Vulnerability intelligence

CVE-2026-96951 is a command injection vulnerability in Windows Shell that allows an unauthorized attacker to bypass security features over a network. Specifically, successful exploitation enables attackers to evade Mark of the Web (MOTW) defenses, which are trust boundary mechanisms designed to trigger Protected View in Microsoft Office documents and SmartScreen warnings for downloaded executables. The vulnerability can be triggered when Windows generates a thumbnail or preview of a file, meaning a user does not necessarily have to open the file to initiate the exploit. In typical attack scenarios, an attacker delivers a specially crafted file to a target via email, instant messaging, or web downloads. Microsoft has confirmed that this vulnerability is being actively exploited in the wild. Consequently, the Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft addressed the vulnerability in its October 2026 cumulative security updates.

CVE-2026-110264 is an integer overflow vulnerability in the regular expression compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). Discovered by a security researcher known as "joaxcar" through GitLab's HackerOne bug bounty program, the flaw resides in the background engine responsible for parsing and validating regular expressions. Under certain conditions, an unauthenticated remote attacker can trigger this integer overflow by submitting a specially crafted regular expression. This can lead to a buffer overflow, allowing the attacker to escape the regular expression engine and execute arbitrary code on the affected GitLab server. The vulnerability affects self-managed GitLab CE and EE installations across a wide range of versions, dating back to version 7.0. Specifically, it impacts versions prior to 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. GitLab has addressed the issue by releasing security patches in these respective version branches and recommends that administrators of self-managed instances upgrade to the patched versions. GitLab.com and GitLab Dedicated environments have already been updated and do not require further action.

CVE-2026-97229 is an integer overflow vulnerability (CWE-190) located in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient validation of regular expressions used within project pipeline configurations. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability by supplying a specially crafted regular expression in a CI/CD configuration file (such as `.gitlab-ci.yml`), which can lead to arbitrary code execution on the affected GitLab server. The vulnerability affects self-managed GitLab versions 19.1 through 19.2.7, 19.3 through 19.3.3, and 19.4 through 19.4.1. Security researchers note that exploitation typically requires the ability to commit a configuration file to a repository. However, this constraint is bypassed on instances where self-registration and project creation are enabled for new users. GitLab has addressed the issue in versions 19.4.2, 19.3.4, and 19.2.8, and there have been no confirmed reports of active exploitation in the wild.

CVE-2026-110447 is an OS command injection vulnerability affecting the Collabora Online Built-in CODE Server (`richdocumentscode`) Nextcloud app in versions prior to 26.4.303. The flaw resides in the `proxy.php` file and is triggered when the CODE server is not running, such as immediately following a system restart. During this state, the wrapper launches the Collabora AppImage via a PHP execution call that fails to properly neutralize externally-influenced input. Attackers can exploit this by sending crafted HTTP GET requests containing encoded path traversal sequences (`%2e%2e`) to the status endpoint, allowing them to execute arbitrary commands on the host. Standalone Collabora Online servers are unaffected by this issue. This vulnerability has been actively exploited in the wild, with threat actors using it to deploy PHP webshells on exposed servers. Once access is established under the web server account, attackers have been observed executing discovery commands to search for password databases—such as Bitwarden, 1Password, and `.kdbx` files—as well as cryptocurrency wallets. To mitigate this risk, administrators are advised to update the Nextcloud app to version 26.4.303 or later and audit their systems for potential indicators of compromise.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

CVE-2026-96656 is an external control of file name or path vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw allows an administrator—or an attacker who has obtained administrative privileges—to write arbitrary files, specifically ELF shared objects (`.so` files), to an attacker-chosen path within the server's Codecs directory. Because Plex Media Server loads and executes all `.so` files in this directory at startup without verifying signatures, execute bits, or symbols, this arbitrary file write leads to code execution. Additionally, the vulnerability involves the `TranscoderH264Options` preference, which is appended verbatim to the x264 option string during transcoding. This vulnerability serves as the final stage of a four-part exploit chain known as "Plex2Shell," which also includes CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. When combined, these flaws allow unauthenticated remote code execution on exposed Plex Media Server instances. Following the public release of a proof-of-concept exploit in October 2026, threat actors began actively targeting unpatched servers in the wild to deploy payloads such as XMRig cryptocurrency miners and reverse proxy software. Plex addressed the issue in an update released in August 2026.