Search: “Togo”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

CVE-2026-75880: Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service

CVE-2026-75880: authenticated ActiveMQ Artemis clients can cause denial of service via crafted selector wildcard handling in affected versions.

An authenticated client can attach a consumer with a selector containing crafted wildcard usage, causing excessive evaluation during message delivery attempts that occupies a shared broker thread and leads to denial of service. Affected versions are Apache Artemis artemis-selector 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis artemis-selector 1.0.0 through 2.44.0. Apache rates the issue moderate.

oss-security·Sep 10, 00:49 UTC · 7d agoVulnerability 7 sourcesCVE-2026-758801

30

CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search

Apache Syncope's JPA persistence layer allows SQL injection via the sort parameter in Task search, affecting all releases through 4.1.2.

CVE-2026-82232 is rated important by upstream: improper neutralization of special elements in an SQL command allows SQL injection through the sort parameter in Task search within syncope-core-persistence-jpa. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No exploitation in the wild is reported.

oss-security·updated Sep 16, 13:21 UTC · 23h ago·first Sep 14, 15:54 UTC · 2d agoVulnerability 3 sourcesCVE-2026-82232

30

Okta Fixes Auth0 and Access Gateway Flaws Enabling XSS, Auth Bypass, and SQL Injection

Okta patched three flaws in Auth0 AD/LDAP Connector and Access Gateway, including a CVSS 9.0 stored XSS tracked as CVE-2026-85982.

Okta disclosed and patched three vulnerabilities on September 8, 2026 affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. CVE-2026-85982 is a CVSS 9.0 stored XSS in the connector's admin panel caused by improper HTML encoding of directory search results and updater logs; CVE-2026-78626 is a CVSS 8.1 authorization bypass in Access Gateway Protected Rules; CVE-2026-78623 is a CVSS 7.7 SQL injection in advanced-mode datastores via unsanitized SAML assertion attributes. Fixes ship in connector version 8.0.0 and Access Gateway 2026.9.1; no exploitation has been reported.

Cyber Security News·updated Sep 11, 09:42 UTC · 6d ago·first Sep 11, 08:13 UTC · 6d agoVulnerability 2 sourcesCVE-2026-85982CVE-2026-78626CVE-2026-786231

45

CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration

Apache Syncope CVE-2026-73236 bypasses delegated administration checks for sibling Realms sharing a name prefix.

Apache Syncope disclosed CVE-2026-73236, an important-rated incorrect authorization vulnerability. Delegated administration checks are enforced via Realm hierarchy prefix matches, so two sibling Realms whose names begin with the same string cannot be correctly distinguished, allowing delegated admins to act outside their assigned Realm. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to fixed versions.

oss-security·Sep 14, 15:25 UTC · 2d agoVulnerability 3 sourcesCVE-2026-732361

28

Israeli contractor BlackCore trained Angolan officials in online influence operationsnew

Citizen Lab links Israeli firm BlackCore to training Angolan officials to run covert influence campaigns with fake personas and pro-government content.

Citizen Lab documents show Israeli influence-for-hire firm BlackCore ran a 14-week training and operations program for Angolan officials, producing more than 40 pro-government content pieces through a fictitious outlet called Agita News. Posts received roughly 20,000 likes, with some later approaching 50,000, in a country with an estimated six million active Facebook users. France's Viginum previously linked BlackCore to interference targeting France Unbowed and suspected operations in New York, Scotland and Togo, and Meta disrupted a related Israel-origin network in August.

The Record·12:15 UTC · 47m agoThreat actor

48

USN-8737-2: GNU C Library vulnerabilities

Ubuntu extends glibc fixes to 24.04 LTS, patching buffer overflow in strfmon and out-of-bounds access in tdelete, both potentially leading to code execution.

USN-8737-2 provides the Ubuntu 24.04 LTS counterpart to fixes released in USN-8737-1 for GNU C Library vulnerabilities. CVE-2026-19499 is a buffer overflow in strfmon when handling right-justification padding, potentially allowing denial of service or arbitrary code execution on Ubuntu 26.04 LTS. CVE-2026-19542 is an out-of-bounds stack array access in tdelete that could also result in denial of service or code execution.

