Pexip Infinity versions 30.0 through 40.x before 41.0 contain a vulnerability due to improper input validation in the web server. This flaw allows a malicious attacker to cause resource exhaustion, rendering a Pexip Infinity node inaccessible. The vulnerability is classified under CWE-770, indicating allocation of resources without limits or throttling. The issue impacts availability but does not affect confidentiality or integrity.
Pexip Infinity versions prior to 40.1 contain a vulnerability due to improper input validation in the signaling implementation. This flaw allows an attacker to trigger a reachable assertion, causing the software to abort and resulting in a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability.
Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service.
A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/buku_tamu.php of the component Guest Book. This manipulation of the argument nama/email/pesan causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
This entry is a daily security news update from the SANS Internet Storm Center (ISC) titled 'ISC Stormcast For Wednesday, September 30th, 2026.' It provides a link to a podcast episode but contains no specific technical details or information about a security threat or vulnerability.
Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance.
Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations.
Top AI technology firms, including leaders from Google, Meta, OpenAI, Nvidia, and others, have signed a voluntary accord to self-police AI development. The agreement focuses on implementing internal controls, independent external audits, and board-level oversight, with the possibility of future regulation. The accord aims to balance innovation with safety but relies on voluntary compliance rather than enforceable legal measures. Some experts express skepticism about the effectiveness of self-policing and call for stronger regulatory frameworks. The accord does not introduce immediate security fixes or patches but signals industry commitment to addressing AI risks. The U.S. government, under former President Trump, supports AI growth without imposing restrictive guardrails. No direct cybersecurity vulnerability or exploit is described in this content.
The test-supply-npm-lib-4 package declares a dependency via a git URL pointing to a GitHub repository controlled by an individual account rather than the official npm registry. This dependency includes lifecycle scripts, such as a prepare hook, that run automatically during npm install. Because the code is fetched directly from GitHub and not vetted through the npm registry, it poses a risk of executing malicious code on the installer's machine.
The npm package 'itsmeeaizat-bailey' includes a dependency on 'libsignal' fetched directly from a GitHub repository without version or integrity constraints, allowing the code executed during installation to change unpredictably. Additionally, the package contains an undocumented behavior that, about 90 seconds after a WhatsApp session opens, automatically issues a follow request to a hardcoded newsletter ID owned by the package author. This action uses the installer's authenticated WhatsApp identity without explicit consent. No credential theft, data exfiltration, backdoors, or destructive actions are present in the code.
CVE-2026-102804 is an integer overflow vulnerability in the hexwave_init function of the stb_hexwave.h library within Nothings stb. The flaw occurs due to improper handling of the width or oversample arguments, which can lead to integer overflow. Remote exploitation is possible, and public exploit code is available. The vulnerability has a medium severity with a CVSS score of 6.5. The project has been notified but has not yet issued a patch or response.
CVE-2026-102805 is an integer overflow vulnerability in the Nothings stb library affecting image encoding functions. It impacts versions 1.0 through 1.16 and can be triggered remotely without authentication or user interaction. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9. Exploit code is publicly available, but no active exploitation has been confirmed.
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the file application/modules/admin/controllers/laporan_data_pasien.php. Executing a manipulation of the argument id_param can lead to authorization bypass. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
A path traversal vulnerability exists in the gedelumbung HospitalManagement software affecting the hapus function in application/modules/admin/controllers/data_galeri.php. This flaw allows remote attackers to manipulate the 'gbr' argument to perform path traversal. The vulnerability has a medium severity score of 5.1 and an exploit has been publicly released. The project uses continuous delivery with rolling releases, so no specific affected or fixed versions are identified. The vendor has not yet responded to the issue report.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically addressing vulnerabilities in the grafana12.4 package. The update fixes CVE-2026-93981, which affects versions prior to 12.4.10-0.10.hum1. No explicit CVSS score is provided, but the severity is assessed as high. The advisory includes updated RPMs for aarch64 and x86_64 architectures. No known exploits are reported in the wild, and no official fix beyond the update is mentioned.
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded traversal such as %2e%2e/ bypasses both the view-resolver check and the loader-side containment and reads files outside the configured template base directory.
Microsoft has released general availability of Linux container support in Windows Subsystem for Linux (WSL), enabling users to build, run, and deploy Linux containers directly on Windows. This new feature includes a command-line tool (wslc.exe) and an API for programmatic container management. It integrates with Microsoft Defender for Endpoint for enhanced security monitoring and with Microsoft Intune for administrative control over container usage. Additional features such as container restart, file copying, health checks, and network commands are now supported. Docker Compose-style support is in development. This release is a feature enhancement rather than a security vulnerability.
The npm package web-vitals-polyfill-core-v1 version 1.0.0 is a malicious package masquerading as a legitimate web-vitals polyfill. It contains obfuscated code designed to hijack end-user navigation by loading a service worker that redirects users to attacker-controlled destinations resolved dynamically via DNS-over-HTTPS and fallback paste sites. The package lacks any legitimate library code and is intended to compromise any system where it is installed. Systems with this package installed should be considered fully compromised.
A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.
An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.