CVE-2026-103093: authenticated admin can bypass Rhino sandbox restrictions in ServiceNow AI Platform to execute arbitrary code on the underlying host OS (sandbox escape). CVE-2026-103094: plaintext user passwords may be persisted in a system table, enabling credential disclosure to unintended users. Affects releases before specified patches/hotfixes; apply ServiceNow security updates/upgrade to patched releases to mitigate.

AJ-Report `

Unsafe deserialization in Apache MINA org.apache.mina:mina-core codec module JavaNativeMessageDecoder calls ObjectInputStream.readObject() on untrusted frame bytes without a class filter. A remote peer can trigger gadget-chain RCE when the decoder is exposed to untrusted clients. Affected: 3.0.0 through 3.0.0-M2. No fix planned for 3.0. Migrate to Apache MINA 2.2.x.

Improper certificate validation in the LXD HTTPS listener lets a remote unauthenticated attacker present a crafted certificate chain to authenticate as any trusted client, gaining full access to the cluster and managed VMs. Affects lxd `4.0.14-

SQL injection in Django raster lookups on RasterField (PostGIS-only) lets remote attackers inject SQL via the band index parameter in raster queries. Affects Django 6.0 < 6.0.2, 5.2 < 5.2.11, 4.2 < 4.2.28 (unsupported 5.0.x/4.1.x/3.2.x may also be affected).The vulnerability was disclosed and fixed in February 2026, and has been actively exploited now. Upgrade to 6.0.2, 5.2.11, or 4.2.28 to mitigate.

Jpom auth bypass lets remote unauthenticated attackers gain super-admin by injecting query conditions into the JPOM-USER-TOKEN header (e.g., is not null) that Hutool’s Condition parser treats as an operator. Affects dromara Jpom 2.10.0 through 2.11.12 (pkg:maven/org.dromara.jpom/server). Attackers can execute commands via Jpom script features.