CVE-2026-77846 is a JSONPath injection vulnerability in AshSqlite versions 0.1.2-rc.0 through 0.2.17 that allows attackers to access hidden or sensitive fields stored in JSON columns by manipulating path construction through the get_path/2 function with untrusted input. Rather than SQL injection, the flaw exploits unsafe JSON path generation where unescaped special characters like dots and brackets enable traversal into nested objects that applications intended to keep private. Organizations using affected versions should upgrade to AshSqlite 0.2.18 or later and audit applications accepting user-controlled field-selection input to mitigate exposure of sensitive data.
Read full article at The Cyber Express ↗Named KindaRails2Shell, the arbitrary file read flaw allows attackers to extract secrets and execute arbitrary code remotely. The post Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek.
PaperCut released a second emergency patch for two chained zero-day vulnerabilities in its NG and MF print management servers after researchers demonstrated that the vendor's initial fix could be bypassed; the flaws enable pre-authentication remote code execution on internet-facing servers. CVE-2026-81578 (CVSS 8.8) is an improper access control weakness allowing unauthenticated requests to reach administrative functions, while CVE-2026-82078 (CVSS 9.4) is an unsafe dynamic class-loading flaw permitting arbitrary Java bytecode execution when configuration parameters are altered. Active exploitation has already been observed by Huntress in customer environments, with attackers performing reconnaissance activities that suggest access brokering ahead of potential ransomware deployment, and roughly 47% of tracked installations run older versions ineligible for patching.
A critical vulnerability in GiveWP, a widely used WordPress donation plugin, allows unauthenticated attackers to execute arbitrary commands on affected servers through a PHP object injection chain. Version 4.16.7.2 addresses this flaw, which was disclosed by Patchstack on August 28. WordPress administrators running vulnerable versions should update immediately to mitigate the risk of server compromise.
PaperCut has released a second emergency patch addressing actively exploited vulnerabilities tracked as CVE-2026-82078 and CVE-2026-81578. The dual CVE assignments indicate multiple distinct flaws requiring urgent remediation across affected deployments.