A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. This issue can cause applications relying on the library to crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.
CVE-2026-106064 is a heap-based buffer overflow vulnerability in the GIF export plug-in of GIMP on Red Hat Enterprise Linux 10. The issue arises when exporting images with very large dimensions, causing a 32-bit integer overflow during pixel buffer size calculation. This leads to allocation of a smaller buffer than needed, while the actual image data written exceeds this buffer, resulting in memory corruption. The vulnerability has a CVSS score of 6.3, indicating medium severity, with potential impact on integrity and availability. No explicit affected versions or patch information is provided in the available data.
PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.
CVE-2026-107202 is a critical OS command injection vulnerability in the jonssonyan h-ui administrative API version 0.0.25 and below. It arises from improper validation of the listen configuration field, allowing an authenticated administrator to inject arbitrary OS commands with root privileges. The vulnerability occurs because the application uses unvalidated input to construct nftables/iptables rules executed via bash -c as root.
A use-after-free and double free vulnerability exists in llama.cpp before commit b11393 in the common_chat_peg_mapper::map function. This flaw allows unauthenticated remote attackers to corrupt heap memory by submitting a crafted POST /completion request with a dangling current_tool pointer. Exploitation can cause the llama-server to crash and potentially enable heap memory manipulation.
Telegram Desktop versions before 7.2.9 have an IPC record-separator injection vulnerability in the Core::Sandbox component. This flaw allows remote attackers to inject specially crafted tg:// links containing unescaped semicolons, leading to the injection of OPEN: records. Exploitation can enable attackers to upload local files, including sensitive tdata session keys, to an attacker-controlled channel, potentially resulting in account takeover.
Southern Company has disclosed a data breach affecting approximately 400,000 customer accounts across its electric utilities Georgia Power, Alabama Power, and Mississippi Power. An unauthorized third party accessed limited customer account information via the company's online customer portal. The compromised data includes names, mailing addresses, phone numbers, emails, last four digits of Social Security numbers, and other basic account details. Sensitive financial information such as bank account numbers, payment card numbers, and driver’s license numbers were not accessed. The company has notified affected customers and is offering one year of free credit monitoring. The breach was detected and stopped promptly, with law enforcement engaged. Details about the intrusion timeline and attack vector have not been disclosed.
A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address this issue. Upgrading the affected component is advised.
Ransomware groups are increasingly targeting backup infrastructure to eliminate recovery options and increase pressure on victims to pay ransom. Attackers use compromised credentials to access and destroy backups, including those stored offsite or in disaster recovery locations, if these share access controls. This trend highlights the need for isolated, immutable backups with strict access controls and regular restore testing to ensure recovery capability.
wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error. Because `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with no user filter, the attacker's injected data is silently folded into the victim's progressive-overload calculations, corrupting their auto-generated weight and repetition targets. Version 2.6 contains a patch.
wger versions prior to 2.6 contain an improper authentication vulnerability where bearer-style API tokens remain valid after user logout or password change. This allows an attacker with a stolen token to continue accessing protected API endpoints until the token expires or is manually revoked. Version 2.6 includes a patch to address this issue.
wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding any one of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. Version 2.6 fixes the issue.
CVE-2026-107194 is a critical authentication bypass vulnerability in Sungrow iSolarCloud versions prior to 2026-08-25. The flaw allows attackers to bypass authentication and potentially take over accounts by using a specific login parameter "login_type":"5". Exploitation could lead to severe consequences, including local blackouts across Europe. The vulnerability involves improper authentication handling and exposure of user email addresses within parent organizations.
A core member of the Qilin ransomware group was arrested in Japan and extradited to Germany to face hacking charges related to ransomware attacks. Qilin, active since August 2022, is a prolific ransomware-as-a-service operation responsible for hundreds of attacks worldwide, causing significant financial and operational damage. The group has targeted various sectors including healthcare, logistics, and manufacturing, and exploited vulnerabilities such as CVE-2026-50751 in Check Point products. The arrest marks a law enforcement success against this ransomware gang.
A low severity argument injection vulnerability (CWE-88) was identified in the CUPS package, affecting multiple versions. Red Hat has issued an advisory with updated RPM packages to address this issue. The vulnerability has a CVSS score of 2.5, indicating low impact, primarily affecting confidentiality with limited attack vector and requiring low privileges. No known exploits are reported in the wild.
wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes `django_login()` without any CSRF protection, because Django's `CsrfViewMiddleware` only enforces tokens on unsafe methods (POST/PUT/PATCH/DELETE). An attacker can embed a single `<img>` tag on a malicious page; when an authenticated trainer loads that page, their browser auto-issues the GET with the session cookie, forcibly rebinding the trainer's session to an arbitrary user account. Version 2.6 fixes the issue.
wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed. Version 2.6 fixes the issue.
Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC).
CVE-2026-102257 is a high-severity Zip Slip vulnerability in the SonicWall SMA1000 Appliance Management Console (AMC) interface. It allows an attacker with high privileges to extract files outside the intended directory by using a specially crafted archive, potentially leading to remote code execution.
CVE-2026-102256 is a high-severity vulnerability in the SonicWall SMA1000 appliance involving improper neutralization of special elements in OS commands. This post-authentication flaw could allow a remote authenticated attacker with administrator privileges to execute arbitrary operating system commands, leading to remote code execution. The vulnerability requires authentication and low attack complexity. No specific affected versions or patch information is provided.