RCE in Plone and Hyperglass, plus Xen and X.Org flaws

Remote code execution dominated the day, with anonymous flaws in Plone and Hyperglass sitting alongside hypervisor bugs that cross the guest-host boundary. Display-server memory corruption and smaller Python library issues, including a project shutdown, filled out the list.

Plone hotfix for anonymous remote code execution

Plone published a security fix dated 20261110 for remote code execution affecting all supported versions. The disclosure describes chained issues that allow anonymous code execution. Sites still on supported Plone releases have an unauthenticated path to running code on the server until the hotfix is applied.

Unauthenticated RCE in Hyperglass on exposed ISP and hosting hosts

An oss-security disclosure reports unauthenticated remote code execution in Hyperglass, with follow-up from three participants. The issue affects exposed instances used by ISPs and hosting providers and can be used to root those hosts. Operators who publish a looking glass to the network should assume a reachable Hyperglass install is a direct compromise path.

Xen advisory on AMD IOMMU out-of-bounds device table read

Xen published Security Advisory 524 version 1, tracked as CVE-2024-21963, for an AMD IOMMU out-of-bounds device table read. The advisory describes the bug as enabling potential guest-to-host escalation. Xen hosts that rely on AMD IOMMU are the population that needs the corresponding fix.

X.Org X server EDID out-of-bounds write

X.Org forwarded a security advisory covering multiple issues in the X server, including an EDID out-of-bounds write tracked as CVE-2026-109091. Affected versions are xorg-server before 21.1.26 and Xwayland before 24.1.15. Memory corruption in EDID handling matters wherever the display server parses monitor data that is not fully trusted.

Guest can crash the host via xen-netback double unmap

Xen Security Advisory 532 version 1 (CVE-2026-99287) covers a double unmap of memory in Linux xen-netback. The flaw affects Linux 5.5 and later and can let a guest crash the host. It is a denial-of-service path from guest to host rather than a stated code-execution bug, but it still breaks isolation for virtualized deployments.

CPython imaplib STARTTLS can replay pre-handshake plaintext

CPython disclosed CVE-2026-115559 in imaplib. STARTTLS can serve plaintext bytes that were buffered before the handshake as if they had arrived over TLS, which allows plaintext injection into post-handshake responses. The issue is described as medium severity and affects applications that upgrade an IMAP connection with STARTTLS.

sqlparse 0.6.1 fixes injection bugs and ends the project

sqlparse 0.6.1 fixes two vulnerabilities, including a PHP injection CVE, and is the final release. The sole maintainer is ending the project over the volume of security reports. Downstream users get a last patch and then need another parser, because there will be no further security maintenance.

Timing leak in XAPI pool-secret comparison

Xen Security Advisory 529 version 2 (CVE-2026-102705) reports that XAPI uses a data-dependent compare for the pool secret. Unauthenticated attackers can use the timing side channel. Deployments that rely on the pool secret for XAPI authentication should treat the comparison leak as a credential-exposure risk even without a stated remote code execution path.