Vulnerability intelligence

CVE-2026-67279 describes a vulnerability in MikroTik RouterOS SSH where the system improperly handles a client-requested rekey operation. This flaw allows the SSH server to proceed to the connection protocol stage and accept session channel requests, even though user authentication has not been completed. As a result, an unauthenticated client can open an SSH session channel and issue `exec` requests. This capability permits the creation, overwriting, and reconstruction of files within the RouterOS managed file namespace, including critical configuration and diagnostic data.

It appears there might be a slight typo in the CVE number provided. Based on popular articles, a vulnerability identified as CVE-2025-12183 has been widely discussed. This vulnerability affects `org.lz4:lz4-java` versions 1.8.0 and earlier. CVE-2025-12183 involves out-of-bounds memory operations, which can be triggered by remote attackers providing untrusted compressed input. This flaw can lead to a denial of service and allow attackers to read adjacent memory. The issue specifically impacts programs utilizing the `LZ4_decompress_fast` API, also known as the "fast" decompressor, which lacks boundary checks when processing untrusted inputs.

CVE-2026-91768 describes an IPv6 access control bypass vulnerability found in PHP-FPM. This flaw specifically affects the `listen.allowed_clients` configuration due to a partial address comparison mechanism. The vulnerability allows clients to circumvent intended IPv6 Access Control List (ACL) restrictions. This issue has been noted in the context of unpatched Linux distributions, including Debian Linux, and is associated with PHP versions such as php8.2 and php8.4. It is also listed among multiple vulnerabilities affecting PHP 8.3.x versions prior to 8.3.35.

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

CVE-2026-67279 describes a vulnerability in MikroTik RouterOS SSH where the system improperly handles a client-requested rekey operation. This flaw allows the SSH server to proceed to the connection protocol stage and accept session channel requests, even though user authentication has not been completed. As a result, an unauthenticated client can open an SSH session channel and issue `exec` requests. This capability permits the creation, overwriting, and reconstruction of files within the RouterOS managed file namespace, including critical configuration and diagnostic data.

CVE-2026-65660 is a vulnerability affecting Microsoft Office SharePoint, specifically SharePoint Server 2016, 2019, and Subscription Edition, with potential impact on SharePoint 2013. This flaw stems from an improper control of code generation, characterized as a 'code injection' vulnerability. It involves a parser desynchronization issue within SharePoint's `SafeControls` filter, which is designed to prevent the loading of dangerous classes. The vulnerability arises when the `ToolPane` component processes web-part markup, failing to properly escape quotes within attribute values when reconstructing `Register` directives. This oversight allows an attacker to inject additional directives through unescaped quotes, enabling the registration of arbitrary .NET classes. While initially described by Microsoft as a spoofing vulnerability, further technical analysis revealed that CVE-2026-65660 can lead to authenticated remote code execution (RCE). Researchers have also demonstrated that this flaw can be chained with other vulnerabilities to achieve pre-authentication remote code execution on servers configured to allow anonymous page access.