Trending now

CVE-2026-82078 identifies an unsafe dynamic class-loading vulnerability present in the database connection utilities of PaperCut MF and PaperCut NG. This flaw allows the application to instantiate database driver classes using configurable driver names without proper validation against an approved allowlist of drivers. When exploited, particularly in conjunction with CVE-2026-81578 (an improper access control vulnerability), this vulnerability can enable an unauthenticated attacker to execute arbitrary Java bytecode. This chain of vulnerabilities ultimately facilitates pre-authentication remote code execution within the PaperCut Application Server.

CVE-2026-81578 describes an improper access control vulnerability found in the web management interface of PaperCut MF and PaperCut NG. This flaw allows unauthenticated remote requests, specifically those targeting administrative functions, to initiate backend actions before the system fully completes its access validation checks. The vulnerability, categorized as CWE-306 (Missing authentication for critical function), enables an unauthenticated remote attacker to modify certain system configurations. It has been observed to be actively exploited in the wild, often in conjunction with CVE-2026-82078, to achieve broader compromise.

CVE-2026-82077 is a path traversal vulnerability (CWE-22) affecting the Scan-to-Fax component of PaperCut NG and PaperCut MF up to versions 25.0.12 and 26.0.4. The flaw stems from improper validation and canonicalization of administrator-supplied fax provider settings. An authenticated administrator can exploit this by injecting directory traversal sequences or unexpected path components into the configuration. When the Scan-to-Fax subsystem subsequently launches the provider, the crafted path resolves to an attacker-controlled binary, allowing arbitrary command execution on the underlying host within the security context of the PaperCut service account. Security researchers from watchTowr, who tracked the issue internally as WT-2026-0144, demonstrated that this post-authentication remote code execution (RCE) vulnerability can be chained with an authentication bypass vulnerability (such as WT-2026-0143). This combination allows attackers to bypass authentication checks and achieve remote code execution on vulnerable systems. Organizations can detect potential exploitation by monitoring for unexpected modifications to Scan-to-Fax provider configurations and looking for unauthorized child processes spawned by the PaperCut service.

CVE-2026-8481 is a remote code execution vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.0. The flaw is located in the code validation API endpoint (`POST /api/v1/validate/code`), which is designed to validate Python code snippets used within visual AI workflows. Because the endpoint accepts user-supplied Python code and passes it directly to Python's built-in `exec()` function without sandboxing, input validation, or privilege restrictions, authenticated users can execute arbitrary system commands. An attacker can exploit this vulnerability by authenticating to the Langflow web interface or API and sending an HTTP POST request containing malicious Python code. Since the code runs within the context of the server process, successful exploitation allows the attacker to execute commands with the server's privileges, potentially enabling them to read sensitive data, install persistence, or pivot to connected AI model providers. A patch is available to address this issue.

CVE-2026-9103 is an authentication bypass vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.0. The flaw is located in the `/api/v1/login/auto_login` endpoint, which is designed to streamline local development. When the `AUTO_LOGIN` configuration is enabled—which is the default setting in many affected deployments—the endpoint issues long-lived superuser bearer tokens to any network caller without requiring authentication credentials. This allows unauthenticated network attackers to obtain full administrative access to the Langflow instance. Additionally, permissive cross-origin resource sharing (CORS) settings compound the issue by potentially exposing these tokens to unintended origins. In real-world scenarios, this vulnerability is frequently chained with other flaws to achieve broader system compromise. Specifically, attackers can exploit CVE-2026-9103 to obtain a superuser token and then leverage CVE-2026-8481—a code execution vulnerability in the `/api/v1/validate/code` endpoint—to execute arbitrary Python code on the underlying server. This combined attack path, tracked as CVE-2026-9198, allows unauthenticated remote code execution under the privileges of the Langflow service account. To mitigate the issue, users are advised to upgrade to Langflow version 1.10.1 or later, or disable the auto-login feature by setting the `LANGFLOW_AUTO_LOGIN` environment variable to false.

