Overview
Google Brotli
Open AI and Node.js have released security notices regarding a recent, actively exploited, critical vulnerability within the Google Brotli decoder. Successful exploitation of the vulnerability could enable an unauthenticated attacker to corrupt the decoder state memory, disclose sensitive memory content, cause a denial of service, or execute arbitrary code.
- CVE-2026-111497 – Unchecked Return Value Vulnerability – CVSSv4.0 Score: 9.2
Affected versions:
- Google Brotli 1.0: all versions affected from 1.0.3 before 1.0.10
- Google Brotli 1.1: affected from 1.1.0 before 1.1.1
- Google Brotli 1.2: affected from 1.2.0 before 1.2.1
To view patched releases for Node.js, Bun, Envoy Proxy, and Istio, please visit OpenAI’s security notice.
MLflow
MLflow has released a security advisory regarding a critical vulnerability impacting their platform. The vulnerability is fully exploitable on authentication-disabled deployments of MLflow, and requires minimal privilege on authentication-enabled deployments. If an exploit attempt is successful, then all data, credentials, network access, and file systems available to the MLflow server process are at risk.
- CVE-2026-116692 – Remote Code Execution Vulnerability – CVSSv3.1 Score: 9.8
Affected Versions:
- MLflow: all versions affected from version 3.12.0rc0 until version 3.17.0
Adobe Connect
Adobe has published a new security bulletin regarding their priority updates to patch a critical vulnerability impacting both Adobe Connect Desktop and Mobile. If the vulnerability is successfully exploited by an attacker, then arbitrary code could be executed in the context of the victim. Interaction is required for this exploit, meaning a user must visit a maliciously crafted URL or interact with a compromised webpage to fall victim to the exploit.
- CVE-2026-48360 – Improper Control of Generation of Code – CVSSv3.1 Score 9.6
Affected Versions:
- Adobe Connect Desktop Windows: version 2026.8.51 and below
- Adobe Connect Desktop Mac Silicon: version 2026.08.45 and below
- Adobe Connect Desktop Mac Intel: version 2026.01.39 and below
- Adobe Connect Mobile: version 4.4 and below.
Recommended Action
Organisations are encouraged to review the appropriate security advisory pages and apply the updates:
Google Brotli: OpenAI Security Notice & Node.js Security Notice
ML Flow: MLflow Security Advisory | GitHub
Adobe Connect: Adobe Security Bulletin