RT-Thread versions through 5.3.0 have a memory corruption vulnerability in the legacy USB CDC virtual COM port driver. This flaw occurs because the rx_ringbuffer is aliased as a Serial V2 rt_serial_rx_fifo in the _function_enable() function. When a connected USB host configures the CDC device, it can cause writes beyond the ring buffer into adjacent memory structures and trigger an invalid rt_free() call upon device close. This results in a denial of service condition.
A local flaw exists in Yungengxin Cloud Billing 2024.11.28.11 within the IOCTL Process Termination component. The vulnerability involves insufficient access control on an ioctl exposed via manipulation of the Pid argument in the sub_14000443C function of the LWBilling64.sys library. Exploit code has been published, but the vendor has not responded or provided a fix. The CVSS score is 4.4, indicating a low severity impact primarily affecting integrity and availability without confidentiality loss.
A cross-site scripting (XSS) vulnerability exists in Cairo-dock Glx-Dock up to version 3.4.0 in the Query Parameter Handler component, specifically involving the manipulation of the 'p' argument in the ww_page.php file. This vulnerability can be exploited remotely and the exploit code is publicly available. The vendor has not responded to disclosure attempts. The CVSS score is 4.3, indicating a low severity issue.
A security vulnerability (CVE-2026-108831) exists in meetecho janus-gateway up to version 1.4.2. The issue is located in the Admin API component, specifically in the file html/demos/admin.js, where hard-coded credentials are present. This vulnerability can be exploited remotely and has been publicly disclosed. The CVSS 3.1 base score is 6.3, indicating a medium severity level. No patch or remediation information is currently available.
A vulnerability exists in Yungengxin Yun Jia Security Guard up to version 2.7.1.9 in the function sub_14000885C within the kgameprotect.sys library. The flaw involves improper privilege management caused by manipulation of the Pid argument. Exploitation requires local access. The vendor has not responded to disclosure requests. The CVSS score is 4.4, indicating a medium severity issue.
CVE-2026-105668 is a Protection Mechanism Failure vulnerability in hexpm hex versions 2.5.0 up to but not including 2.5.2. It allows a package owner or an attacker who has compromised the owner's account to bypass the release-age cooldown mechanism, enabling a newly published release to be selected during dependency resolution despite being younger than the configured cooldown period. This bypass occurs because the cooldown bypass check is based solely on package name, affecting packages with the same name across repositories. The vulnerability does not affect cooldowns configured through organization dependency policies.
The npm package @modss/libsignal contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
CVE-2026-108900 is a medium severity SQL injection vulnerability in Exponent CMS affecting versions 3.0.2patch1 and 3.0.2patch2. The flaw exists in the userLogin function of the xmlrpc.php file within the XML-RPC component. This vulnerability allows remote attackers to manipulate SQL queries, potentially compromising the database. The exploit has been publicly disclosed, but no vendor response or patch has been provided as of the publication date.
CVE-2026-105280 is a medium severity vulnerability in hexpm hex affecting versions from 0.20.2 up to but not including 2.5.2. It involves improper validation of integrity check values when fetching packages with the command mix hex.package fetch using standard output. This flaw allows a malicious package mirror to substitute altered tarball data that is written to standard output without checksum verification, potentially leading to untrusted content being processed. The vulnerability arises because the standard output branch bypasses the checksum comparison that is otherwise enforced when writing to a file. Additionally, error responses containing tar archives can be written to standard output before checksum verification, enabling extraction of untrusted files if the output is piped to an unpacking tool.
CVE-2026-96618 is a low severity vulnerability in hexpm hex affecting versions from 0.11.2 up to but not including 2.5.2. It involves improper handling of highly compressed data that can lead to excessive memory or disk space consumption when using commands like mix deps.get, mix deps.update, mix hex.package fetch, or mix hex.docs fetch. The vulnerability arises because hex processes untrusted mirrors without limiting the size of compressed or decompressed data, allowing a malicious mirror to cause resource exhaustion. This affects registry, package, docs, and API responses, with some paths lacking size limits or checksum verification. No known exploits are reported, and no official patch information is provided in the input data.
