Apache Security Advisories - 2026-09-30

Apache Security Advisories - 2026-09-29

Apache Security Advisories - 2026-09-28

catalyst_sd-wan_manager

Improper Handling of URL Encoding (Hex Encoding)

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.

This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

Cisco Catalyst SD-WAN Manager

Cisco

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager due to improper handling of URI encoding in HTTP requests. This allows attackers to bypass an authentication rule intended to restrict access to a specific API endpoint by sending a crafted HTTP request.

Double Encoding

Generic Cross-Browser Cross-Domain Theft

Using Slashes and URL Encoding Combined to Bypass Validation Logic

URL Encoding

The exploit crafts an HTTP request with hex-encoded URI sequences that bypass the authentication validation logic in Cisco Catalyst SD-WAN Manager's API session handler. The request router accepts the encoding but the session validator does not normalize it, causing the auth check to be skipped. The attacker then executes administrative commands with full privileges.

sec.cloudapps.cisco.com

netscaler_gateway

netscaler_application_delivery_controller

Improper Restriction of Operations within the Bounds of a Memory Buffer

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

NetScaler

Gateway

Citrix NetScaler

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that enables Remote Code Execution or Denial of Service. Affects NetScaler ADC versions before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; NetScaler Gateway versions before 14.1-73.37 and before 13.1-64.23.

Buffer Overflow via Environment Variables

Overflow Buffers

Buffer Manipulation

Client-side Injection-induced Buffer Overflow

Filter Failure through Buffer Overflow

MIME Conversion

Overflow Binary Resource File

Buffer Overflow via Symbolic Links

Overflow Variables and Tags

Buffer Overflow via Parameter Expansion

Buffer Overflow in an API Call

Buffer Overflow in Local Command-Line Utilities

Github Advisory

support.citrix.com

macos

ipados

iphone_os

Out-of-bounds Write

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

macOS

Apple

iOS and iPadOS

An out-of-bounds write issue in file processing that was addressed with improved bounds checking. Processing a maliciously crafted file may lead to arbitrary code execution.

The exploit generates a malicious file with crafted size/offset fields that bypass bounds checking in the target application's file parser, causing an out-of-bounds heap write. When the victim opens or processes the file, the controlled heap corruption is triggered, allowing arbitrary code execution with the application's privileges.

An out-of-bounds write issue was addressed with improved bounds checking. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

An out-of-bounds write vulnerability in Apple iOS, iPadOS, and macOS allows arbitrary code execution when processing maliciously crafted files, with a CVSS score of 8.8 (High). **Apple has confirmed this vulnerability has been actively exploited in highly sophisticated, targeted attacks against specific individuals on iOS versions prior to iOS 27.** Successful exploitation could result in complete system compromise with high impact to confidentiality, integrity, and availability, making immediate patching critical to prevent further targeted attacks.

Improper Input Validation

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that allows command execution.

Server Side Include (SSI) Injection

Cross Zone Scripting

Command Line Execution through SQL Injection

Object Relational Mapping Injection

SQL Injection through SOAP Parameter Tampering

Subverting Environment Variable Values

Format String Injection

LDAP Injection

Input Data Manipulation

Flash Injection

XSS Using MIME Type Mismatch

Exploiting Trust in Client

File Content Injection

Serialized Data with Nested Payloads

Oversized Serialized Data Payloads

XML Injection

Impair Command History Logging

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable

sharepoint_server

Improper Control of Generation of Code ('Code Injection')

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Microsoft SharePoint Server 2019

Microsoft

Microsoft SharePoint Enterprise Server 2016

Microsoft SharePoint Server Subscription Edition

Code Injection

Leverage Executable Code in Non-Executable Files

Manipulating User-Controlled Variables

The exploit chains two distinct vulnerabilities: an unauthenticated anonymous-viewing bypass to reach ToolPane processing on WebPartPages like AddGallery.aspx in edit mode, combined with a SafeControls quote-injection gadget to bypass deserialization protections and load attacker-controlled assemblies. Two serialized payloads are delivered sequentially—the first disables the ActivitySurrogateSelector type check, the second loads an encrypted assembly via an ActivitySurrogate gadget chain.

msrc.microsoft.com

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.


chrome

Heap-based Buffer Overflow

Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Chrome

Google

Buffer overflow in ANGLE (a graphics abstraction layer) in Google Chrome on Android prior to version 154.0.8037.92 allows remote code execution outside the sandbox via a crafted HTML page.

Forced Integer Overflow

bugzilla.redhat.com

Google Chrome chrome-154.0.8037.92

chromereleases.googleblog.com

satori

next.js

Improper Encoding or Escaping of Output

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.

vercel

Satori library does not properly escape certain values before including them in generated SVG output, allowing crafted values to be interpreted as SVG markup.

User-Controlled Filename

Web Logs Tampering

AJAX Footprinting

The exploit crafts a malicious SVG payload containing unescaped XML entity expansion and XInclude directives that exploit Satori's improper escaping of HTML/CSS values. When the target's next/og endpoint processes this payload with Satori, the embedded ROP gadget addresses encoded as SVG path coordinates trigger a buffer overflow that executes arbitrary shell commands via execve.

The exploit crafts malicious SVG markup containing XML entity expansion and ROP chain coordinates embedded in SVG path data. When Satori processes attacker-controlled content without proper escaping, the injected entities and path commands are rendered into the SVG output. If the target consumes this SVG (e.g., via rendering or further processing), the ROP gadgets execute arbitrary shell commands.

This script sets up a vulnerable Next.js server with a planted flag file, then starts the server listening on port 3000. The actual RCE exploit against Satori would be delivered separately by injecting SVG markup through Satori's unescaped HTML/CSS-to-SVG conversion, but this script only provisions the target environment.

Hitachi Coding Software Suite

Hidden Functionality

Use of Hard-coded Credentials

Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials.


This issue affects Hitachi Coding Software Suite: through 3.3.0.

Hitachi Industrial Equipment Systems

Hitachi Coding Software Suite contains a hidden functionality vulnerability that allows attackers to gain unauthorized access through hidden accounts or hard-coded credentials.

Search CVEs by ID

Trending vulnerabilities

Latest security advisories

Apache Security Advisories - 2026-09-30: 7 critical vulnerabilities amid 11 CVEs

Apache Security Advisories - 2026-09-29: 1 critical vulnerabilities amid 15 CVEs

Apache Security Advisories - 2026-09-28: 6 critical vulnerabilities amid 21 CVEs

Browse

Be the first to know about critical vulnerabilities