CVE-2026-120344 is a critical OS command injection vulnerability in the WAVLINK WN551X3-A device's WireGuard CLI Group Handler component. The flaw exists in the system function of the /bin/ioos file, where manipulation of the group_name argument allows remote attackers to execute arbitrary OS commands. The vulnerability has a CVSS 4.0 base score of 10.0, indicating maximum severity. Public exploit code has been disclosed, but no official patch or remediation information is currently available.
CVE-2026-120343 is a cross-site scripting (XSS) vulnerability in the mathurvishal CloudClassroom-PHP-Project affecting the manageassessment2.php file. The flaw arises from improper handling of the ExamName and question parameters (Q1 to Q5), allowing remote attackers to inject malicious scripts. Exploit code has been published, but no vendor response or patch is currently available. Due to the product's rolling release model, specific affected versions are not identified.
Multiple security vulnerabilities have been identified and fixed in Apache Tomcat as distributed by Red Hat Enterprise Linux 9.8. These include security constraint bypass, access control bypass due to an off-by-one error, improper input validation allowing HTTP/2 no-authority bypass of strict SNI validation, improper authentication from principal lookup failure, authentication bypass via replay attack in DIGEST authenticator, unauthorized resource access via FORM authentication bypass, and denial of service via HTTP/2 allocation leak. Red Hat has released updated packages addressing these issues for various architectures and product variants.
Multiple security vulnerabilities have been identified and fixed in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include denial of service and remote code execution issues caused by heap buffer overflows, out-of-bounds reads, uninitialized heap memory disclosure, and buffer over-reads. The vulnerabilities affect the xfreerdp client and related components. Red Hat has issued an important security update for affected Red Hat Enterprise Linux 8.4 versions to address these issues.
Multiple security vulnerabilities have been identified in nginx, a widely used web and proxy server. These include code execution, denial of service, heap-based buffer overflow, heap buffer over-read, and memory disclosure issues affecting various nginx modules such as ngx_http_rewrite_module, HTTP/2 header processing, and ngx_http_slice_module. Red Hat has issued an important security advisory with updates for Red Hat Enterprise Linux 9.4 to address these vulnerabilities.
.NET 8.0 on Red Hat Enterprise Linux contains security vulnerabilities including an out-of-bounds write in the Google Brotli decoder (CVE-2026-111497) and an elevation of privilege vulnerability in ASP.NET Core (CVE-2026-114148). These issues have been addressed in updated SDK and runtime versions. The update is rated as important by Red Hat Product Security.
CVE-2026-120342 is a SQL injection vulnerability in the mathurvishal CloudClassroom-PHP-Project. The flaw exists in an unknown function within the file viewquery.php, where manipulation of the 'eid' argument allows remote attackers to execute SQL injection attacks. Exploit code is publicly available. The product uses a rolling release model, so specific affected or fixed versions are not provided. The vendor did not respond to early disclosure attempts.
CVE-2026-120341 is a security vulnerability in the mathurvishal CloudClassroom-PHP-Project affecting an unknown function within studentdetails.php. The flaw allows execution after a redirect, which can be exploited remotely without authentication. The vulnerability has been publicly disclosed, but no vendor response or patch information is available. The product uses a rolling release model, so specific affected or fixed versions are not provided.
A moderate security vulnerability (CVE-2025-11395) exists in the podman tool used for managing container pods and images. The flaw allows arbitrary file write during the import of an OCI archive. This vulnerability affects Red Hat Enterprise Linux 10 and related products. A security update addressing this issue is available from Red Hat.
CVE-2026-120340 is a session expiration vulnerability in the Global Session Handler component of the mathurvishal CloudClassroom-PHP-Project. The issue can be exploited remotely but requires high attack complexity and no user interaction. Exploit code is publicly available. The product uses a rolling release model, so no specific affected versions are identified. The vendor has not responded to the disclosure.
A security update for the Linux kernel in Red Hat Enterprise Linux 8 addresses multiple vulnerabilities including use-after-free bugs, improper pointer refreshes in IPv6 extension headers, privilege escalation, and input validation issues. The update fixes several CVEs such as CVE-2026-63922, CVE-2026-63924, CVE-2026-64109, CVE-2026-72083, CVE-2026-74283, and CVE-2026-93787. The kernel is a critical component of the operating system, and these fixes improve overall system security. Red Hat recommends applying the update and rebooting the system to ensure protection.
A stack overflow vulnerability (CVE-2026-14330) was identified in the Pulse Server component of PipeWire, a multimedia server for Linux and Unix-like systems. Red Hat has issued a security advisory for this vulnerability affecting Red Hat Enterprise Linux 10 and related variants. The vulnerability is rated as moderate in severity. An update to PipeWire is available to address this issue.
CVE-2026-120339 is a cross-site scripting (XSS) vulnerability in the mathurvishal CloudClassroom-PHP-Project. The flaw exists in the updatedetailsfromfaculty.php file, where manipulation of the fname argument can lead to XSS attacks. The vulnerability can be exploited remotely and public exploit code is available. The product uses a rolling release model, so specific affected versions are not identified. The vendor has not responded to the disclosure. The CVSS 4.0 score is 5.3, indicating a medium severity risk.
.NET 9.0 on Red Hat Enterprise Linux contains an elevation of privilege vulnerability in ASP.NET Core identified as CVE-2026-114148. This security issue affects multiple .NET versions including 8.0, 9.0, 10.0, and 11.0. Red Hat has released security updates for these versions as part of their Extended Update Support for RHEL 10.0. The vulnerability allows an attacker to gain elevated privileges, potentially compromising system security.
A denial of service vulnerability (CVE-2026-94286) exists in the X.Org X11 libXtst runtime library due to an out-of-bounds read in the RECORD reply parser. This issue affects Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related variants. Red Hat has issued a security advisory with an update to address this vulnerability.
Multiple heap buffer overflow vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME. These vulnerabilities arise from WebSocket handling issues including Pong signal type confusion, message reassembly, receive-buffer growth, and client-frame masking. Red Hat has issued security updates addressing these flaws in Red Hat Enterprise Linux 8.8 variants.
Multiple security vulnerabilities have been identified and fixed in the libxml2 library used in Red Hat Enterprise Linux 8.8. These include denial of service via use-after-free, arbitrary code execution through various buffer overflows, data integrity issues from integer overflow, information disclosure, SSRF, and double-free/use-after-free in Python bindings. The update addresses these issues with security patches and bug fixes.