Nov 6, 2026
1 new incident, 1 with updates.
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Started
- LivePatched
Foxit Workspace: SSRF in file upload and PDF export plus stored XSS in file share preview (CVE-2026-119431, CVE-2026-119433, CVE-2026-119432)
On Nov 6 2026 Foxit updated its hosted Foxit Workspace service (https://ai.foxit.com/) for three Important issues. CVE-2026-119431 and CVE-2026-119433 are server-side request forgery flaws in the file-upload and PDF-export flows: insufficient validation of user-supplied URLs and network parameters could let an authenticated attacker make the service fetch arbitrary internal or external resources and return their contents (CVSS 3.0 7.7). CVE-2026-119432 is a stored cross-site scripting bug in file share preview: an attacker could upload a crafted file, share it, and when a victim opens or previews it the script runs in the application origin and may access locally stored credentials (CVSS 3.0 8.7). Foxit rates all three Important and says no customer action is required; the hosted service is already patched. Reported by mrfathoni.
Foxit Workspace (https://ai.foxit.com/)Since Nov 6, 2026
Updated
- LiveMediumPartly patched
AO3 (Archive of Our Own) down for 2-4 weeks after security incident; user database theft not ruled out
The Organization for Transformative Works (OTW) took Archive of Our Own (AO3), the large fan-fiction site, offline on Oct 29 for what it first called maintenance, then said it had detected evidence of a security incident. OTW says no AO3 data was deleted and it does not currently believe the user database was stolen, but cannot rule it out. That database may hold usernames, email addresses, IP addresses and hashed passwords. AO3 does not collect real names, and donor data is in a separate system that was not exposed. The site is expected to stay down for at least two weeks and up to four.
Archive of Our Own (archiveofourown.org)Since Oct 29, 2026