CVE-2026-109195 is an authorization bypass vulnerability in Red Hat Quay 3. An authenticated attacker can access repository auto-prune configurations from other namespaces due to improper enforcement of namespace scoping when retrieving policy details by repository name and policy identifier. Exploitation requires the attacker to manage a repository with the same name as the target and know the target policy's unique identifier. The vulnerability leads to unauthorized information disclosure but does not affect integrity or availability.
CVE-2026-109194 is an authorization bypass vulnerability in Red Hat Quay 3's build trigger management API. The API does not verify if a requested build trigger belongs to the specified repository, allowing an authenticated user with administrative access to any repository to access or modify build triggers and write tokens of other repositories if they know the trigger's UUID.
The npm package @mikudeveloper/libsignal-node contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the affected system. Immediate removal of the package is recommended, but due to potential persistent malicious software, complete remediation may require additional measures such as rotating all secrets and keys from a separate, trusted device.
A cyberattack targeted Danfoss refrigeration controllers at multiple French supermarket chains, remotely triggering the automatic defrost function and causing refrigerators to shut down. The attack affected between 250 and 350 stores, including major chains such as Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, resulting in significant financial losses and food waste. The Paris prosecutor's office has opened an investigation into the incident. While no direct link has been confirmed, a high-severity authentication bypass vulnerability (CVE-2025-41450) in Danfoss AK-SM 8xxA Series hardware was previously reported. Retail giant Ahold Delhaize also reported taking systems offline after a cybersecurity incident, though no confirmed connection exists.
The npm package @lekzo_dev/amprem contains malicious code that fully compromises any computer on which it is installed or running. The compromise may allow an attacker full control over the system, risking exposure of all stored secrets and keys. Immediate removal of the package is advised, but removal alone may not eliminate all malicious components. Secrets and keys should be rotated from a different, uncompromised machine.
The npm package 'amprem' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully remediate the infection, as the attacker may have established persistent control over the system.
CVE-2026-103503 is an improper certificate validation vulnerability in hexpm hex affecting versions from 0.20.2 up to but not including 2.5.2. The issue arises when the software uses a custom CA certificate store (cacerts_path) that excludes a CA present in Hex's bundled CA store. The verification logic incorrectly accepts server certificate chains containing certificates with public keys matching those in the bundled CA store, even if the configured CA store does not trust that CA. Hostname verification remains enforced. This flaw could allow an attacker who intercepts HTTPS connections and possesses a certificate issued by a CA in the bundled store to impersonate a Hex host to users relying on a custom CA store that excludes that CA.
CVE-2026-108094 is a use-after-free vulnerability in the mutter component of Red Hat Enterprise Linux 10, specifically in the Wayland color-management ICC image-description path. A local attacker running a malicious Wayland client can trigger this flaw by destroying a resource while an asynchronous ICC file read is ongoing. This leads to the compositor writing into freed memory and freeing a pointer derived from it, potentially crashing the GNOME session or enabling arbitrary code execution within the compositor process. The vulnerability has a high severity score of 7.8 CVSS 3.1.
SWUpdate versions up to and including 2026.05.1 have a critical vulnerability involving improper certificate validation. The flaw occurs in the crypto/swupdate_cms_verify_openssl.c component, where untrusted X.509 certificates embedded in CMS SignedData are trusted during chain building. This allows attackers with a signing key from a sibling intermediate certificate under the same root to embed that intermediate in the signature and potentially install malicious updates.
Gumlet php-image-resize versions before 3.0.1 have a denial of service vulnerability due to improper handling of highly compressed images. The vulnerability arises because the ImageResize constructor passes images to GD imagecreatefrom* functions without enforcing pixel limits, allowing attackers to upload small images that decompress into large bitmaps. This can exhaust PHP memory and terminate the worker process.