A cyberattack targeted refrigeration systems at three French blood bank sites, attempting to raise storage temperatures to levels that could compromise plasma products. The attack was detected and mitigated in time, preventing any loss or health consequences. The incident is linked to a supplier of refrigeration equipment and follows similar attacks on supermarket refrigeration systems in Europe.
CVE-2026-123119 is a low-severity race condition vulnerability in the Symfony HttpClient component NoPrivateNetworkHttpClient. It allows DNS rebinding attacks to bypass private network restrictions by exploiting how IP addresses are cached and resolved. This can lead to enumeration of internal hosts and ports in affected Symfony versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11.
A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function FileBasedSkill.get_prompt of the file packages/dbgpt-core/src/dbgpt/agent/skill/claude_skill/__init__.py of the component Jinja2 Template Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.8.2 is sufficient to fix this issue. The identifier of the patch is a9e7a3c026d114fcfb4ffe3eaf78851a636ded16. It is suggested to upgrade the affected component.
Cisco and WatchGuard have released patches addressing multiple vulnerabilities, including a high-severity remote code execution (RCE) flaw in Cisco UCS Central Software and critical authentication and integrity issues in WatchGuard products. WatchGuard also disclosed a critical use-after-free vulnerability in the Linux kernel affecting some of its products, though not exploitable via RCE in those cases. SonicWall's legacy Global Management System (GMS), which reached end-of-life in October 2025, contains two vulnerabilities—a critical unauthenticated file read and a medium-severity SQL injection—that will remain unpatched.
Apache Sling Engine versions before 3.0.4 contain an HTTP request/response smuggling vulnerability due to inconsistent interpretation of HTTP requests. The engine's query and form parser accepts non-standard percent-escapes and incorrect character sets, continuing request processing despite these errors. This issue is fixed in version 3.0.4.
Improper output neutralization for logs in Apache Sling Engine.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Apache Juneau versions through 9.2.0 have an Insufficiently Protected Credentials vulnerability in the RestClient component. The RestClient followed HTTP redirects while retaining credential headers such as Authorization, Cookie, Proxy-Authorization, and X-API-Key from the original request. This behavior could expose sensitive credentials to unintended hosts or downgrade from HTTPS to HTTP, risking credential leakage. The issue is fixed in version 9.2.1 by changing the handling of redirects and credential headers.
A weakness in eosphoros-ai DB-GPT up to version 0.8.2 affects the exec_module function in the hf_adapter.py file of the HuggingFace Adapter component. Manipulating the trust_remote_code argument can cause inclusion of functionality from an untrusted source. This vulnerability can be exploited remotely. Public exploit code is available. The project has been informed but has not yet responded or issued a fix.
CVE-2026-73117 is a critical vulnerability in Apache Juneau through version 9.2.0 involving improper neutralization of CRLF sequences in HTTP headers, also known as HTTP Response Splitting. The issue arises because the REST server passes response header values and redirect targets to the servlet container without sanitization. This can allow remote clients to inject header lines or redirect users to arbitrary external sites if the application sets headers or redirects based on request data. The vulnerability is fixed in version 9.2.1, which sanitizes header values by default and introduces a safer redirect method.
Apache Juneau versions through 9.2.0 have a vulnerability where sensitive request headers are logged in cleartext when a server error occurs. This includes headers such as Authorization, Cookie, Proxy-Authorization, and X-API-Key. The issue is fixed in version 9.2.1.
Apache Juneau versions through 9.2.0 have a cross-site scripting (XSS) vulnerability due to improper HTML encoding of variable substitutions in page chrome elements. This affects applications that include request-derived variables in the chrome, such as headers or form data, reflecting unencoded input and enabling XSS attacks. The default chrome does not use request variables, so only customized applications are impacted. The issue is fixed in version 9.2.1.
Apache Juneau versions through 9.2.0 have a vulnerability where error messages expose sensitive internal exception details to remote clients. This occurs because the REST server includes the internal exception class and message in a "Thrown" response header and may include exception messages in the error body, even when stack-trace rendering is disabled. This information disclosure reveals implementation details that could aid attackers. The issue is fixed in version 9.2.1.
Apache Juneau versions through 9.2.0 contain a vulnerability in the MessagePack parser used by the REST server. An unauthenticated client can trigger large buffer allocations from crafted input length values, causing an OutOfMemoryError and denial of service. Related unbounded allocations in multipart uploads and request reader buffers are also addressed in the fix. The issue is resolved in version 9.2.1.
Apache Juneau versions through 9.2.0 have a Cross-Site Request Forgery (CSRF) vulnerability. The REST server accepts a 'content' query parameter that replaces the request body and is enabled by default on all HTTP methods, including GET. This allows an attacker to craft a cross-site link that delivers an attacker-chosen request body without triggering CORS preflight checks, bypassing protections that rely on HTTP method or content type instead of anti-CSRF tokens. The issue is fixed in version 9.2.1. Users can also mitigate by disabling the content parameter if it is not used.
CVE-2026-121489 is a critical path traversal vulnerability in Apache Juneau affecting the DirectoryResource microservice. When enabled, the resource's view, upload, or delete settings allow clients to access files outside the configured root directory, potentially reading, writing, or deleting any file accessible by the server process. This flaw affects Apache Juneau versions through 9.2.0 and is fixed in version 9.2.1.
A remote code injection vulnerability exists in the execute_code function of the code_utils.py file within the CodeAction component of eosphoros-ai DB-GPT versions up to 0.8.2. This flaw allows an attacker to execute arbitrary code remotely. Public exploit code has been released, and the project has not yet issued a response or fix.
Apache Juneau versions through 9.2.0 contain a vulnerability where parsing a value into a java.lang.Class property causes the named class to be loaded with initialization, triggering its static initializer. This improper control of dynamically-loaded code can lead to unintended code execution depending on the classes present in the deployment. The issue is fixed in version 9.2.1.
Ansible-core versions starting from 2.19 introduced a regression where tasks marked with no_log: true still leak sensitive information in their exception messages. This occurs because the exception field is preserved and printed by default, exposing secret values in error outputs such as argument-validation errors, templating errors, and assertion failures. The issue does not exist in version 2.16, where error texts are properly censored.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.
This issue affects Apache Sling Engine before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Execution with unnecessary privileges vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-usb-formatter allows Privilege Abuse.
This issue affects pardus-usb-formatter: from 0.7.0 before 0.7.2.