🛑 Malformed Chunk Size Can Crash facil.io Servers
Operators running affected facil.io versions should patch promptly, especially on internet-facing services. Exploitation requires only one unauthenticated request and can cause an immediate outage.
CVE-2026-66731 is a denial-of-service vulnerability affecting facil.io 0.7.5 through 0.7.6. An unauthenticated remote attacker can send a single crafted HTTP/1.1 chunked POST request with a negative chunk size, corrupting parser state and crashing the server. It is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🔥 Partial Multipart Request Freezes facil.io Workers
Patch affected facil.io deployments urgently if they accept multipart uploads from untrusted users. A small number of crafted requests could exhaust every worker and create a persistent service outage.
CVE-2026-66730 is a denial-of-service vulnerability in the multipart body parser of facil.io 0.6.0 through 0.7.6. An unauthenticated remote attacker can submit a partial closing boundary that traps worker processes in an infinite loop at 100% CPU. The server can remain disabled until manually restarted, and the issue is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
💥 Empty Multipart Field Crashes facil.io
Teams using facil.io for public-facing applications should patch quickly. The flaw is remotely reachable without authentication and can be triggered with a single POST request.
CVE-2026-66729 is an integer-underflow vulnerability affecting facil.io through 0.7.6. An unauthenticated remote attacker can send a crafted multipart Content-Disposition header with an empty field name, triggering an out-of-bounds read and crashing the handling worker. It is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🚨 Critical TeamCity Agent Protocol Flaw Enables Remote Code Execution
All administrators running affected TeamCity releases should upgrade immediately, prioritizing internet-accessible servers. Unauthenticated code execution on a build system can expose credentials, source code, artifacts, and downstream software pipelines.
CVE-2026-63077 is an unauthenticated remote code execution vulnerability in JetBrains TeamCity before 2026.1.3 and 2025.11.7. The flaw is exposed through the agent polling protocol and may allow a remote attacker to execute code without credentials. It is rated CRITICAL with CVSS 9.8.
🔗 Read more 🔗
Source: NVD
⚠️ NVIDIA NeMo Command Injection Exposes Linux Hosts
Organizations running NVIDIA NeMo on Linux should apply the vendor fix promptly and restrict access until patching is complete. Treat affected systems as high-value targets because successful exploitation can compromise both data and host privileges.
CVE-2026-24252 is an OS command-injection vulnerability affecting NVIDIA NeMo for Linux. Successful exploitation may enable code execution, data tampering, privilege escalation, and information disclosure. It is rated HIGH with CVSS 7.8.
🔗 Read more 🔗
Source: NVD
🌐 Arista VCO Input Validation Flaw Reaches Internal Services
Arista VCO customers should patch on an accelerated schedule and review accounts holding Enterprise Standard Admin privileges. There is no reported exploitation, but the internal-service access could support lateral movement or sensitive service discovery.
CVE-2026-17192 is an input-validation vulnerability in an Arista VCO feature that can let authenticated tenant users send requests to otherwise inaccessible internal services. Exploitation requires at least the Enterprise Standard Admin role. It is rated HIGH with CVSS 8.5, and Arista reports no known malicious use in customer networks.
🔗 Read more 🔗
Source: NVD
🔓 Critical Arista Orchestrator API Flaw Bypasses Data Boundaries
Administrators of affected Arista orchestrator deployments should patch urgently and examine privileged-user activity for unusual queries or outbound connections. No exploitation is currently reported, but the combination of unauthorized data access and network requests makes this a serious tenant-isolation risk.
CVE-2026-17191 is an input-validation vulnerability in an Arista orchestrator API component. An authenticated user can manipulate backend queries to access data beyond their intended privileges and trigger unintended outbound network connections. It is rated CRITICAL with CVSS 9.1, and Arista reports no known malicious use in customer networks.
🔗 Read more 🔗
Source: NVD
🚨 phpMyFAQ Admin Privileges Can Be Turned Into Server Code Execution
phpMyFAQ administrators should upgrade to v4.1.6 or later immediately and audit privileged accounts and uploaded attachments. Although elevated permissions are required, compromise of one administrator account can lead directly to server takeover.
CVE-2026-66398 is a remote code execution vulnerability affecting phpMyFAQ before v4.1.6. An authenticated administrator with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges can upload a malicious ZIP file, redirect the updater to it, and extract arbitrary PHP files into the application root. Code then executes as the web server user, and the issue is rated CRITICAL with CVSS 9.4.
🔗 Read more 🔗
Source: NVD
🗑️ phpMyFAQ Path Traversal Can Create Rogue Superadmins
Upgrade phpMyFAQ installations to 4.1.6 or later as soon as possible. Also verify that database.php is intact, the setup wizard is inaccessible, and no unexpected superadmin accounts have appeared.
CVE-2026-66397 is a path-traversal and arbitrary file-deletion vulnerability affecting phpMyFAQ before 4.1.6. An authenticated attacker can manipulate the existing_image field during category updates to delete files such as database.php. Removing that configuration file can reopen the setup wizard and allow creation of new superadmin accounts, and the issue is rated HIGH with CVSS 8.6.
🔗 Read more 🔗
Source: NVD
⚡ SiYuan Stored XSS Escapes Into Full Node.js Execution
SiYuan desktop users and managed deployments should update promptly, particularly where untrusted users have editor access. Because the XSS runs with Node.js privileges, treat it as potential local code execution rather than a routine browser-only script issue.
CVE-2026-66396 is a stored cross-site scripting vulnerability affecting SiYuan before v3.7.2. An attacker with editor permissions can inject an event handler through the title-img attribute used by Gallery and Kanban covers. When a victim opens the affected document, the payload executes in the Electron renderer with full Node.js access; the issue is rated HIGH with CVSS 8.4.
🔗 Read more 🔗
Source: NVD
🚨 Malicious SiYuan Deep Link Delivers Critical Code Execution
All SiYuan desktop users should update immediately and avoid opening untrusted siyuan:// links until patched. A convincing link can turn a single user interaction into arbitrary code execution on the workstation.
CVE-2026-66395 is a reflected cross-site scripting vulnerability affecting SiYuan desktop before v3.7.2. An attacker can craft a malicious siyuan:// deep link whose plugin-name parameter injects HTML into the bazaar plugin readme handler. The payload executes in an insecure Electron renderer with full Node.js access, and the issue is rated CRITICAL with CVSS 9.6.
🔗 Read more 🔗
Source: NVD
🖼️ Crafted SVG Files Bypass SiYuan Sanitization
SiYuan administrators and users should upgrade to v3.7.3 or later promptly, especially in collaborative environments. Review recently uploaded SVG content and limit untrusted users’ ability to add or distribute files until remediation is complete.
CVE-2026-66394 covers stored and reflected cross-site scripting vulnerabilities in SiYuan before v3.7.3. Authenticated attackers can conceal scripts inside SVG elements that the application sanitizer treats as raw text but browsers later interpret as executable content. The scripts run in the application origin, and the issue is rated HIGH with CVSS 8.7.
🔗 Read more 🔗
Source: NVD