CVE-2026-40721

In Group-Office, the Contact/labels JMAP endpoint accepts an attacker-controlled tpl parameter passed without restriction to TemplateParser::parse(). When the template contains an [assign] block with a {{...}} variable reference, the engine calls eval() on the expanded expression, and the validation guard can be bypassed to invoke arbitrary PHP functions such as system("id"). A single authenticated HTTP request is sufficient to execute arbitrary OS commands as the web server user.

In rabbitmq-c before version 0.17.0, a heap buffer overflow exists when the public amqp_send_frame() API serializes an oversized AMQP_FRAME_BODY. amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application passing an oversized body frame can trigger a heap out-of-bounds write, causing a process crash and memory corruption.

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.

Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.

SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.

Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

Sandbox escape vulnerability due to use-after-free in the Widget: Gtk component of Firefox. It may allow bypassing process isolation. The vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

A sandbox escape due to a use-after-free exists in the IPC component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

A use-after-free in the DOM: Service Workers component of Firefox allows a sandbox escape. The vulnerability was fixed in Firefox 160.

Use-after-free vulnerability in the DOM: Service Workers component of Firefox enabling a sandbox escape. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.