42
MapLibre Vulnerability Exposes 2.7M Users to Zero-Click Attacks
Critical XSS CVE-2026-85061 in MapLibre GL JS enables zero-click attacks on an estimated 2.7 million users; fixed in maplibre-gl 6.4.1.
A flaw in MapLibre GL JS's DOM.sanitize() iterates a live NamedNodeMap while removing attributes, skipping malicious attributes placed adjacent to removed ones, letting event handlers like onload and ontoggle survive and execute via innerHTML in the attribution control. Tracked as CVE-2026-85061 and GHSA-jrc7-96c5-q579, the flaw affects maplibre-gl versions 6.4.0 and earlier, is rated critical under CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), and requires no user interaction, privileges, or authentication. Exploitation could enable session theft, unauthorized actions, phishing redirects, or map content manipulation; the patch in 6.4.1 snapshots attributes with Array.from before iterating.
63
Critical MapLibre GL JS Vulnerability Enables Zero-Click XSS Attacks
MapLibre GL JS 6.4.1 patches CVE-2026-85061, a critical zero-click XSS in DOM.sanitize() affecting versions 6.4.0 and earlier.
A critical cross-site scripting vulnerability, CVE-2026-85061 (GHSA-jrc7-96c5-q579), affects maplibre-gl versions 6.4.0 and earlier and is fixed in 6.4.1. The flaw stems from DOM.sanitize() iterating a live NamedNodeMap while deleting attributes, causing the sanitizer to skip adjacent dangerous event-handler attributes that later execute via innerHTML. GitHub rates the issue Critical with CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, exploitable without user interaction when untrusted attribution strings are rendered. Organizations should upgrade to 6.4.1 or later, rebuild affected bundles, and sanitize attribution fields as an interim measure.
55
42
42
42
47
47
Amasty patches dozens of Magento extensions, 2 critical
Amasty patched dozens of Magento/Adobe Commerce extensions, including two critical flaws allowing unauthenticated web shell upload and remote code execution.
Extension vendor Amasty released fixes for a large batch of Magento and Adobe Commerce modules, with critical unauthenticated file upload flaws in Advanced Product Reviews and Gift Card that allow attackers to plant web shells and take full control of stores. Dozens of additional high-, medium- and low-severity extensions were also patched. The vendor says the release affects almost every Magento and Adobe Commerce store. A related Order Attributes flaw was previously exploited heavily, with Sansec Shield blocking over 12,000 attempts against 25% of Magento stores in three days.
75
42
60
Okta Patches Auth0 and Access Gateway Vulnerabilities Let Attackers Enable XSS, Authentication Bypass and SQL Injection
Okta patches three high-severity flaws in Auth0 AD/LDAP Connector and Access Gateway: stored XSS, auth bypass, SQL injection.
Okta disclosed on September 8, 2026 three vulnerabilities: CVE-2026-85982, a CVSS 9.0 stored XSS in Auth0 AD/LDAP Connector before 8.0.0; CVE-2026-78626, a CVSS 8.1 Protected Rule authorization bypass in Access Gateway before 2026.9.1; and CVE-2026-78623, a CVSS 7.7 SQL injection in Access Gateway advanced-mode datastores. Exploitation requires authenticated access and specific configurations. Fixes require upgrading the connector to 8.0.0+ and Access Gateway to 2026.9.1+.
62
PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution
PostgreSQL fixed CVE-2026-6471 (CVSS 7.2), a 12-year-old logical decoding flaw letting replication-role accounts execute arbitrary code as the database OS user.
PostgreSQL patched CVE-2026-6471 (CVSS 7.2), a flaw present since logical decoding shipped in 9.4 (2014) that lets an account with the REPLICATION attribute run arbitrary code as the database server's OS user when wal_level is logical. Versions before 18.6, 17.11, 16.15, 15.19, and 14.24 are affected; exploitation requires such an account, which backup, CDC, and monitoring tooling routinely holds. The fix adds an output_plugin_libraries whitelist, so administrators using non-default plugins such as wal2json and decoderbufs must add them and reload configuration after updating. Cyera Research, whose write-up names the flaw PostGREShell, demonstrated escalating a replication user to superuser with persistence; no PoC or KEV entry existed as of September 4.
60
42
42
42
42
47
Decade-old PostgreSQL flaw turns backup account into a backdoor
Cyera disclosed CVE-2026-6471, a decade-old PostgreSQL flaw letting REPLICATION-attribute accounts achieve RCE and superuser compromise, patched August 13.
Cyera Research's 'PostGREShell' flaw exists in PostgreSQL's logical replication output plugin loading, where the replication code path never called the library-path security check, allowing path traversal or UNC paths to load arbitrary code. A low-privilege backup account can achieve code execution on Windows, Linux, and macOS, then escalate to superuser with persistent backdoor access. CVE-2026-6471 affects versions back to PostgreSQL 9.4 (2014) and was patched in releases 18.6, 17.11, 16.15, 15.19, and 14.24 on August 13. CVSS is 7.2, and no exploitation of this specific CVE has been confirmed, though VirusTotal hunting found 114 malicious PostgreSQL plugins.
65
42
42
47
42
42
47
42
42
42
42
42
47
47
42
42
47
47
42
57
42
47