Vulnerabilities

XenForo before 2.3.13 contains an unauthenticated authentication bypass (CWE-697) in its OAuth2 token endpoint, rated critical (CVSS 4.0: 9.1). The flaw arises from PHP truthy evaluation: when an attacker submits empty values for the client_secret and code_verifier parameters, the empty strings are treated as false and both client-secret validation and PKCE code-verifier validation are skipped entirely. As a result, an attacker who obtains a valid authorization code (for example by intercepting it during a legitimate redirect) can exchange it for a token pair without proving client identity or honoring the PKCE commitment, gaining access and refresh tokens with the high confidentiality and integrity impact reflected in the CVSS scoring. Only XenForo deployments running versions before 2.3.13 that expose the OAuth2 token endpoint (i.e., act as OAuth2 authorization servers) are affected. No in-the-wild exploitation is documented so far: one public proof-of-concept exists on GitHub, the issue is not in CISA's KEV catalog, and EPSS assigns a 0.5% probability of exploitation within 30 days.

Do: Upgrade to XenForo 2.3.13 or later. Until patched, add a mitigation that rejects empty client_secret and code_verifier values at the OAuth2 token endpoint (e.g., via WAF rule or code patch) and monitor for tokens issued without proper client authentication. Also review OAuth2 client configurations and recently issued tokens, and enforce strict redirect-URI and TLS hygiene, since the bypass matters most when authorization codes can be intercepted.

Libcurl wrongly reuses an HTTP connection that was set up for a hostname using Negotiate authentication when the initial request to that host was made with empty credentials, so a connection already authenticated as one user can be handed to a different user's request (tracked as CWE-488, Exposure of Data Element to Wrong Session). The flaw is triggered when a client first contacts a host over Negotiate (Kerberos/SPNEGO) HTTP authentication with no credentials, and then subsequent requests as different users are sent over that reused, already-authenticated connection. An attacker gains cross-user identity mixups: user B's requests travel over user A's authenticated connection, so data can be disclosed to, or acted on under, the wrong identity, with the CVSS vector rating confidentiality, integrity and availability impact all high and the flaw critical (9.8) with no privileges or user interaction required. Any application or tool that uses libcurl is affected when it performs Negotiate HTTP authentication for multiple users against the same host; this includes the curl command-line tool and the very large ecosystem of operating systems and products that bundle or embed libcurl. No public proof of concept or in-the-wild exploitation is known, it is not in CISA KEV, and EPSS currently estimates a 0.8 percent probability of exploitation within 30 days.

Do: Upgrade curl/libcurl to the fixed release named in the curl project's security advisory, and audit which installed or embedded libcurl builds your estate carries. As mitigations, avoid making Negotiate-authenticated requests with empty credentials, or prevent connection reuse (for example, use fresh connections per user or disable the connection cache) when multiple users authenticate against the same host. Deployments that never use Negotiate/Kerberos HTTP authentication are not practically affected.

libxml2 before 2.15.4 fails to propagate parser flags in the xmlXIncludeProcess and xmlXIncludeProcessTree functions, so options such as XML_PARSE_NONET are not applied during XInclude processing. An application that relies on that flag to block network access, while using a custom resource loader that can reach the internet, can be tricked into fetching attacker-controlled external entities or remote resources. This enables XML external entity (XXE) injection, server-side request forgery (SSRF), and denial of service via deliberately slow attacker-controlled internet resources, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8). Any product that embeds a vulnerable libxml2 and calls the affected XInclude functions is affected, with the xmlsoft project as the maintaining vendor. No public proof-of-concept or confirmed in-the-wild exploitation is known, EPSS is low (0.2% in 30 days), and the issue is not listed in the CISA KEV catalog.

Do: Upgrade libxml2 to 2.15.4 or later, or apply your Linux distribution's backported security patch. Developers whose code calls xmlXIncludeProcess or xmlXIncludeProcessTree should audit whether they rely on XML_PARSE_NONET for network isolation, and mitigate by restricting or hardening custom resource loaders, disabling XInclude on untrusted XML input, and enforcing egress filtering. Remember that bundled or vendored copies of libxml2 inside language bindings and third-party software may need separate updates from the OS package.

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1.

Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

multer 2.2.0 leaks a file descriptor each time a multipart upload using diskStorage is aborted or truncated before completion, because the destination write stream is never closed. An unauthenticated network client can trigger this simply by repeatedly starting uploads and interrupting them. Each failed request leaves an open file descriptor and retains its disk blocks until the process exits, so sustained repeated failures can exhaust the process's file descriptor limit and cause a full denial of service (availability impact only). Any Node.js application running multer 2.2.0 with disk storage enabled is affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.3%, so no confirmed exploitation is known; a fixed release (2.3.0) is available and no workarounds are provided.

Do: Upgrade multer to 2.3.0 or later, which closes the write stream on aborted uploads. Inventory your dependency tree (e.g., npm ls multer and lockfiles) to find applications pinned to or resolving to 2.2.0, and prioritize any that use diskStorage on internet-reachable upload endpoints. Since no workarounds exist, as an interim measure monitor file descriptor counts and recycle Node processes that handle high upload-failure volumes until the patch is deployed.

ONNX before 1.21.0 contains a symlink-following and time-of-check-to-time-of-use flaw in its save_external_data function, which builds the external-data output path from the model's external_data location field and opens it for writing without O_NOFOLLOW/O_EXCL after a non-atomic os.path.isfile() check. A local attacker with write access to the directory where a victim serializes a model's external data can pre-plant a symlink at the expected path, causing the victim's write to follow it. As a result, the attacker can append attacker-influenced content to any file the victim can write, such as ~/.ssh/authorized_keys, cron files, or application configs, potentially achieving code execution or persistence in the victim's user context. Any Python environment running a vulnerable onnx version and saving models with external data, particularly on shared or multi-user systems, is affected. No exploitation is known in the wild; one public advisory/PoC reference exists and EPSS is 0.1% (1st percentile).

Do: Upgrade the onnx pip package to 1.21.0 or later. As an interim mitigation, serialize model external data only into directories exclusively writable by the running user, and audit services, cron jobs, and pipelines on shared or multi-user hosts that call save_external_data for vulnerable usage.

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability (CWE-288, 'using an alternate path or channel') that an unauthenticated remote threat actor can exploit. The flaw is triggerable when the appliance is configured as an AAA virtual server or as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments, allowing the attacker to bypass authentication without valid credentials. A successful bypass could give an attacker access to VPN-protected or AAA-gated resources as an authenticated user; no CVSS score has been published yet. Organizations running affected NetScaler appliances in these configurations are exposed, and affected version ranges are not specified in the available data, so defenders should consult Citrix advisory AL26-019. The flaw was added to CISA's KEV on 2026-09-09, indicating exploitation in the wild; ransomware use is unknown, no public PoC is known, and EPSS assigns a 3.4% probability of exploitation within 30 days (88th percentile).

Do: Prioritize applying vendor fixes or mitigations per Citrix advisory AL26-019 in line with CISA BOD 26-04, focusing first on internet-facing appliances configured as AAA virtual servers or Gateways (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Until patched, restrict internet exposure and review VPN/AAA authentication logs for signs of unauthenticated access, following CISA's Forensics Triage Requirements if compromise is suspected.

Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.

Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of signatures.

CVE-2026-66838 is a SQL injection (CWE-89) in the Elixir PostgreSQL driver Postgrex, affecting versions from 0.19.3 up to but not including 0.22.4. The flaw arises because Postgrex.stream/4 embeds the caller-supplied :comment option into the statement text of the Parse message by raw concatenation, without invoking the comment_not_present!/1 validation applied at every other execution point, so an attacker who can influence that value can close the comment with */ and append their own SQL clauses, which execute under the database connection's role. Applications that pass attacker-controlled data as :comment — including through Ecto.Repo.stream/2, which exposes the same option — are affected; because Parse accepts only a single command, the injection is confined to the streamed statement and further statements cannot be chained. CVSS 4.0 rates this 5.9 (medium) with a precondition that the attacker has a way to influence the comment value, and no exploitation in the wild is currently known (EPSS 0.3%, not in CISA KEV), though a public advisory with a proof-of-concept exists (GHSA-3gww-3f36-2388).

Do: Upgrade postgrex to 0.22.4 or later via your dependency manager, and review the public advisory GHSA-3gww-3f36-2388. If you cannot upgrade immediately, audit whether your code calls Postgrex.stream/4 or Ecto.Repo.stream/2 with a :comment option and, if so, ensure that value never originates from untrusted input or sanitize it to reject the */ sequence. Because exploitation requires application code to forward attacker-influenced data into :comment, checking that single call pattern is the fastest way to determine actual exposure.

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected. Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.