A denial of service vulnerability exists in the perl-DBI package for Red Hat Enterprise Linux 8 due to an invalid memory read during numeric type casting. This issue affects multiple architectures including x86_64, ppc64le, and aarch64. Red Hat has rated this vulnerability as important and has released updated perl-DBI packages to address it.
Red Hat has released a security advisory for Red Hat Hardened Images RPMs addressing a vulnerability identified as CVE-2026-103111. The issue is related to the pcre2 packages and is categorized under CWE-787, indicating a potential out-of-bounds write vulnerability. The advisory does not provide detailed technical information or specify affected versions. No known exploits are reported in the wild. An update to version 10.49-0.1.hum1 of multiple pcre2-related RPMs is available and should be applied to mitigate the vulnerability.
The LatePoint Appointment Booking plugin for WordPress up to version 5.6.9 contains an authorization bypass vulnerability. Authenticated users with Subscriber-level access or higher can modify personal information of arbitrary customers due to insufficient ownership checks in the process_step_customer() function. This flaw allows attackers to change details such as first name, last name, email, phone, and notes. When the contact_merge setting is configured to 'phone', attackers can overwrite the victim's email address and potentially take over the account via password reset.
The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin user clicks the injected heatmap link.
The CEO of MonsterCloud, a ransomware remediation company, has been charged with defrauding ransomware victims by secretly paying attackers for decryptors while falsely claiming to use proprietary technology to recover encrypted data.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy authentication and an absolute-form target only from whether the URI is secure. Because ws is not marked secure, the tunneled WebSocket upgrade sent to the origin includes the proxy's Proxy-Authorization value. Basic credentials are directly recoverable and Digest responses can be replayed or cracked offline. This issue is fixed in versions 3.0.12 and 2.16.1.
HashiCorp Vault and Vault Enterprise versions prior to 2.1.2 (Community Edition) and certain 1.x Enterprise versions improperly handle case sensitivity when evaluating ACL policies. This flaw allows authenticated users with delegated permissions to bypass explicit deny restrictions, potentially accessing protected resources or assigning denied policies, leading to privilege escalation. The vulnerability is fixed in Vault Community Edition 2.1.2 and Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
Threat actors are increasingly leveraging Web3 decentralized blockchain architectures to enhance command-and-control (C2) infrastructure in cloud supply chain attacks. These attacks target developer workstations and CI/CD pipelines by poisoning open-source dependencies to steal ephemeral cloud credentials and establish persistence. Notable campaigns include the ChainDrop npm worm and the PolinRider campaign, which use Web3 smart contracts and multi-chain transaction queries to dynamically update malware infrastructure and evade traditional detection. DPRK-affiliated actors have been observed using these techniques in recent supply chain compromises. Defensive measures include restricting Web3 network connections where unnecessary, deploying endpoint and network protections, and automating policy controls across CI/CD environments.
CVE-2026-105820 is a path traversal vulnerability in HashiCorp Vault Enterprise's ACL policy cache. It allows tokens with specially crafted policy names containing path traversal constructs to access capabilities of policies in other namespaces, including the root namespace. This issue affects Vault Enterprise versions prior to 1.21.12 and has been fixed in versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition is not affected as it does not support namespaces.
CVE-2026-105816 is a path traversal vulnerability in HashiCorp Vault and Vault Enterprise that allows a privileged operator to execute arbitrary code on the Vault host when restoring an Integrated Storage (Raft) snapshot with an external plugin directory configured. The issue arises because Vault did not consistently verify that plugin catalog entries reference binaries only within the configured plugin directory. This vulnerability has a high severity score of 8.0 and is fixed in Vault Community Edition 2.1.2 and Vault Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
The FBI has issued a warning about ongoing FortiBleed attacks targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways. These attacks result in locking out legitimate administrators from their systems. The threat remains active as of the reported date.
AsyncHttpClient versions prior to 3.0.12 and 2.16.1 contain a vulnerability where the WebSocketHandler.upgrade method improperly processes WebSocket handshakes with missing or invalid Sec-WebSocket-Accept values. Although the handshake is aborted, the pipeline installation and onOpen event still proceed, allowing frames from an unverified peer to be decoded and delivered. This issue is resolved in versions 3.0.12 and 2.16.1.
AsyncHttpClient versions prior to 3.0.12 and 2.16.1 use a cryptographically weak pseudo-random number generator (ThreadLocalRandom) to generate the HTTP Digest client nonce (cnonce). This weak randomness reduces the security of the authentication exchange by making the nonce more predictable. The issue is fixed in versions 3.0.12 and 2.16.1.
CVE-2026-107282 is a critical vulnerability in the AsyncHttpClient (AHC) Java library that allows cleartext transmission of sensitive information. Versions prior to 3.0.13 and 2.16.1 have a flaw where cross-host request replay can cause the original host's sensitive data, including path, Host header, and Authorization credentials, to be sent to an unintended replay destination. This occurs due to improper updating of the target request and proxy context during failover and retry scenarios. The issue is fixed in versions 3.0.13 and 2.16.1.
HashiCorp Vault's PKI secrets engine ACME server had a vulnerability where it did not restrict certificate identities that were not validated by ACME challenges under the default directory policy. This could allow an ACME client to obtain a certificate with unverified identity claims, potentially enabling impersonation against systems trusting certificates from the affected Vault PKI mount. The issue is fixed in Vault Community Edition 2.1.2 and Vault Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
AsyncHttpClient versions prior to 3.0.13 and 2.16.1 contain an origin validation error affecting connection pooling with NTLM and Negotiate authentication. The connection pool key does not include the authenticated principal, allowing a pooled socket authenticated for one user to be reused by another, causing the server to execute requests under the wrong identity. Basic and Digest authentication methods are not affected. This vulnerability is fixed in versions 3.0.13 and 2.16.1.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent A-label normalization, locale-sensitive lowercasing, public-suffix host-only handling, and numeric or IP host checks allow one origin to store a cookie later sent to another origin. Applications sharing one client across trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation. This issue is fixed in version 3.0.14.
CVE-2026-107363 is a vulnerability in OpenStack Zaqar before version 23.0.1 affecting the WebSocket transport with Keystone authentication. It allows an authenticated user with a valid token for one project to substitute another project's UUID, enabling unauthorized enumeration, inspection, creation, or deletion of queues belonging to that other project. This results in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.
AsyncHttpClient versions prior to 3.0.13 and 2.16.1 contain a vulnerability in the ThreadSafeCookieStore where domain attributes are validated but public suffixes are not rejected. This allows a host under a public suffix (e.g., co.uk) to set cookies for the entire suffix, causing cookies to be shared across unrelated hosts. This can lead to injection or overwriting of session-relevant cookies across origins. The issue is fixed in versions 3.0.13 and 2.16.1.