Quest Diagnostics, a major American clinical laboratory company, disclosed a data breach involving unauthorized access to its Quanum LSM system, resulting in exposure of patient records. The breach was confirmed publicly but specific technical details and affected versions were not provided. No known exploits or active attacks have been reported. The incident highlights risks to sensitive healthcare data due to unauthorized system access.

Quest Diagnostics experienced a data breach where a threat actor gained unauthorized access to its Quanum LSM system, exposing patient records. The disclosure does not include detailed technical information about the breach vector, exploited vulnerabilities, or affected software versions. There is no indication of known exploits in the wild or further technical indicators. The breach involves sensitive healthcare data, raising concerns about patient privacy and regulatory compliance.

Bleeping Computer

Quest Diagnostics, a major American clinical laboratory company, disclosed a data breach involving unauthorized access to its Quanum LSM system, resulting in exposure of patient records. The breach was confirmed publicly but specific technical details and affected versions were not provided. No know

Original Source

Quest Diagnostics confirms data breach exposed patient records

Microsoft announced that Windows Server 2016 will reach its end of support in January 2027, after which it will no longer receive security updates or patches.

Windows Server 2016 will stop receiving security updates from Microsoft starting January 2027, marking the end of its official support lifecycle. This means that any newly discovered vulnerabilities in this operating system version will not be addressed by Microsoft through patches or security fixes.

Microsoft: Windows Server 2016 reaches end of support in January

recipes

Tandoor Recipes versions from 2.0.0 up to but not including 2.7.0 contain a server-side request forgery (SSRF) vulnerability in the Pestle importer. This flaw allows authenticated low-privileged users to craft malicious image URLs in Pestle JSON import files that cause the server to issue arbitrary GET requests. The vulnerability arises from a raw requests.get call that bypasses the application's centralized SSRF protections, enabling attackers to access internal-only endpoints, perform port and service discovery, and exfiltrate internal responses via stored recipe images.

CVE-2026-115810 is a server-side request forgery vulnerability in Tandoor Recipes before version 2.7.0, specifically in the Pestle importer component. Authenticated users with low privileges can exploit this by embedding malicious image URLs in Pestle JSON import files. The vulnerability stems from the use of a raw requests.get call in cookbook/integration/pestle.py, which circumvents the application's centralized SSRF filter. This allows attackers to make the server send GET requests to arbitrary internal or external hosts, potentially reaching internal-only endpoints, conducting port and service discovery, and exfiltrating internal responses through stored recipe images.

CVE Database V5

Tandoor Recipes versions from 2.0.0 up to but not including 2.7.0 contain a server-side request forgery (SSRF) vulnerability in the Pestle importer. This flaw allows authenticated low-privileged users to craft malicious image URLs in Pestle JSON import files that cause the server to issue arbitrary 

CVE-2026-115810: Server-Side Request Forgery (SSRF) in TandoorRecipes recipes

node

A vulnerability in Node.js affects the internal entropy caches used by crypto functions such as crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() when user-land startup snapshots or single executable applications are built with useSnapshot. If these functions are called during snapshot creation, the cached random values are reused across processes started from that snapshot, causing collisions and predictability of supposedly unique identifiers. This impacts Node.js versions 22.23.3, 24.22.0, and 26.12.0.

CVE-2026-106074 is a vulnerability in Node.js where the internal entropy caches for crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() are saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot. When these functions or dependent APIs like URL.createObjectURL() are invoked during snapshot creation, the cached random values are reused in every process started from that snapshot until the cache is refilled. This results in up to 127 UUIDs and about 1,000 randomInt() values being identical across processes, leading to collisions of identifiers expected to be unique and predictability of values across processes. The affected versions are Node.js 22.23.3, 24.22.0, and 26.12.0.

A vulnerability in Node.js affects the internal entropy caches used by crypto functions such as crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() when user-land startup snapshots or single executable applications are built with useSnapshot. If these functions are called during snaps

CVE-2026-106074: CWE-330 Use of Insufficiently Random Values in nodejs node

Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain a flaw in the filesystem permission model where fs.realpathSync() does not enforce required read permission checks. This incomplete fix of a previous vulnerability allows code running with restricted filesystem read permissions to bypass these restrictions and access filesystem paths outside permitted directories. The vulnerability has a low severity score and does not impact integrity or availability.

CVE-2026-106073 is a vulnerability in Node.js affecting versions 22.23.3, 24.22.0, and 26.12.0. The issue arises because fs.realpathSync() lacks proper read permission enforcement under the Node.js permission model, allowing code running with restricted --allow-fs-read permissions to check file existence, resolve symbolic link targets, and enumerate filesystem paths outside allowed directories. This is an incomplete fix of CVE-2026-21715, which only addressed fs.realpathSync.native(). The vulnerability has a CVSS 3.0 base score of 3.3 (low severity) with local attack vector, low complexity, low privileges required, no user interaction, and limited confidentiality impact.

Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain a flaw in the filesystem permission model where fs.realpathSync() does not enforce required read permission checks. This incomplete fix of a previous vulnerability allows code running with restricted filesystem read permissions to bypass these r

CVE-2026-106073: CWE-284 Improper Access Control - Generic in nodejs node

CVE-2026-73327 is a path traversal vulnerability in Joomla! CMS version 6.1.1 affecting the com_joomlaupdate extension. The vulnerability arises when a Super User extracts a crafted ZIP archive containing filenames with parent-directory segments or absolute paths. This causes the extraction routine (extract.php) to write files outside the intended destination root directory. Attackers can leverage this to plant malicious PHP files, resulting in persistent remote code execution. The CVSS 4.0 score is 8.7, indicating a high severity with network attack vector, high complexity, and requiring high privileges and user interaction.

Detailed information about CVE-2026-73327: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Joomla Joomla! CMS affecting Joomla

CVE-2026-73327: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Joomla Joomla! CMS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-73327 has been rejected

Official rejection reason