CVE-2026-9198 is an unauthenticated remote code execution vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.0. This flaw allows attackers to gain full control over default Langflow deployments by exploiting a chain of two API endpoints. Specifically, the vulnerability leverages the `/api/v1/auto_login` endpoint, which issues SUPERUSER tokens to any network caller without requiring authentication. Subsequently, attackers can utilize the `/api/v1/validate/code` endpoint to execute arbitrary Python code via `exec()`, leading to full remote code execution. This issue is classified under CWE-94, indicating improper control of code generation. The vulnerability has been addressed in Langflow version 1.10.1.

CVE-2026-100829 is a security vulnerability identified in the DOM: Security component of several Mozilla products, including Firefox, Firefox ESR, and Thunderbird. Reported by researcher Rintaro Kawasugi, the flaw stems from improper security control enforcement within the DOM security component. This issue allows a remote attacker to interact with the affected component and bypass built-in security mitigation mechanisms. Mozilla has addressed this vulnerability in its security advisories MFSA2026-97 and MFSA2026-100. The issue is resolved in Firefox 157, Firefox ESR 153.4, Thunderbird 157, and Thunderbird 153.4. To prevent potential exploitation, users are advised to update their installations to these patched versions, though there are currently no reports of active exploits in the wild.

**CVE-2026-100828** is a security vulnerability affecting the Bookmarks & History component of Mozilla Firefox and Thunderbird. Reported by researcher Rintaro Kawasugi, the flaw allows for a mitigation bypass within this specific component. While the underlying technical mechanisms and exact downstream consequences of the bypass are not detailed in public advisories, the vulnerability enables an attacker to circumvent established security mitigations. The issue affects versions of Firefox prior to 157, Firefox ESR prior to 153.4, and Thunderbird prior to versions 157 and 153.4. Mozilla addressed the vulnerability in late September 2026, releasing patches in Firefox 157, Firefox ESR 153.4, and Thunderbird 153.4 and 157. Users are encouraged to update their software to these versions or later to resolve the issue.

CVE-2026-100816 is a site-isolation vulnerability discovered in the "DOM: Networking" component of Mozilla Firefox, Firefox ESR, and Thunderbird. Reported by security researcher Rintaro Kawasugi, the flaw is categorized as an origin validation error where the browser does not properly verify the source of data or communication. This weakness allows a potential bypass of intended site-isolation boundaries within the browser's security model, which could enable unauthorized cross-site access or interaction. The vulnerability has been addressed by Mozilla and is fixed in Firefox 157, Firefox ESR 153.4, Thunderbird 157, and Thunderbird 153.4. To mitigate the risk of cross-site data exposure, users and administrators are advised to update their software to these patched versions or apply the corresponding security updates provided by their operating system vendors.

CVE-2026-105134 is an operating system command injection vulnerability affecting the Replication Receiver component of the AhsayCBS backup utility, specifically within the `/rps/api/json/UpdateReceivers.do` endpoint. The flaw stems from the improper neutralization of user-supplied input, which allows remote attackers to manipulate the `random` argument. The affected API also contains an authentication bypass mechanism that permits a random token to substitute for valid credentials. Consequently, remote, unauthenticated attackers can exploit this vulnerability to execute arbitrary commands with system privileges (such as NT AUTHORITY\SYSTEM) on the host. In active campaigns, threat actors have been observed chaining CVE-2026-105134 with CVE-2026-105133—an improper authentication flaw in the utility's `checkSysPwd` function—to bypass authentication and achieve remote code execution. After gaining access, attackers configure a malicious replication receiver and drop Java Server Page (JSP) web shells into the application directory. These intrusions are typically followed by reconnaissance and the deployment of payloads, such as XMRig cryptocurrency miners disguised as Microsoft Edge processes, alongside evasion scripts designed to terminate mining activities if administrative monitoring tools are opened.