Ubuntu Security Notices·Sep 10, 11:25 UTC · 7d agoAdvisoryCVE-2026-19499CVE-2026-195421

26

CVE-2026-0770: Langflow exec_globals RCE Vulnerability

CVE-2026-0770 is a critical unauthenticated remote code execution vulnerability in Langflow's exec_globals, endangering exposed deployments.

CVE-2026-0770 is a critical remote code execution vulnerability in Langflow, a popular open-source framework for building language model applications. It allows remote attackers to execute arbitrary code on affected installations without authentication, making internet-exposed deployments particularly dangerous. The flaw resides in the exec_globals component; the available disclosure does not state active exploitation or provide patch details.

Web discovery (articles for new exploits & KEV entries)·Aug 24, 09:57 UTC · 24d agoVulnerabilityCVE-2026-0770

58

CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions

Apache Syncope non-recursive Any search can skip Realms restrictions, exposing objects outside an administrator's authorized realm (CVE-2026-73579).

CVE-2026-73579 is an incorrect authorization vulnerability in Apache Syncope where non-recursive Any search requests are transformed in a way that skips Realms restrictions, returning objects outside the administrator's authorized realm. Affected component is syncope-core-persistence-common 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity.

oss-security·Sep 14, 15:31 UTC · 2d agoVulnerabilityCVE-2026-73579

18

Critical Langflow Vulnerability Exploited as Attacks on AI Platform Rise

Attacks exploiting CVE-2026-0768, a critical vulnerability in the Langflow low-code AI platform, are rising amid growing adversary attention this year.

CVE-2026-0768 is a critical vulnerability in Langflow, a low-code AI development platform, with exploitation attacks now rising. Dark Reading notes the platform has drawn increasing adversary attention in 2026. Organizations running exposed Langflow instances face elevated risk and should patch promptly and review instances for compromise.

Dark Reading·Sep 1, 20:48 UTC · 15d agoExploit / PoC in the wildCVE-2026-07681

62

CVE-2026-91752: GNU libextractor < 1.15 Stack Overflow via OLE2

GNU libextractor before 1.15 has a stack-based buffer overflow (CVE-2026-91752) in its OLE2 parser, triggerable via crafted files.

A stack-based buffer overflow was identified in GNU libextractor's OLE2 plugin in versions prior to 1.15, assigned CVE-2026-91752. The flaw resides in the process_star_office function, which sizes a variable-length stack array using attacker-controlled OLE2 stream data. Attackers can craft malicious OLE2/StarOffice files to trigger the overflow. The issue was disclosed on the oss-security mailing list by researcher Haitam Lazaar on September 16, 2026.

oss-security·Sep 16, 23:13 UTC · 13h agoVulnerability 2 sourcesCVE-2026-91752

45

CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

Apache OpenNLP CVE-2026-82617: built-in EMAIL and URL regex name-finder patterns enable regular expression denial-of-service and stack exhaustion in affected releases.

CVE-2026-82617 affects Apache OpenNLP opennlp-core 3.0.0-M1 before 3.0.0-M6 and opennlp-tools 2.0.0 before 2.5.12. The DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL patterns in RegexNameFinderFactory contain ambiguous nested quantifiers. Applications using these built-in finders on attacker-controlled input can be forced into regular expression denial of service or stack exhaustion. Fixes shipped in opennlp-tools 2.5.12 and 3.0.0-M6.

oss-security·Sep 11, 19:24 UTC · 5d agoVulnerability 2 sourcesCVE-2026-826172

28

CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles

Apache Syncope CVE-2026-73470 lets delegated users grant roles they do not own via crafted delegations.

Apache Syncope disclosed CVE-2026-73470, an improper privilege management vulnerability rated important. Delegations can be created or updated so that delegated users are able to grant roles they do not own, breaking ownership constraints. The flaw affects syncope-core-provisioning-java in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users are advised to upgrade to the latest fixed releases.

oss-security·Sep 14, 15:29 UTC · 2d agoVulnerabilityCVE-2026-73470

25

CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser

Apache Syncope Console and Enduser UIs suffer unauthenticated reflected XSS via notification messages, affecting versions 4.0.4 through 4.1.2.

