CVE-2026-0320 is a command injection vulnerability in Palo Alto Networks PAN-OS software affecting PA-Series and VM-Series firewalls and Panorama devices. An authenticated administrator with access to the management interface can execute arbitrary commands as root. The vulnerability does not affect Cloud NGFW or Prisma Access. Restricting management interface access to trusted internal IP addresses significantly reduces risk. The CVSS 4.0 score is 6.1 (medium severity).
CVE-2026-100232 is a high-severity vulnerability in SonicWall Network Security Manager (NSM) on-premises. It is an OS command injection flaw that occurs post-authentication and could allow a remote authenticated attacker to execute arbitrary operating system commands, leading to remote code execution.
CVE-2026-96540 is an improper access control vulnerability in SonicWall Network Security Manager (NSM) on-premises export settings. It allows a remote authenticated attacker with limited privileges to potentially access sensitive information. Exploitation may lead to privilege escalation to administrator level or interception of other users' communications within the NSM instance. The vulnerability has a high severity rating with a CVSS score of 8.8.
OpenAEV-Platform versions prior to 2.260622.0 have a missing authentication vulnerability in the /api/player/** lessons endpoints. These endpoints accept a userId query parameter without verifying the caller's identity or membership in the exercise. This allows unauthenticated attackers who know an exercise UUID to read sensitive lesson content and impersonate users by creating or overwriting answers. The issue is fixed in version 2.260622.0.
CVE-2026-0321 is a medium severity denial of service vulnerability in Palo Alto Networks PAN-OS software affecting certain versions. An unauthenticated attacker with network access can send specially crafted traffic to cause the firewall to enter maintenance mode, disrupting service. Cloud NGFW and Panorama products are not affected by this issue.
FileRise versions prior to 3.15.0 contain a vulnerability where public shared-folder links with subfolder browsing enabled can follow symbolic links to access sibling directories outside the intended shared folder. This allows an unauthenticated user with a valid share token to list, download, or create ZIP archives of files outside the shared folder boundary. The issue arises because symlink resolution does not enforce the original shared folder as a boundary. The vulnerability is fixed in version 3.15.0.
CVE-2026-55684 is a critical SQL injection vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.6 have an unauthenticated endpoint that improperly handles user input in SQL INSERT statements, allowing remote attackers to execute arbitrary SQL commands. This can lead to unauthorized reading, modification, or deletion of sensitive data including billing, member, employee, permission, and credential information. The vulnerability is fixed in version 3.8.6.
CVE-2026-55682 is a high-severity vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.6 have a flaw in the session handling mechanism where an attacker-supplied PHPSESSID cookie is reflected in the Set-Cookie response with the internal database host name exposed as the cookie domain. This allows an attacker to hijack authenticated sessions if a victim uses the attacker-chosen session identifier. The issue affects all PHP pages and is fixed in version 3.8.6.
CVE-2026-110669 is a security vulnerability in cemtan sar2html version 4.0.0 affecting the deleteHost, deleteRange, and deleteAll functions in sar2html.py. The flaw results in missing authentication, allowing remote attackers to perform unauthorized deletions. The vulnerability has a medium severity score of 6.9 and has been publicly disclosed, but no patch or vendor response is currently available.
CVE-2026-55681 is a high-severity SQL injection vulnerability in the WeGIA web manager for charitable institutions. Prior to version 3.8.6, authenticated users with access to the Material & Patrimônio module can exploit improper sanitization of the id_produto parameter in a specific PHP script. This allows arbitrary SQL commands to be executed, potentially exposing or modifying sensitive institutional and inventory data. The vulnerability is fixed in version 3.8.6.
CVE-2026-55679 is an OS command injection vulnerability in the LabRedesCefetRJ WeGIA web manager for charitable institutions. Versions prior to 3.8.6 allow unauthenticated attackers to reach the pre-installation endpoint and inject commands via the 'usuario' parameter in the Linux reinstall flow. This leads to execution of arbitrary commands as the web-server user, persistence of attacker-controlled PHP configuration, and potential disruption or alteration of application data. The issue is fixed in version 3.8.6.
CVE-2026-55680 is a critical SQL injection vulnerability in WeGIA, a web manager for charitable institutions. Versions prior to 3.8.6 allow unauthenticated attackers to inject arbitrary SQL code via the 'codigo' parameter in a POST request to cadastro_cobranca.php. This vulnerability permits reading or modifying database content, including sensitive user credential hashes and billing records. The issue is fixed in version 3.8.6.
The U.S. Department of Justice has disrupted operations of the Famous Chollima threat group by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops involved in North Korean remote IT worker schemes. This action targets a criminal network allegedly linked to North Korea that used remote IT workers in the United States. No specific technical vulnerability or exploit details are provided.
CVE-2026-55683 is a critical SQL injection vulnerability in the LabRedesCefetRJ WeGIA web manager for charitable institutions. Versions prior to 3.8.6 have an unauthenticated endpoint that improperly incorporates user input into SQL queries without using prepared statements. This allows remote attackers to execute arbitrary SQL commands, potentially reading, modifying, or deleting database content including billing records and credentials. The vulnerability is fixed in version 3.8.6.
A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object.
To remediate this issue, we recommend that users upgrade to version 3.2.2 or 4.0.3. The 1.x and 2.x lines will not be patched, users of those lines need to migrate to 3.2.2 or 4.0.3.
Plane, an open-source project management tool, prior to version 1.4.0, contains an authorization bypass vulnerability allowing members of one project to read description_html of public pages in other projects within the same workspace. This issue affects the PageVersionEndpoint, which scopes lookups by workspace and page but not by project_id, enabling unauthorized read access. The vulnerability is read-only and does not allow modification of pages. It is fixed in version 1.4.0.
Plane, an open-source project management tool, has a missing authorization vulnerability in versions 1.3.1 and earlier. The flaw allows project guests or members to modify the is_active status of other project members, including administrators, by bypassing proper authorization checks. Additionally, members can overwrite preferences of other members due to insufficient object-level authorization. This vulnerability is fixed in version 1.4.0.
CVE-2026-110668 is a medium severity SQL injection vulnerability in cemtan sar2html version 4.0.0. The flaw exists in the index function of the sar2html.py file, where manipulation of the 'sort' argument allows remote attackers to perform SQL injection. Public exploit code is available, but the vendor has not yet responded or issued a fix.