CVE-2026-47360 is a high-severity vulnerability in Apache HTTP Server's mod_session_cookie module affecting versions 2.4.0 through 2.4.68. The flaw allows exposure of sensitive session cookie information to unauthorized actors due to improper handling of the SessionCookieRemove setting during internal redirects. This can result in session cookies being passed incorrectly to backend servers.
CVE-2026-46729 is a NULL Pointer Dereference vulnerability in the Apache HTTP Server's mod_heartmonitor module when using the unicast listener. It affects Apache HTTP Server versions from 2.4.0 through 2.4.68. This vulnerability can cause a denial of service by crashing the server. The CVSS score is 7.5, indicating a high severity impact due to availability disruption.
CVE-2026-42528 is a medium severity vulnerability in Apache HTTP Server up to version 2.4.68. It is caused by a memory allocation bug in the mod_dav module that allows an attacker with permission to create WebDAV locks to crash server child processes. The vulnerability is fixed in version 2.4.69.
The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.
HCL BigFix Service Management has an information disclosure vulnerability where the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints. This could potentially aid attackers in planning further attacks. The vulnerability has a low severity score of 3.7 and does not affect system integrity or availability.
HCL BigFix Service Management has an information disclosure vulnerability due to an exposed API endpoint that reveals sensitive internal database information. This exposure could assist attackers in crafting targeted database attacks. The vulnerability has a medium severity rating with a CVSS score of 5.3. No affected versions or patch information are provided.
CVE-2026-56449 is an out-of-bounds write vulnerability in the mod_proxy_html module of Apache HTTP Server. It occurs when processing crafted HTTP response bodies, potentially causing a crash. This issue affects Apache HTTP Server versions from 2.4.0 up to and including 2.4.68 and several specific Ubuntu package versions. A patch is available to address this vulnerability.
In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a user to open a crafted Web UI link whose `aas` or `path` query parameter points to an attacker-controlled endpoint. The user's browser would then send the configured Basic Authentication credentials, Bearer token, or an available OAuth2 access token to that endpoint. The attacker could reuse the disclosed credential to access protected AAS services with the victim's privileges. The issue is fixed in v2-260924.
Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by an attacker who can estimate when the password was generated.
A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
CVE-2026-42356 is a vulnerability in Apache HTTP Server versions 2.4.60 through 2.4.68 where an internal redirect from CGI programs may cause the target to be incorrectly treated and executed as a CGI script. This occurs if the target is in a CGI-enabled directory and lacks another mod_mime-recognized extension. The vulnerability has a low severity rating with a CVSS score of 3.7.
Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teacher download` clones each student's assignment repository and then writes autograde artifacts (`result.json` and `results.json`) into the just-cloned working tree. The write followed symlinks, so a student who committed `result.json` or `results.json` as a **symlink** (materialized verbatim by `git clone`) could redirect the teacher's write to an arbitrary path — e.g. `~/.zshrc`, `~/.ssh/authorized_keys`, a cron file, or an in-clone `.git/hooks/*` file that git subsequently executes. The written bytes are attacker-controlled (the student's uploaded release asset for `result.json`; student-chosen submit-tag names for `results.json`). This is an arbitrary file write leading to code execution as the teacher, whose `gh` token carries `admin:org`, `repo`, and `workflow` across the entire classroom organization. Version 1.11.0 contains a patch. Some workarounds are available. Avoid running `gh teacher download` against untrusted student repositories, or run it inside a disposable sandbox / container with no access to sensitive host files or credentials. Inspect cloned trees for symlinked, hardlinked, or special (`result.json`/`results.json`) entries before allowing the artifact-refresh step to run.
Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing.
The 2026 Microsoft Digital Defense Report highlights trends in credential theft, phishing techniques including CAPTCHA-gated delivery, and rapid exploitation of container workloads. Credential theft remains a significant vector, with valid account intrusions often leading to further credential harvesting. Password attacks have declined, but session theft via phishing and token theft has increased. ClickFix-related malicious copy-and-paste intrusions surged significantly. Container workloads face exploitation attempts within hours of startup. A 2020 vulnerability (CVE-2020-1472) remains prevalent in detections. NTLM-related security cases have increased substantially in early 2026.
Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux. Although the daemon is normally restarted automatically, repeated requests can sustain the service interruption.
The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their verifiers in drivers/smbus/smbus_handlers.c validated only the dev argument with K_SYSCALL_OBJ(dev, K_OBJ_DRIVER_SMBUS) and forwarded the caller-supplied struct smbus_callback *cb pointer into kernel-mode driver code without any K_SYSCALL_MEMORY_READ/K_SYSCALL_MEMORY_WRITE validation. A companion change in 2023 had already removed the matching smbus_smbalert_set_cb() / smbus_host_notify_set_cb() syscalls for this reason, but the two removal syscalls were left exposed.
On a build with CONFIG_USERSPACE=y, CONFIG_SMBUS=y and a driver implementing the callback operations (drivers/smbus/intel_pch_smbus.c with CONFIG_SMBUS_INTEL_PCH_SMBALERT/CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY, or drivers/smbus/smbus_stm32.c with CONFIG_SMBUS_STM32_SMBALERT), any user-mode thread that has been granted the SMBus device object can invoke these syscalls with an arbitrary pointer. The value reaches smbus_callback_remove() in drivers/smbus/smbus_utils.h, which uses it as a node identity against the kernel's sys_slist_t of registered callbacks.
The consequence is that an unprivileged thread can unregister an SMBALERT or Host Notify callback that a supervisor-mode component registered, silently disabling alert handling for the rest of the system; because Zephyr images have fixed symbol addresses and the syscall returns 0 on a hit versus -ENOENT on a miss, the target address is both derivable and searchable. In builds with CONFIG_ASSERT=y the __ASSERT(callback->handler, ...) check additionally dereferences the caller-supplied address in supervisor mode, so a bogus pointer raises a kernel-mode fault and a fatal system error, and the fault/no-fault outcome discloses which addresses are mapped.
The fix removes both syscall entry points, demoting the two functions to ordinary static inline calls so that callback list manipulation is available only to supervisor-mode code. There is no impact on builds without CONFIG_USERSPACE, and no impact on configurations that do not enable an SMBus driver with SMBALERT or Host Notify support.
HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks.
HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery (CSRF), session hijacking via Cross-Site Scripting (XSS), and unauthorized access.
HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation.
HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle (MitM) attacks.