CVE-2026-78318 is a moderate-severity cross-site scripting flaw in Apache Syncope's syncope-client-idrepo-common-ui module. The notification message, optionally shown by the Console and Enduser UIs, is improperly neutralized, enabling unauthenticated reflected XSS. Affected versions are 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2; no exploitation is reported.

oss-security·Sep 14, 15:48 UTC · 2d agoVulnerabilityCVE-2026-783181

25

USN-8772-1: AOM vulnerabilities

Ubuntu USN-8772-1 patches four libaom flaws (CVE-2026-56208 to CVE-2026-56211) that could cause heap overflow, arbitrary memory writes, or code execution.

Ubuntu Security Notice USN-8772-1 fixes a heap buffer overflow in libaom's first-pass statistics buffer handling in Look-Ahead Processing mode (CVE-2026-56208), potentially causing denial of service or arbitrary code execution. Three additional flaws in spatial and temporal layer ID validation in the SVC encoder controls (CVE-2026-56209, CVE-2026-56210, CVE-2026-56211) allow arbitrary memory writes, out-of-bounds heap reads, or code execution. Users should apply the updated packages.

Ubuntu Security Notices·updated Sep 16, 20:12 UTC · 16h ago·first Sep 16, 09:29 UTC · 1d agoAdvisory 7 sourcesCVE-2026-56208CVE-2026-56209CVE-2026-56210+1 CVEs

30

CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication

Apache Syncope allows privilege escalation for an admin user via misconfigured internal JWT JWKS authentication settings, versions through 4.1.2.

CVE-2026-78330 is a moderate-severity incorrect privilege assignment vulnerability in Apache Syncope's syncope-core-spring module. When the configured JWKS settings for internal JWT authentication are misconfigured, an admin user can escalate privileges. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security·Sep 14, 15:50 UTC · 2d agoVulnerabilityCVE-2026-78330

22

CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables

Apache Doris authorization bypass CVE-2026-72524 lets authenticated low-privilege users read, write, or drop arbitrary tables in affected 3.1.x through 4.1.3 versions.

CVE-2026-72524 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated low-privilege user to bypass privilege checks and read, write, or drop arbitrary tables. Affected versions include Apache Doris 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3. The flaw permits access to or modification of data the user is not authorized to touch.

oss-security·Sep 14, 15:09 UTC · 2d agoVulnerabilityCVE-2026-725241

30

CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection

Apache Syncope CVE-2026-73195 allows authenticated users to inject spreadsheet formulas into CSV exports.

Apache Syncope disclosed CVE-2026-73195, a moderate-rated improper encoding or escaping of output vulnerability. Authenticated users can inject spreadsheet formulas into data that is later exported as CSV, which may execute when an administrator opens the file in a spreadsheet application. The flaw affects syncope-core-provisioning-java in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security·Sep 14, 15:23 UTC · 2d agoVulnerabilityCVE-2026-731952

18

IBM security advisory (AV26-922)

Canadian Cyber Centre relays IBM advisory for Langflow, MQ, and Sterling File Gateway flaws including MQ remote code execution (CVE-2026-13293).

Canadian Cyber Centre advisory AV26-922 relays IBM fixes for Langflow OSS (versions through 1.11.5 across release lines), IBM MQ (10.0.0.0 and 9.x LTS/CD through 9.4.5.1), and Sterling File Gateway (through 6.2.2.1). CVE-2026-13293 is a remote code execution flaw in IBM MQ Java messaging caused by an incomplete security scanner blocklist enabling network-based code execution. CVE-2026-19290 is an improper access control vulnerability in IBM Sterling File Gateway. Administrators are urged to review and apply the necessary updates.

Canadian Centre for Cyber Security·Sep 15, 14:29 UTC · 1d agoAdvisoryCVE-2026-13293CVE-2026-19290

30

CVE-2026-75030: Apache Syncope: Incomplete authorization checks for Group members deprovisioning

Apache Syncope patches missing authorization checks (CVE-2026-75030) in Group members deprovisioning that administrators can abuse.

CVE-2026-75030 is a moderate-severity missing authorization vulnerability in Apache Syncope's Group members deprovisioning logic (syncope-core-idrepo-logic). An administrator with task execution permissions can bypass the incomplete authorization checks. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security·Sep 14, 15:38 UTC · 2d agoVulnerabilityCVE-2026-750301

15

[webapps] Langflow 1.10.0 - RCE

A public proof-of-concept demonstrates remote code execution in Langflow 1.10.0, the open-source AI workflow builder.

