A cross-site scripting (XSS) vulnerability exists in OPNsense core prior to version 26.1.11. The issue arises from improper encoding of stored category names and alias descriptions placed into HTML title attributes, allowing injection of script code. An authenticated user with Firewall Categories or Firewall Alias Edit privileges can exploit this by crafting malicious input that executes in the session of an administrator or other user viewing the affected Rules or NAT page. This can lead to unauthorized actions performed with the victim's privileges. The vulnerability is fixed in version 26.1.11.
CVE-2026-53582 is an XML Injection vulnerability in the OPNsense core Trust module prior to version 26.1.10. It allows users with CA Manager or Certificate Manager privileges to inject crafted refid values into XPath expressions, enabling them to recover sensitive configuration data character by character. Exposed data may include password hashes, API credentials, private keys, and VPN key material, potentially leading to privilege escalation and compromise of other security domains. The issue is fixed in OPNsense version 26.1.10.
CVE-2026-109413 is a high-severity vulnerability in the Symfony YAML component affecting versions prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6. The issue arises from uncontrolled recursion in the YAML parser's lexInlineStructure function, which does not properly limit nesting levels for inline collections. This can cause stack exhaustion and crash the process or cause a fatal error when parsing deeply nested YAML input. Any code parsing untrusted YAML is vulnerable, including endpoints using #[MapRequestPayload] without restricting the accepted format. The vulnerability is exploitable without authentication by sending a crafted YAML payload.
CVE-2026-79843 is an out-of-bounds read vulnerability in Hewlett Packard Enterprise's HPE NonStop SQL/MX EXE component. It occurs when a corrupted file is processed under certain conditions, potentially causing information disclosure, process termination, CPU halt, or data corruption. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No affected versions or patch information are currently provided.
CVE-2026-108082 is a high-severity vulnerability in the Symfony PHP framework affecting multiple versions prior to 5.4.54, 6.4.46, 7.4.19, and 8.1.7. The issue arises from inefficient regular expression complexity in HeaderUtils::split(), which processes HTTP header values. This can cause exponential backtracking when parsing headers with runs of whitespace before separators, leading to high CPU usage and denial of service. The vulnerability is reachable without authentication via crafted HTTP requests. From 18 spaces onward, the regex engine hits backtrack limits, causing header directives to be silently dropped.
CVE-2026-110957 is a critical OS command injection vulnerability in the Wavlink WL-WN530BE2-A device firmware up to version M30BE2_V250604. The flaw exists in the login processing component, specifically in the api.cgi file's sub_12580 function, where manipulation of the REMOTE_ADDR argument allows remote attackers to execute arbitrary OS commands. The vendor has confirmed the issue and released a fixed firmware version 2026-09-24-841a51c6d5_tclinux.bin that mitigates the vulnerability by changing the command execution method and validating input. The vulnerability has a CVSS 4.0 score of 10.0, indicating critical severity. No known exploits are reported in the wild at this time.
CVE-2026-79841 is a medium severity buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop RDMA SERVICES NSK. It involves an out-of-bounds memory write that can lead to memory corruption. The vulnerability requires local access with high privileges and user interaction to exploit. No affected versions or patch information are currently provided.
CVE-2026-103509 is a vulnerability in Perforce P4 (Helix core) affecting versions up to 2026.4.2. The P4 Search component exposes stored credentials in cleartext via its configuration API to users with administrative privileges on the connected P4 Server, enabling privilege escalation. This issue is fixed in version 2026.4.3.
Multiple U.S. military commissaries experienced refrigeration outages affecting frozen and refrigerated goods, leading to spoilage and loss. The Defense Commissary Agency has acknowledged a possible refrigeration disruption but has not confirmed the cause. The refrigeration units themselves are not network-connected, but remote monitoring systems are part of contracts for refrigeration needs. Recent research has highlighted potential security vulnerabilities in refrigeration systems that could be exploited. Commissaries remain open, with efforts to mitigate product loss by transferring goods to alternate locations. No official confirmation of a cyberattack has been provided.
