A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can overflow stack buffers causing a crash of the weblinker daemon.
An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges when their remote SSH session closes.
Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering during service bring-up, leading to a persistent Denial of Service (DoS) of the administrative web interface.
The Super Forms – Drag & Drop Form Builder plugin for WordPress contains a critical vulnerability (CVE-2026-17609) that allows unauthenticated attackers to recursively delete arbitrary directories on the server. This affects all versions up to and including 6.3.316. The issue arises from insufficient validation of attacker-controlled JSON fields and a bypassable ABSPATH guard, enabling directory deletion when the 'Delete files from server after form submissions' setting is enabled by an administrator.
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions string from _super_elements post meta verbatim as the allowed MIME type map. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The attack requires a preceding step: poisoning the _super_elements post meta via the super_save_form AJAX handler, which lacks a capability and nonce check but requires the attacker to be authenticated as at minimum a Subscriber-level user; the subsequent file upload via super_upload_files requires no authentication at all.
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.
An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associated with the target account. Malformed account names previously accepted by Fabric OS can cause the execution of embedded shell metacharacters, triggering command injection.
CVE-2026-94586 is a command injection vulnerability in the WebTools administrative interface of Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. An authenticated user with configuration download permissions can exploit this flaw to execute arbitrary shell commands with root privileges on the switch. The vulnerability has a high severity rating with a CVSS score of 8.5.
CVE-2026-94581 is an OS command injection vulnerability in the REST API management interface of Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. An authenticated attacker with high privileges who can configure SSH known host settings may execute arbitrary system commands with root permissions by supplying crafted parameters containing shell metacharacters.
CVE-2026-94577 is a privilege escalation vulnerability in Brocade Fabric OS affecting versions before 9.2.2d and 10.0.0 through 10.0.0a1. It involves improper authorization handling in the internal CLI, allowing an authenticated user or local process to bypass RBAC checks and gain root privileges.
CVE-2026-87664 is a high-severity vulnerability in Brocade Fabric OS affecting versions prior to 9.2.2d and versions 10.0.0 through 10.0.0a1. It involves a session context forgery in the web management daemon where local IPC storage callbacks are accepted without verifying the sender's identity. This allows attackers to gain elevated administrative privileges on the web management interface without proper authentication.
CVE-2026-87663 is an authentication bypass and command injection vulnerability in Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. The flaw exists in the inter-switch remote execution service, where commands received from fabric-connected switches are processed with elevated privileges without proper parameter verification. This allows an attacker on a connected switch to escalate privileges and execute arbitrary root commands locally or on other managed fabric members with remote execution enabled.
CVE-2026-87662 is an OS command injection vulnerability in Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. The flaw arises from unsanitized parameter strings used in processing upgrade requests, allowing attackers to execute arbitrary shell commands with elevated privileges of the firmware management daemon.
Magic: The Gathering Arena (Windows/Steam client) versions 2026.59.30.12801.127931.6 and certain later 2026.60.x builds have a vulnerability where a server-supplied URL from the home-screen carousel is passed directly to the Windows shell without validating the URI scheme or domain. This can allow an attacker controlling carousel content to invoke arbitrary registered URI-scheme handlers on client hosts without user interaction. The vulnerability is classified as CWE-99 (Improper Control of Resource Identifiers) and has a low CVSS score of 3.4.
An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the utility fails to sanitize user-supplied search string options before passing them to internal search commands. An authenticated user with low-privilege administrative access can exploit this vulnerability to read arbitrary files on the local operating system, including sensitive configuration files, system password hashes and system secrets.
CVE-2026-87666 is an OS command injection vulnerability in Brocade Fabric OS affecting versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. It occurs in the time and zone management subsystem when updating system timezone settings via the REST API or configuration download routines. The system fails to properly sanitize input, allowing an authenticated low-privilege administrative user to execute arbitrary shell commands with elevated privileges by submitting crafted timezone strings containing shell metacharacters.
CVE-2026-107445 is a medium severity vulnerability in Red Hat Hardened Images affecting the Katello component. It involves improper authorization enforcement in the Flatpak Remote Repositories API, allowing an authenticated user with permission to view flatpak remotes in one organization to access repository information of another organization. This flaw also affects the mirror action, potentially enabling repository creation with another organization's remote URL and stored credentials.
CVE-2026-107444 is an authorization bypass vulnerability in Red Hat Hardened Images related to the Katello Docker Tags repositories API. An authenticated user with permission to view products in one organization can retrieve repository metadata of Docker tags from another organization by supplying the tag identifier. This leads to unauthorized disclosure of repository configuration information across organization boundaries. The vulnerability has a CVSS score of 4.3 (medium severity).