Exploit-DB lists a remote code execution proof of concept targeting Langflow version 1.10.0. Langflow is a widely used open-source tool for building AI agent and LLM workflows. The listing does not include a CVE id or evidence of in-the-wild exploitation, but RCE in AI development tooling is relevant to teams running it in production.

Exploit-DB·Sep 2, 00:00 UTC · 15d agoExploit / PoC1

32

USN-8737-1: GNU C Library vulnerabilities

Ubuntu patches GNU C Library flaws including a strfmon buffer overflow and tdelete out-of-bounds access that could enable code execution.

Ubuntu issued USN-8737-1 fixing multiple GNU C Library vulnerabilities. CVE-2026-19499 is a buffer overflow in the strfmon function when handling right-justification padding, affecting only Ubuntu 26.04 LTS. CVE-2026-19542 is an out-of-bounds stack array access in the tdelete function. An additional issue involves incorrect memory handling in wordexp with the WRDE_APPEND flag. All issues could potentially cause denial of service or arbitrary code execution.

Ubuntu Security Notices·Sep 8, 15:17 UTC · 8d agoAdvisoryCVE-2026-19499CVE-2026-19542

25

Update Chrome now to protect against an actively exploited vulnerability

Google shipped Chrome 153.0.8010.36/.37 fixing 230 flaws including actively exploited V8 out-of-bounds write CVE-2026-87491 enabling sandboxed code execution.

Chrome stable channel updated to 153.0.8010.36/.37 for Windows and Mac and 153.0.8010.36 for Linux, including 230 security fixes. CVE-2026-87491 is an out-of-bounds write in Chrome's V8 JavaScript engine that a crafted HTML page can exploit to execute arbitrary code inside the browser sandbox; Google rates it medium severity, but it is confirmed as actively exploited. The update also fixes five Critical vulnerabilities, four of which were found in WebGL. Users should update via Settings > About Chrome and restart the browser.

Malwarebytes Labs·Sep 10, 10:52 UTC · 7d agoExploit / PoC in the wildCVE-2026-874911

75

Google security advisory (AV26-904)

Google patches Chrome CVE-2026-87491, exploited in the wild and added to CISA's KEV; users should update to 153.0.8010.37.

Google released a stable channel desktop update fixing vulnerabilities in Chrome prior to 153.0.8010.37. Google confirmed that an exploit for CVE-2026-87491 exists in the wild, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 9, 2026. The Canadian Centre for Cyber Security issued advisory AV26-904 urging users and administrators to apply the update.

Canadian Centre for Cyber Security·Sep 9, 19:52 UTC · 7d agoAdvisory in the wildCVE-2026-87491

79

[remote] CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE

Public exploit released for CVE-2026-80428, unauthenticated PHP object injection via Shibboleth in ILIAS LMS, enabling remote code execution.

Exploit-DB entry 52682 publishes a proof-of-concept for CVE-2026-80428, an unauthenticated PHP object injection flaw in the ILIAS learning management system. The vulnerability is reachable through the Shibboleth authentication integration and can result in remote code execution. Affected versions are ILIAS below 9.22, 10.x below 10.10, and 11.x below 11.3. No evidence of in-the-wild exploitation is stated in the disclosure.

Exploit-DB·Sep 11, 00:00 UTC · 6d agoExploit / PoCCVE-2026-804281

48

Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-87491)

Google patched actively exploited Chrome V8 out-of-bounds write CVE-2026-87491; CISA added it to KEV with a September 23 patch deadline.

Google fixed 230 Chrome vulnerabilities in its stable channel update, including CVE-2026-87491, an out-of-bounds write in the V8 JavaScript engine being exploited in the wild. The flaw, reported by Jihyeon Jeong of Compsec Lab, Seoul National University, is the seventh Chrome zero-day patched by Google in 2026. It affects Chrome versions before 153.0.8010.36, and CISA added it to the Known Exploited Vulnerabilities Catalog urging patching before September 23, 2026. Users should upgrade to Chrome 153.0.8010.36 (Linux) or 153.0.8010.36/.37 (Windows/Mac); Qualys customers can detect vulnerable assets with QID 388666.

Qualys ThreatPROTECT·Sep 10, 05:14 UTC · 7d agoExploit / PoC in the wildCVE-2026-87491CVE-2026-2441CVE-2026-3909+4 CVEs

80