authentication logs for signs of unauthenticated access, following CISA's Forensics Triage Requirements if compromise is suspected.

Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.

CVE-2026-53362 is an out-of-bounds write (CWE-787) in the Linux kernel's IPv6 output path: __ip6_append_data() mis-accounts fraggap bytes on the paged-allocation branch, leaving the new skb's linear area undersized so the copy of carried-over fragment-gap data spills past skb->end into the trailing skb_shared_info. An unprivileged local user can trigger the corruption by sending over a UDPv6 socket using MSG_MORE combined with MSG_SPLICE_PAGES; the bad accounting was introduced by commit 773ba4fe9104 ('ipv6: avoid partial copy for zc') and became triggerable when commit ce650a166335 allowed the MSG_SPLICE_PAGES case to proceed instead of returning -EINVAL. Successful triggering causes kernel memory corruption that, per the high confidentiality/integrity/availability scores, can lead to loss of data confidentiality, integrity and availability — potentially local privilege escalation or a system crash. Any Linux system running a kernel with the affected code is exposed; the source data provides no specific affected version numbers, only the introducing and trigger commits. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-27, indicating known in-the-wild exploitation (ransomware use unknown), with EPSS at 0.5% and no public PoC known.

Do: Apply the kernel fix per vendor instructions: upgrade to Linux kernel builds containing the fraggap-accounting resolution for __ip6_append_data(), following CISA's BOD 26-04 patching requirements (for cloud services, follow BOD guidance or discontinue use if mitigations are unavailable); no fixed version numbers were provided in the source data, so confirm with your distribution/vendor that the fix commit is included. Until patched, prioritize multi-user hosts and systems where untrusted local users can open UDPv6 sockets, since exploitation requires local unprivileged access with MSG_MORE and MSG_SPLICE_PAGES. Track KEV-required remediation deadlines, as the flaw is cataloged as exploited in the wild (added 2026-08-27).

CVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that applies when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The flaw is reachable over the network without authentication (CVSS 4.0: AV:N/PR:N), so an unauthenticated attacker can trigger it remotely. Successful exploitation causes unpredictable or erroneous appliance behavior and denial of service, and the high confidentiality score suggests possible disclosure of memory contents; some reporting suggests pre-authentication remote code execution may be possible, though the vendor description emphasizes DoS. Organizations running affected NetScaler appliances in a Gateway or AAA role — a very common configuration for remote access to Citrix virtual apps and desktops — are potentially exposed. The flaw was added to CISA's KEV catalog on 2026-08-26 and is reported as exploited in the wild, with headlines noting the flaw was already patched before exploitation was confirmed.

Do: Upgrade NetScaler ADC and Gateway to the fixed releases identified in Citrix security advisory AV26-645 (Update 3); no fixed version numbers were included in this data, so consult the advisory directly. Prioritize any appliance with an internet-exposed Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, and given the KEV listing and reports of exploitation, perform log and forensics review for signs of prior compromise per CISA's Forensics Triage Requirements — federal agencies must comply with BOD 26-04 timelines. Where patching cannot happen immediately, restrict or disable exposed Gateway/AAA configurations as an interim mitigation.

CVE-2022-0995 is an out-of-bounds (OOB) memory write in the Linux kernel's watch_queue event notification subsystem (CWE-787) that can overwrite parts of kernel state. A local user can trigger it through the watch_queue interface, for example by supplying a crafted event filter definition, causing the kernel to write beyond allocated memory when event notifications are processed. Successful exploitation may allow the local user to gain privileged (kernel/root) access or crash the system, yielding high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, local attack vector). Affected systems include mainstream Linux kernels (Fedora is explicitly listed) and NetApp HCI appliance firmware products that ship the affected kernel. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-26, two public proof-of-concepts are available, and EPSS puts 30-day exploitation probability at 9.5% (95th percentile), though ransomware use is unconfirmed.

Do: Apply updated kernels from your distribution or vendor (Fedora kernel updates; NetApp fixes are delivered via the HCI firmware updates in its security advisory) and prioritize internet-exposed, multi-user hosts per CISA BOD 26-04, including the required forensics triage checks. Because exploitation requires local access, restrict untrusted local code execution and shell access on unpatched systems, and hunt for signs of local privilege escalation on high-exposure hosts. After remediation, verify the patched kernel package is installed and that the running kernel has actually been booted into the fixed version.

Ajax.NET Professional (distributed as the ajaxpro.2 package) is vulnerable to insecure deserialization (CWE-502): it deserializes arbitrary .NET classes supplied by the client without validating which types may be instantiated. Because AjaxPro exposes HTTP endpoints for browser-to-server AJAX calls, a remote, unauthenticated attacker can send a crafted serialized payload to any reachable AjaxPro endpoint and abuse .NET deserialization gadget chains to execute code on the server. Successful exploitation yields full remote code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1 score of 9.8, network vector, no privileges or user interaction required). Any application running any version of ajaxpro.2 / Ajax.NET Professional is affected; the provided data specifies no fixed version, so defenders must rely on vendor guidance for patched releases. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-26, carries an EPSS 30-day exploitation probability of 83.6%, has public PoC code available, and Talos Intelligence reporting links it to the Chinese-speaking threat actor UAT-10147, which deploys the SPECTRE malware with an EDR bypass and a Linux rootkit in post-compromise operations.

Do: Inventory your ASP.NET estate for AjaxPro usage (web.config references, AjaxPro HTTP handlers) and prioritize any internet-facing instance for remediation. Upgrade ajaxpro.2 to the latest vendor release per vendor instructions — the provided data specifies no fixed version — or, if patching is not immediately possible, restrict or block access to AjaxPro endpoints from the internet. Because the flaw is on CISA's KEV under BOD 26-04, apply mitigations within the required timeline and hunt exposed servers for post-compromise tooling, as Talos reports UAT-10147 deploying SPECTRE with an EDR bypass and a Linux rootkit.