CVE-2026-79840 is a stack-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop XABroker. This flaw can lead to memory corruption and cause the affected application to crash. The vulnerability has a high severity rating with a CVSS score of 7.3. No specific affected versions or patch information are provided in the available data.
CVE-2026-79839 is a stack-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop ODBC/MX Server. This vulnerability can cause memory corruption leading to application crashes. It requires low privileges and user interaction to exploit and affects confidentiality, integrity, and availability to a limited extent. The vulnerability has a high severity rating with a CVSS score of 7.3.
CVE-2026-79838 is a stack-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop ODBC/MX Services. This flaw may lead to memory corruption and cause the affected application to crash. The vulnerability has a high severity rating with a CVSS score of 7.3. No specific affected versions or patch information is provided in the available data.
The UK Legal Aid Agency (LAA) suffered a data breach in April 2025, with forensic analysis revealing that the compromised data spans records from 1978 through 2025. The breach exposed personal information related to legal aid applications, claims, payments, and data of legal aid practitioners, judges, solicitors, and probation service users. The investigation was complex due to the volume and fragmented nature of the data. There is no evidence that the stolen information has been publicly released or sold.
This analysis discusses the security and privacy risks associated with using AI chatbots and language models for resume writing and job applications. It highlights the potential for personal data leakage through AI training, bugs, or indexing of shared conversations. The post advises users to remove sensitive information before submitting resumes to AI tools and to prefer local AI models for sensitive data. It also warns about malicious actors exploiting personal data from AI interactions for targeted phishing and scams. The article provides guidance on safely using AI to improve resumes without oversharing and explains how applicant tracking systems (ATS) and AI are used in recruitment.
CVE-2026-108116 is a high-severity vulnerability in Progress Software Kendo UI for jQuery versions from 2014.2.716 up to but not including 2026.3.1015. It involves improper neutralization of special elements in output used by a downstream component, specifically in the PivotGrid XMLA transport. This flaw allows specially crafted filter values to alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.
CVE-2026-106153 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery versions from 2011.3.1007 up to but not including 2026.3.1015. The issue arises because the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper sanitization or HTML attribute encoding. An attacker with low privileges who can control these values can inject malicious JavaScript that executes in the context of users interacting with the affected calendar components, potentially compromising confidentiality and integrity of accessible data.
A cross-site scripting (XSS) vulnerability exists in Progress Software Kendo UI for jQuery versions from 2012.2.710 up to but not including 2026.3.1015. The Validator component improperly decodes and parses validation messages from data-msg-* attributes as HTML, allowing an attacker who can modify these messages to execute arbitrary JavaScript in the user's browser. This can compromise confidentiality and integrity of data accessible to the affected application. The issue is fixed in version 2026.3.1015.
CVE-2026-106150 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery affecting the Splitter, Window, and Tooltip components. Versions from 2011.2.804 and 2013.1.319 up to but not including 2026.3.1015 are vulnerable. The issue arises because these components improperly sanitize URL values and do not encode iframe titles correctly, allowing attackers with low privileges to inject malicious JavaScript. Exploitation requires user interaction and can compromise confidentiality and integrity of data accessible in the user's browser.
CVE-2026-106149 is a medium severity vulnerability in Progress Software Kendo UI for jQuery prior to version 2026.3.1015. The Menu component improperly neutralizes script-related HTML tags by constructing HTML attributes from bound dataSource fields via string concatenation without proper sanitization. This allows an attacker with low privileges who can control these fields to inject JavaScript event-handler attributes. The injected code executes when a user interacts with the affected Menu, potentially compromising confidentiality and integrity of data in the user's browser context.
CVE-2026-110746 is a local privilege escalation vulnerability in TotalAV by TotalSecurity. It involves improper limitation of a pathname to a restricted directory (path traversal), allowing an unprivileged local user to forge the gRPC IPC authentication token by loading IPC.dll. This abuse of the SYSTEM service within TotalAV enables execution of arbitrary code with NT AUTHORITY\SYSTEM privileges. The vulnerability affects versions from 0 up to and including 7.1.17. It has a high severity with a CVSS score of 7.8.