Vulnerability intelligence

CVE-2026-55040 is an authentication bypass vulnerability affecting Microsoft SharePoint Server. This flaw stems from issues within the JSON Web Token (JWT) validation pipeline, allowing a remote, unauthenticated attacker to bypass the authentication process. By exploiting this vulnerability, an attacker can assume the identity of any SharePoint site user, provided they know the target user's Active Directory Security ID (SID) or User Principal Name (UPN). This authentication bypass can be chained with other vulnerabilities to achieve further compromise, such as unauthenticated remote code execution. The vulnerability was discovered by Rapid7 Labs during a zero-day research project.

CVE-2026-63520 is a remote code execution (RCE) vulnerability affecting Microsoft SharePoint Server. This flaw stems from improper input validation, specifically an unsafe .NET type instantiation issue within SharePoint's Business Connectivity Services or its Federation Service. An attacker can exploit this vulnerability by crafting a malicious input or .NET gadget chain, enabling them to execute arbitrary code on the vulnerable server with the privileges of the SharePoint Site's service account. This vulnerability is frequently highlighted as the second part of a critical exploit chain when combined with CVE-2026-55040, an authentication bypass vulnerability. When chained together, these two vulnerabilities allow for unauthenticated remote code execution against a susceptible SharePoint server. Affected versions include SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016.

CVE-2026-76565 is identified as a reflected Cross-Site Scripting (XSS) vulnerability found within the Phoca Cart extension for Joomla. This flaw specifically impacts versions 5.0.0 through 6.1.7 of the extension. The vulnerability stems from improper output encoding of the `price_from` and `price_to` filter parameters, which are reflected directly into HTTP responses. An attacker can exploit this by crafting a malicious URL containing a JavaScript payload embedded within these parameters. When an authenticated or unauthenticated user visits this crafted URL, the arbitrary JavaScript code can be executed in their browser session. This vulnerability is categorized under CWE-79, which addresses improper neutralization of input during web page generation.

CVE-2026-8452 is identified as a memory overflow vulnerability impacting Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway appliances. This flaw can result in unpredictable or erroneous behavior and may lead to a Denial of Service (DoS) condition. The vulnerability is present when the appliance is configured as a Gateway, supporting functions such as SSL VPN, ICA Proxy, Clientless VPN (CVPN), or RDP Proxy, or when it operates as an AAA virtual server. The vulnerability is reachable over the network and does not require authentication or user interaction for exploitation. In some configurations, particularly involving the SSL VPN portal component and a malformed TLS handshake, it has been described as a pre-authentication Remote Code Execution (RCE) vulnerability, stemming from a heap overflow in the SAML message normalization process. This can allow an attacker to trigger memory corruption and potentially install a webshell with root privileges.

An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.