Android Security Bulletin—November 2026

Apache Security Advisories - 2026-11-02

Apache Security Advisories - 2026-11-01

node.js

brotlicffi

industrial_edge_cloud_connector_configurator

edge_opc_ua_server_configurator

data_flow_monitoring

industrial_edge_management_cloud

industrial_edge_databus_configurator

flow_creator_configurator

common_configurator

ruggedcom_ape1808_firmware

industrial_edge_hub

7-zip-zstd

.net

woff2

brotli

istio

debian_linux

duckdb

p7zip

envoy

arrow

edk2

clickhouse

Unchecked Return Value

Out-of-bounds Write

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.





Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Brotli

Google LLC

Google

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 allows an attacker to corrupt adjacent decoder state memory using a crafted Brotli-compressed stream. The vulnerability can result in sensitive memory disclosure, denial of service, or arbitrary code execution.

The tool builds seed brotli streams with the Python brotli package, mutates metablock headers (preferentially NBLTYPES block-switch fields) and other bytes, and feeds candidates to a local Node.js zlib decoder in a child process to detect crashes. Separately, it can deliver a chosen stream to a remote HTTP endpoint with Content-Encoding br and interpret the response for crash or decoder-error signals. The code does not demonstrate memory corruption, code execution, or information disclosure on a vulnerable build.

The script builds a Brotli stream that drives the decoder into a large repeated-command loop (1<<24 commands with fixed distance extra bits), sends it to a loopback service over a framed protocol, then sends a crafted 127-byte second-stage buffer. It then checks whether the service still responds to PONG to determine whether a denial of service occurred.

The PoC POSTs four crafted Brotli byte sequences to /api/ingest with Content-Encoding br and classifies the HTTP response, treating a 200 or a non-patched 500 error as a sign of the claimed decoder flaw. The demo server decompresses the body via zlib and returns the result or the error. The flow only detects a response difference; it does not demonstrate memory corruption, disclosure, or code execution.

The code parses Brotli stream headers, mutates NBLTYPES fields, header bits, MLEN, or truncates streams to produce malformed payloads, then feeds them to Node.js zlib decompression (sync, async, streaming, and via HTTP fetch) to observe crashes or errors. The flow is a fuzzing and reproduction harness; it does not demonstrate memory corruption or code execution. The claimed out-of-bounds write is asserted in comments and is not shown to be triggered.

Github Advisory

bugzilla.redhat.com

Microsoft

Palo Alto Networks

IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js

HPSBHF04161

Out-of-bounds write in .NET allows an unauthorized attacker to elevate privileges over a network.


connect_secure

Authentication Bypass by Spoofing

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Connect Secure

Ivanti

Authentication bypass by spoofing in Ivanti Connect Secure before version 25.1.3.0 allows remote attackers to execute arbitrary commands. Versions 22.7R2.14 and prior are not impacted.

Exploitation of Trusted Identifiers

Exploiting Trust in Client

Creating a Rogue Certification Authority Certificate

Web Services API Signature Forgery Leveraging Hash Function Extension Weakness

Signature Spoof

Signature Spoofing by Misrepresentation

Session Credential Falsification through Prediction

Reusing Session IDs (aka Session Replay)

Bluetooth Impersonation AttackS (BIAS)

Adversary in the Middle (AiTM)

Access Token Manipulation

Create Process with Token

Web Session Cookie

Adversary-in-the-Middle

hub.ivanti.com

E8450

e8450_firmware

Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based Buffer Overflow

A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Linksys

Stack-based buffer overflow in the strcpy function of /www/cgi-bin/portal.cgi in Linksys E8450 1.2.00.360516 through manipulation of the hidden_timezone argument.

Buffer Overflow via Environment Variables

Overflow Buffers

Buffer Manipulation

Client-side Injection-induced Buffer Overflow

Filter Failure through Buffer Overflow

MIME Conversion

Overflow Binary Resource File

Buffer Overflow via Symbolic Links

Overflow Variables and Tags

Buffer Overflow via Parameter Expansion

Buffer Overflow in an API Call

Buffer Overflow in Local Command-Line Utilities

WN536AX6-A

A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

WAVLINK

A stack-based buffer overflow vulnerability exists in the OpenVPN Handler component of WAVLINK WN536AX6-A. The vulnerability is triggered through improper input validation in the strcpy function when processing the openvpn_ip argument in the /protocol.csp file.

DJ-Classifieds extension for Joomla

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.

dj-extensions.com

An SQL injection vulnerability exists in the Joomla extension DJ-Classifieds versions prior to 3.11.3, affecting the frontend search functionality.

Command Line Execution through SQL Injection

Object Relational Mapping Injection

SQL Injection through SOAP Parameter Tampering

Expanding Control over the Operating System from the Database

SQL Injection

Blind SQL Injection

Control Web Panel

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.

Control Web Panel (CWP) before version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module. The flaw exists in the acc=deletedp action where the file POST parameter receives unescaped user input that is passed directly into a shell_exec call, allowing attackers to execute arbitrary commands in the user panel context.

Command Delimiters

Exploiting Multiple Input Interpretation Layers

Argument Injection

OS Command Injection

Reboot Restore Standard

A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit is publicly available and might be used. A fix is planned for the upcoming release.

Horizon DataSys

A memory corruption vulnerability exists in the function sub_23908 within the shield.sys kernel driver component of Horizon DataSys Reboot Restore Standard up to version 13.2. A publicly available exploit for this vulnerability exists.

A local user-mode process talks to the EAZShield kernel driver through a custom IOCTL that performs arbitrary 8-byte kernel reads and writes. It uses these primitives to locate the ntoskrnl base by scanning for PE headers, resolves PsInitialSystemProcess, and copies the SYSTEM token pointer into its own EPROCESS. The process then spawns a shell that runs with SYSTEM privileges.

Improper Certificate Validation

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

Canonical

Improper certificate validation in the HTTPS listener allows attackers to bypass authentication mechanisms by presenting a crafted certificate chain, enabling unauthorized access to the LXD cluster and managed virtual machines.

Signature Spoofing by Improper Validation

Search CVEs by ID

Trending vulnerabilities

Latest security advisories

Android Security Bulletin—November 2026: 10 critical vulnerabilities amid 216 CVEs

Apache Security Advisories - 2026-11-02: 0 critical vulnerabilities amid 8 CVEs

Apache Security Advisories - 2026-11-01: 0 critical vulnerabilities amid 5 CVEs

Browse

Be the first to know about critical vulnerabilities