CVE-2026-57189 is an out-of-bounds write vulnerability in the Asterisk telephony toolkit affecting the chan_sip channel driver when its textsupport option is enabled. An authenticated attacker can trigger a T.140 RED out-of-bounds write during generation accumulation, potentially leading to remote code execution or a crash. The chan_sip driver is deprecated in Asterisk 20 and removed in later versions. Fixes are available in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and corresponding certified releases.
CVE-2026-57201 is a high-severity stack buffer overflow vulnerability in the Asterisk telephony toolkit's H.323 chan_ooh323 addon channel driver. It arises from an unbounded vsprintf write into a fixed 2048-byte buffer in the ooTrace() trace-logging function. This can cause the Asterisk process to crash when processing a crafted packet. The vulnerable chan_ooh323 driver is not enabled by default and requires explicit compilation and a publicly reachable port. The issue is fixed in multiple Asterisk releases including 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk versions 20.7-cert11 and 22.8-cert3.
CVE-2026-114598 is a high-severity vulnerability in EPICS Base versions up to and including 7.0.10. It involves insufficient validation of element or length values in network messages, which can cause the application to read beyond allocated buffer bounds. This flaw can lead to denial of service and potential exposure of adjacent memory contents.
CVE-2026-108015 is a critical vulnerability in HCLSoftware Notes Client caused by the compromise of private keys for eight eMudhra intermediate CA certificates. This flaw allows an unauthenticated network attacker to spoof server certificates and perform man-in-the-middle (MITM) attacks on outbound TLS connections, potentially intercepting or modifying sensitive data.
CVE-2026-57194 is an out-of-bounds write vulnerability in the chan_unistim module of Asterisk, an open source telephony toolkit. The flaw allows an attacker to overflow the phone_number field and crash the system by sending a crafted incoming request packet. Exploitation requires the chan_unistim module to be loaded and configured with a reachable UNISTIM UDP port, and the attacker must register as a configured phone MAC or use an equivalent provisioning path. This vulnerability affects multiple Asterisk versions prior to fixed releases and has a medium severity rating with a CVSS score of 5.9.
CVE-2026-114597 affects EPICS Base versions up to and including 7.0.10. It involves improper validation of element or length values in network messages, which can cause the application to read beyond allocated buffer boundaries. This vulnerability may lead to denial of service and potential exposure of adjacent memory contents.
CVE-2026-114596 is a high-severity integer overflow vulnerability in EPICS Base versions up to and including 7.0.10. The flaw arises from improper validation of message length values during protocol parsing, which can lead to an integer overflow and subsequent out-of-bounds memory write. Exploitation may cause process instability or denial of service conditions.
CVE-2026-114595 is a critical integer overflow vulnerability in EPICS Base versions up to 7.0.10. The flaw occurs during network request processing, causing memory to be allocated with an incorrect size. This can lead to memory corruption, denial of service, or potentially remote code execution if attacker-supplied data is handled improperly.
CVE-2026-57198 is a heap-based buffer overflow vulnerability in the Asterisk telephony toolkit affecting the chan_sip channel driver when the textsupport option is enabled. An authenticated attacker can exploit this flaw by sending crafted T.140 RED packets, potentially causing remote code execution or crashing the system. The chan_sip driver is deprecated in Asterisk 20 and removed in later versions. Fixes are available in multiple Asterisk versions including 20.20.1, 21.12.3, 22.10.1, and 23.4.1.
TinyMCE versions from 7.9.3 up to but not including 7.9.4, and from 8.5.1 up to but not including 8.9.3, contain a stored cross-site scripting (XSS) vulnerability in the media plugin. This occurs because the plugin creates elements using data-mce-object in the active document before sanitization, allowing malicious scripts to execute during processing. The vulnerability is fixed in versions 7.9.4 and 8.9.3.
CVE-2026-117513 is a SQL injection vulnerability in the oretnom23 php-travel-agency-system affecting the admin/customer_search.php component. It allows remote attackers to manipulate the customer_name, voucher_no, or emp_name parameters to execute SQL injection attacks. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.
A prototype pollution vulnerability exists in the systeminformation library for node.js versions prior to 5.33.13. On FreeBSD, OpenBSD, and NetBSD, the networkStats(ifaces) function improperly indexes cached network interface data using sanitized caller-controlled names, allowing Object.prototype properties to be overwritten. This can corrupt application logic such as branching, serialization, configuration merging, validation, or lookup behavior. The issue is fixed in version 5.33.13.
CVE-2026-57185 is a buffer over-read vulnerability in the PJSIP MWI body parser of Asterisk, an open source telephony toolkit. An authenticated attacker can cause a crash by sending a crafted SIP NOTIFY request. Authentication can be via username/password or source IP address matching. The issue affects multiple versions prior to fixed releases and has been addressed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and corresponding Certified Asterisk releases.
Adobe Connect Desktop App contains a code injection vulnerability (CWE-94) that allows an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page. The vulnerability affects versions from 0 up to and including 4.4. The issue has a critical severity with a CVSS score of 9.6.
A path traversal vulnerability (CWE-22) exists in the systeminformation Node.js library prior to version 5.33.14. The Linux networkStats(iface) function improperly validates the iface parameter when constructing filesystem paths, allowing an attacker with local access to manipulate the iface value to read arbitrary files accessible to the Node.js process. This requires local filesystem setup and cannot be exploited remotely. The issue is fixed in version 5.33.14.
CVE-2026-108014 concerns the compromise of private keys for eight eMudhra intermediate CA certificates affecting HCL Domino Server. This vulnerability allows an unauthenticated network attacker to spoof server certificates, enabling man-in-the-middle (MITM) attacks on outbound TLS connections. The flaw is related to the use of broken or risky cryptographic algorithms (CWE-327).
CVE-2026-57197 is a heap-based buffer overflow vulnerability in Asterisk's handling of OGG/Speex audio packets. It occurs due to an unbounded memcpy operation in the format_ogg_speex component when processing corrupted Speex audio files. An attacker must supply a crafted file and have it played by Asterisk, requiring elevated privileges or administrator cooperation. This flaw can cause Asterisk to crash. Fixed versions include Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases.
The Gentlemen is a Russian-speaking ransomware-as-a-service (RaaS) group active since mid-2025. It operates a double-extortion model by encrypting files and exfiltrating data to pressure victims into paying ransoms. The group targets Windows, Linux, NAS, and BSD systems and has claimed over 800 victims, primarily in the US and Europe. It aggressively offers affiliates up to 90% of ransom revenue. The group uses EDR-killing tools and deletes forensic artifacts to evade detection. A breach of its infrastructure in May 2026 exposed internal communications and affiliate details, providing insights into its operations and links to other ransomware groups.
CVE-2026-109090 is a heap-based buffer overflow vulnerability in the x.org libXi library versions prior to 1.8.4. It occurs when a malicious X server sends an excessively large DEVICE_ENABLE reply, causing libXi to overflow its heap buffer. This flaw was fixed in version 1.8.4.
Authlib versions from 0.15 up to but not including 1.9.1 contain an authorization bypass vulnerability in the ClientConfigurationEndpoint implementations. These implementations improperly verify client permissions by only checking if the target client is editable, without confirming that the request credential belongs to that client. This flaw allows any client with a valid registration access token to read, modify, or delete other clients' registrations. Modifying redirect_uris could lead to authorization code or token interception, and deleting registrations can cause denial of service for affected clients. The vulnerability is fixed in version 1.9.1.