Threat database

A denial of service vulnerability (CVE-2026-95512) exists in the FreeType font rendering library's CID font loader due to repeated subroutine allocations. Red Hat has issued updated RPM packages for FreeType to address this issue in their Hardened Images. The vulnerability is rated medium severity. No active exploitation or detailed technical information about the flaw is provided. Updated FreeType packages version 2.14.3-2.1.hum1 are available from Red Hat.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including the opentelemetry-collector-k8s package version 0.161.0-0.1.hum1. This update addresses multiple vulnerabilities including CVE-2026-63209. The advisory does not provide detailed information on the nature of the vulnerabilities or specific fixes. No known exploits are reported in the wild. The update is available for aarch64 and x86_64 architectures.

Kener versions 4.0.0 through before 4.1.6 have an information disclosure vulnerability that allows unauthenticated attackers to access hidden or inactive monitor data. This occurs because certain dashboard API endpoints lack proper visibility filters, enabling attackers to retrieve sensitive details such as monitor names, descriptions, status, uptime history, and latency by supplying a known or guessed monitor tag.

UVdesk support-center-bundle versions before 1.1.3.3 contain an authorization bypass vulnerability in the rateTicket action. Authenticated customers can rate or change ratings on tickets owned by other customers by supplying arbitrary ticket IDs, due to lack of ownership verification.

Shopclass versions before 6.2.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows self-registered non-admin users to inject malicious JavaScript into item listing descriptions when the frontend TinyMCE editor is enabled. The injected scripts are saved without proper tag stripping and execute in the context of the site origin for any visitor viewing the affected listing. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.

Formwork versions prior to 2.3.13 contain a path traversal vulnerability in the BackupController. Authenticated users with backup download or delete permissions can exploit this flaw by supplying a specially crafted base64-encoded traversal payload. This payload bypasses PHP basename on Linux systems, allowing access to files outside the intended backup directory. The vulnerability enables reading or deleting arbitrary files on the server.

Showdown versions up to and including 2.1.0 contain a cross-site scripting (XSS) vulnerability in the makehtml link and image subparsers. The vulnerability arises because double quotes in destination URLs are not properly escaped when inserted into href and src attributes. This allows attackers to craft markdown links or images with embedded event handlers like onerror or onmouseover, which execute script when the rendered HTML is viewed. The CVSS 4.0 score is 5.3, indicating a medium severity vulnerability.

IDURAR ERP CRM versions up to 4.1.1 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can upload SVG files containing malicious JavaScript via profile update or settings upload endpoints. These scripts execute in the browsers of other users when the SVGs are served from the /public route. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1.

OpenLiteSpeed versions before 1.9.3 have a local privilege escalation vulnerability due to a TOCTOU race condition in the admin update script lsup.sh. This script runs update packages from a directory writable by the nobody user without verifying them, allowing an attacker with control over the nobody web process to replace the update package and execute arbitrary code as root during the next update.

Mooncake transfer engine versions before 0.3.12 contain an out-of-bounds read vulnerability in the readString function. This flaw allows unauthenticated attackers to crash the service by sending a zero-length handshake frame to the handshake port. The vulnerability affects versions prior to 0.3.12 and can be exploited remotely without authentication.

CVE-2026-105051 is a low-severity vulnerability in Irdeto's Denuvo Anti-Tamper product up to version 2026-03-04. It allows bypassing a hypervisor presence check through CPUID interception using specific drivers on AMD and Intel platforms. The vulnerability does not impact confidentiality or availability but may allow limited integrity compromise.

Zilliz Attu versions from 2.6.5 up to but not including 3.0.0 contain a vulnerability in the Playground feature that allows proxying arbitrary HTTP and HTTPS requests without requiring authentication. This missing authentication for a critical function could allow unauthorized users to misuse the proxy capability. The vulnerability has a medium severity with a CVSS score of 5.8.

Zilliz Attu versions from 2.6.5 up to but not including 3.0.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the Playground feature. This vulnerability arises from improper validation of unsafe equivalence in input, allowing proxying of requests to private IP addresses. The CVSS 3.1 base score is 4.0, indicating medium severity. There is no indication of active exploitation in the wild. No official patch or remediation details are provided in the available data.

Armatura One versions prior to 4.7.2 and 4.6.1 store database and message-broker credentials in an install configuration file encrypted with AES-128-CBC using fixed keys embedded in the software. These fixed encryption keys and initialization vectors are identical across all installations, allowing an attacker with access to the installation package and the encrypted configuration file to decrypt credentials. This vulnerability is classified as CWE-321 and has a high severity with a CVSS score of 8.4.

Armatura One contains a vulnerability where its database initialization routine uses a fixed, vendor-defined password for the database superuser account instead of generating a unique password per installation. This allows anyone with operating system access and knowledge of the fixed password to authenticate as the database superuser if the password has not been changed. The vulnerability affects versions prior to 4.6.1 and 4.7.2. It has a high severity with a CVSS score of 8.4.

Kentico Xperience 13 versions prior to 13.0.216 have a vulnerability due to missing object-level authorization checks on administration API endpoints. This flaw allows users with limited privileges to perform direct requests that bypass intended access controls. The vulnerability is classified as CWE-425 (Direct Request or Forced Browsing).

Armatura One versions prior to 4.7.2 and 4.6.1 have a vulnerability where the backup and restore routine logs the full database connection command, including the superuser password, in plain text on the host. This exposure allows anyone with access to the server operating system to obtain credentials and potentially access the database.

Armatura One's message broker logs client connection credentials, including passwords, in plain text during normal operation. This allows any party with read access to these logs or related backups to obtain sensitive credential information. The vulnerability is identified as CWE-532 and affects versions prior to 4.6.1 and 4.7.2. The CVSS score is 4.0, indicating a medium severity issue with low impact on confidentiality and no impact on integrity or availability.

CVE-2026-95102 is a critical vulnerability in Monta's monta.app where WebSocket endpoints lack proper authentication. This allows attackers to impersonate charging stations, potentially gaining unauthorized access to sensitive data and performing unauthorized actions. The absence of authentication can lead to privilege escalation and compromise the system's security.

CVE-2026-105043 is a vulnerability in MathWorks Simulink before version R2026b where crafted .slx files can contain blocks that remain invisible in the Simulink Editor but trigger code execution. The vulnerability involves user interface misrepresentation of critical information (CWE-451). The CVSS score is 3.6, indicating a low severity risk. There is no indication of known exploits in the wild or available patches at this time.