Trending now

CVE-2026-107103 is an SQL injection vulnerability affecting the Multi-tenant Enterprise Resource Planning (ERP) system developed by Manacle Technologies. The flaw is caused by insufficient validation and parameterization of user-supplied input within an API endpoint of the ERP application. Because the system fails to properly sanitize this input, an unauthenticated remote attacker can exploit the vulnerability by sending specially crafted requests to the exposed endpoint. If successfully exploited, the vulnerability allows attackers to execute arbitrary SQL commands on the backend database. This can enable unauthorized actors to access sensitive database records, manipulate application data, or perform other unintended actions on the targeted system.

CVE-2026-107104 is an unsafe deserialization vulnerability (CWE-502) affecting the Multi-tenant Enterprise Resource Planning (ERP) system developed by Manacle Technologies. The issue arises because the platform, which is designed to manage core business processes for multiple organizations in a shared environment, performs unsafe deserialization of user-controlled data within its affected functionality. An unauthenticated remote attacker can exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system. Successful exploitation can allow the attacker to execute arbitrary code, manipulate application data, or perform other unauthorized actions on the host system.

CVE-2026-107102 is an account takeover vulnerability identified in the multi-tenant Enterprise Resource Planning (ERP) system developed by Manacle Technologies. Reported by the Indian Computer Emergency Response Team (CERT-In), the flaw is rooted in the insufficient verification of data authenticity (CWE-345). The issue arises due to improper validation of payment callback parameters combined with inadequate authentication controls within the application's API endpoint. To exploit this vulnerability, an unauthenticated remote attacker can manipulate the payment callback parameters. This manipulation causes the application to establish an authenticated session for an arbitrary user without requiring valid payment verification. As a result, attackers can bypass standard authentication protocols and gain unauthorized access to other user accounts on the targeted system.

CVE-2026-59346 is an integer-overflow vulnerability affecting the VMXNET3 virtual network adapter in VMware Workstation and VMware Fusion versions 25H2 and 26H1. The issue resides in the TCP Segmentation Offload (TSO) processing path within the host's VMware-VMX process, which handles splitting large network packets into smaller segments. When calculating the memory required for these segments, the system performs a 32-bit multiplication of the segment count by the space needed per segment. If the result exceeds the 32-bit limit, it wraps to a smaller value, leading to an undersized buffer allocation. Because the subsequent copy loop still processes the original segment count, guest-controlled packet data is written beyond the allocated buffer, resulting in an out-of-bounds write. An attacker with local administrative privileges inside a guest virtual machine can exploit this vulnerability to escape the virtual machine sandbox and execute arbitrary code on the host system, or cause the host process to crash. Broadcom addressed this issue by releasing patches in VMware Workstation and Fusion version 26H1u1 on September 3, 2026.

CVE-2026-96207 is an elevation of privilege vulnerability affecting Microsoft Partner Center, a platform used by enterprises to manage cloud services, licenses, and customer accounts. The vulnerability stems from improper certificate validation mechanisms within the platform. This flaw allows an unauthorized attacker to exploit the validation process over a network, enabling them to elevate their privileges within the Microsoft Partner Center environment. Successful exploitation of this vulnerability can lead to unauthorized access and control over affected systems within the network. Microsoft has addressed the issue by incorporating it into its security update guidance. To mitigate potential exploitation risks, organizations are advised to apply the official patches provided by Microsoft and review their access controls.

CVE-2026-86360 is a path traversal vulnerability affecting the Dell System Update (DSU) command-line interface (CLI) deployment tool in versions prior to 2.3.0.0. DSU is a utility used by enterprise IT administrators to apply driver, BIOS, and firmware updates to Dell PowerEdge servers. The vulnerability stems from an improper limitation of a pathname to a restricted directory, which can allow an unauthenticated remote attacker to gain unauthorized access to the system's filesystem. By leveraging this filesystem access, an unauthenticated remote attacker can execute arbitrary code with root privileges on the affected system. This can result in unauthorized control over the DSU application and the underlying operating system. To remediate the vulnerability, Dell has released a patch and advises administrators to upgrade to DSU version 2.3.0.0 or later.

CVE-2026-102255 is a pre-authentication server-side request forgery (SSRF) vulnerability affecting SonicWall Secure Mobile Access (SMA) 1000 series appliances, specifically models 6210, 7210, and 8200v. The flaw resides in the Appliance WorkPlace interface, which is the web portal users access to log in and reach internal applications. It stems from an unintended alternate access-path weakness that allows a remote, unauthenticated attacker to send crafted requests to the internet-facing portal. By exploiting this vulnerability, an attacker can direct the appliance to issue requests on their behalf, enabling them to reach internal functionality and perform unauthorized operations. SonicWall released hotfixes in October 2026 to address the issue, urging users to update their systems. At the time of the announcement, the vendor stated there was no evidence that the vulnerability was being actively exploited in the wild.

CVE-2026-106446 is an Abstract Syntax Tree (AST) type confusion vulnerability affecting the JavaScript templating library Handlebars.js in versions 4.0.0 through 4.7.9. The flaw resides in the `compile()` and `precompile()` functions, which accept pre-parsed AST objects but only validate specific nodes, such as selected PathExpression, NumberLiteral, and BooleanLiteral values. This incomplete validation allows an attacker who can supply an object instead of a standard template string to bypass previous security controls (specifically the fix for CVE-2026-33937) and inject arbitrary JavaScript expressions into unchecked fields, such as `Program.blockParams.length` or non-string values. When the compiler processes these unchecked values, it emits them directly into the generated JavaScript code. This leads to arbitrary code execution within the server process when the compiled output is rendered or when precompiled output is loaded. Applications that only pass trusted template strings to the compiler are not affected by this issue. The vulnerability has been resolved in Handlebars.js version 4.7.10.

CVE-2026-106445 is a deny list bypass vulnerability in the Handlebars.js templating engine, affecting versions 4.0.0 through 4.7.9. The library maintains a prototype-access deny list designed to block access to specific properties, such as `constructor`. However, the `lookupProperty` function returns `Function.prototype.constructor` before applying this deny list because `constructor` is recognized as an own property of `Function.prototype`. An attacker can exploit this flaw if they can render a controlled template with the `allowProtoMethodsByDefault` option enabled and have an accessible function within the template context. By traversing from that function through its prototype to `Function.prototype`, the attacker can bypass the deny list to obtain the `Function` constructor. This allows the execution of arbitrary JavaScript with the privileges of the server application. The issue has been resolved in Handlebars.js version 4.7.10.

CVE-2024-37085 is an authentication bypass vulnerability affecting VMware ESXi. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management. This can be achieved by re-creating the configured AD group (named 'ESXi Admins' by default) after it has been deleted from AD. Successful exploitation allows an attacker who has already gained limited system rights on a targeted server to escalate their privileges and gain full administrative control of the ESXi hypervisor. With this level of access, an attacker can manipulate the hypervisor's settings, control the guest operating systems, and potentially encrypt the file system.