Trending now

CVE-2026-81983 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Acrobat and Acrobat Reader on Windows and macOS. Disclosed in September 2026 as part of Adobe's APSB26-141 security bulletin, the flaw resides within the application's image pipeline. It stems from an integer overflow where a file-controlled count, computed using 32-bit arithmetic, is trusted as a loop bound. Because the upstream size check shares the same wrapping arithmetic, it fails to validate the input properly, allowing data to be written outside the allocated memory buffer. Exploitation of this vulnerability requires user interaction, meaning a victim must open a specially crafted, malicious PDF document. If a user opens such a file, the memory corruption caused by the out-of-bounds write can allow an attacker to execute arbitrary code within the security context of the current user. The vulnerability was discovered by security researchers using a custom, large language model (LLM)-generated fuzzer that targeted the software's image parsing decoders.

CVE-2026-96951 is a command injection vulnerability in Windows Shell that allows an unauthorized attacker to bypass security features over a network. Specifically, successful exploitation enables attackers to evade Mark of the Web (MOTW) defenses, which are trust boundary mechanisms designed to trigger Protected View in Microsoft Office documents and SmartScreen warnings for downloaded executables. The vulnerability can be triggered when Windows generates a thumbnail or preview of a file, meaning a user does not necessarily have to open the file to initiate the exploit. In typical attack scenarios, an attacker delivers a specially crafted file to a target via email, instant messaging, or web downloads. Microsoft has confirmed that this vulnerability is being actively exploited in the wild. Consequently, the Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft addressed the vulnerability in its October 2026 cumulative security updates.

CVE-2026-110264 is an integer overflow vulnerability in the regular expression compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). Discovered by a security researcher known as "joaxcar" through GitLab's HackerOne bug bounty program, the flaw resides in the background engine responsible for parsing and validating regular expressions. Under certain conditions, an unauthenticated remote attacker can trigger this integer overflow by submitting a specially crafted regular expression. This can lead to a buffer overflow, allowing the attacker to escape the regular expression engine and execute arbitrary code on the affected GitLab server. The vulnerability affects self-managed GitLab CE and EE installations across a wide range of versions, dating back to version 7.0. Specifically, it impacts versions prior to 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. GitLab has addressed the issue by releasing security patches in these respective version branches and recommends that administrators of self-managed instances upgrade to the patched versions. GitLab.com and GitLab Dedicated environments have already been updated and do not require further action.

CVE-2026-97229 is an integer overflow vulnerability (CWE-190) located in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient validation of regular expressions used within project pipeline configurations. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability by supplying a specially crafted regular expression in a CI/CD configuration file (such as `.gitlab-ci.yml`), which can lead to arbitrary code execution on the affected GitLab server. The vulnerability affects self-managed GitLab versions 19.1 through 19.2.7, 19.3 through 19.3.3, and 19.4 through 19.4.1. Security researchers note that exploitation typically requires the ability to commit a configuration file to a repository. However, this constraint is bypassed on instances where self-registration and project creation are enabled for new users. GitLab has addressed the issue in versions 19.4.2, 19.3.4, and 19.2.8, and there have been no confirmed reports of active exploitation in the wild.

CVE-2026-89078 is identified as a double free vulnerability affecting the regular expression parser in GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw could enable an authenticated user to execute arbitrary code on the GitLab server. The vulnerability is triggered when a specially crafted regular expression is parsed within a CI/CD configuration. GitLab has released remediations for this issue, impacting versions 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

CVE-2026-93577 is an integer overflow vulnerability found in the regular expression compiler of GitLab CE/EE. This flaw could enable an authenticated user to execute arbitrary code on the GitLab server. The vulnerability is triggered when a specially crafted regular expression is compiled within a CI/CD configuration. Affected versions include all GitLab CE/EE versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2024-4577 is a vulnerability that enables remote code execution in PHP installations on Windows servers. It specifically affects systems running PHP in CGI mode or those exposing the PHP binary. Exploitation involves leveraging the Windows "Best-Fit" encoding feature, typically by inserting a "soft hyphen" character within a URL. This allows attackers to bypass PHP sanitization measures and execute arbitrary code via the `php.exe` executable. While initially believed to have a broader impact, further research revealed that successful exploitation primarily hinges on the system's locale being configured for Chinese (simplified or traditional) or Japanese. Other similar locales might also be susceptible. The vulnerability affects PHP versions 8.1 before 8.1.29, 8.2 before 8.2.20, and 8.3 before 8.3.8. Proof-of-concept exploits were observed shortly after the vulnerability's disclosure, highlighting its potential for misuse.

CVE-2025-55182 is a critical unauthenticated remote code execution (RCE) vulnerability found in React Server Components (RSC) versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. This vulnerability affects packages including `react-server-dom-parcel`, `react-server-dom-turbopack`, and `react-server-dom-webpack`. The flaw stems from insecure deserialization in the RSC payload handling logic, allowing attacker-controlled data to influence server-side execution. Exploitation requires only a crafted HTTP request. Patches are available for React and Next.js. It is recommended to upgrade to patched React versions such as 19.0.1, 19.1.2, or 19.2.1, and to update frameworks like Next.js to their corresponding patched versions.