30
ZDI-26-638: Oracle Outside In Technology WPS File Parsing Memory Corruption Remote Code Execution Vulnerability
ZDI disclosed memory corruption in Oracle Outside In Technology's WPS file parsing (CVE-2026-60414) enabling user-triggered remote code execution.
Zero Day Initiative published ZDI-26-638, a CVSS 7.8 memory corruption vulnerability in WPS file parsing within Oracle Outside In Technology. Remote attackers can execute arbitrary code on affected installations by convincing the target to visit a malicious page or open a malicious file, so user interaction is required. The issue is tracked as CVE-2026-60414. The advisory reports no exploitation.
22
Re: bubblewrap 0.12.0 fixes writes outside sandbox
Red Hat Product Security allocated CVE-2026-87766 for a bubblewrap flaw fixed in 0.12.0 that allowed writes outside the sandbox.
CVE-2026-87766 has been allocated by Red Hat Product Security for the bubblewrap sandboxing tool vulnerability that permitted writes outside the sandbox. The fix shipped in bubblewrap 0.12.0, and the oss-security advisory was updated with the new CVE identifier. The short follow-up post provides no exploitation details.
30
30
30
35
30
30
30
35
30
30
30
Homebrew 7.0.0 is out, here’s what changed for security
Homebrew 7.0.0 closes eight security advisories, including a High sudo execution bug fixed in 6.0.12, and ships brew vulns vulnerability scanning.
Homebrew 7.0.0 closes eight security advisories rated one High, two Moderate, and five Low. The High flaw let unsigned cask removal metadata execute commands with sudo (fixed in 6.0.12), while the 7.0.0 Moderate closes a LaunchServices escape that let a malicious cask execute code outside the macOS install sandbox. The release ships brew vulns, which checks installed formulae against OSV.dev, extends build attestation verification to third-party tap bottles, and replaces Bubblewrap with Landlock sandboxing on Linux.
40
Fwd: Security vulnerabilities fixed in WeeChat 4.10.1
WeeChat 4.10.1 fixes six security vulnerabilities, including WSA-2026-15 allowing DCC-received files to be written outside the configured directory.
WeeChat 4.10.1, released September 5, 2026, patches six security vulnerabilities tracked via project advisories such as WSA-2026-15. The Xfer issue lets a file received over DCC be written outside the configured directory. The announcement was forwarded by Sam James on the oss-security mailing list, and users should upgrade to 4.10.1.
30
30
30
30
35
30
30
30
30
30
30
35
30
35
30
35
30
30
CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions
Apache Syncope non-recursive Any search can skip Realms restrictions, exposing objects outside an administrator's authorized realm (CVE-2026-73579).
CVE-2026-73579 is an incorrect authorization vulnerability in Apache Syncope where non-recursive Any search requests are transformed in a way that skips Realms restrictions, returning objects outside the administrator's authorized realm. Affected component is syncope-core-persistence-common 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity.
18
VU#614868: OpenCart ecommerce platform contains directory traversal vulnerability
OpenCart 4.2.0.0 extension installer fails to validate zip extraction paths, allowing directory traversal (CVE-2026-18412) to write files outside intended directories.
CERT/CC VU#614868 discloses CVE-2026-18412, a directory traversal vulnerability in OpenCart v4.2.0.0's extension installer. The installer extracts uploaded .ocmod.zip files using zip entry filenames as filesystem paths without verifying the resolved path stays inside the intended directory. A malicious extension zip could result in arbitrary file writes outside the target directory.
45
30
30
30
30
30
30