Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 have an unauthenticated SQL injection vulnerability in the element search endpoint. The vulnerability arises because the attribute parameter is concatenated into the SQL query without proper sanitization, and emulated PDO prepares allow stacked statements. This flaw allows remote attackers to read and write the database, including setting the admin flag or overwriting password hashes in the users table to gain administrator access.
Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 validates user email address format with a regular expression whose run time grows quadratically with input length and that is applied without a length limit. An unauthenticated attacker who knows the application ID can send a sign-up request, or a logged-in user can update their own email, with a long crafted email address to block the Node.js event loop and deny service to all clients.
A race condition vulnerability exists in WWBN AVideo versions 29.0 through 29.4.0 in the PayPal plugin's IPN handling. This flaw allows attackers to bypass IPN replay protection by exploiting a non-atomic check and insert operation, enabling duplicate wallet credits and subscription renewals.
Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as get-tle-sources) to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext usernames, passwords, and tokens that administrators stored for basic and token orbital sources.
Wazuh versions 4.0.0 up to but not including 4.14.9 contain a SQL injection vulnerability in the WazuhDBBackend._substitute_params function. Authenticated users with agent:read permission on one agent can exploit this flaw by injecting UNION SELECT statements via the q and search parameters. This allows extraction of internal keys of all agents through a blind boolean oracle technique. The vulnerability is fixed in version 4.14.9.
Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.
Wazuh versions from 3.9.0 up to but not including 4.14.9 have a vulnerability in the fluent-forward module where TLS hostname verification is missing. This flaw allows network attackers who can redirect connections via DNS, ARP, or on-path attacks to impersonate the Fluentd collector by presenting any certificate chaining to the configured CA file. Exploiting this vulnerability enables attackers to intercept forwarded security telemetry and obtain the shared key hash for offline cracking.
Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_github.c) that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts, exposing organization repositories and settings.
Wazuh versions from 3.7.0 up to but not including 4.14.9 contain a server-side request forgery (SSRF) vulnerability in the Azure wodle get_graph_events() function. This function follows the @odata.nextLink URL without validating the host or HTTPS scheme. An attacker who can influence the nextLink value may redirect requests to attacker-controlled endpoints, potentially capturing the Microsoft Graph bearer token and accessing internal services. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity) and is fixed in version 4.14.9.
CVE-2026-112336 is a memory leak vulnerability in Wazuh Manager versions 3.0.0 up to but not including 4.14.9. The flaw exists in the generic JSON decoder, where repeated static fields in events can cause memory exhaustion. An attacker can exploit this by enrolling an agent without a password and sending events with duplicate fields such as 'id', leading to an out-of-memory (OOM) kill that disables alerting functionality.
A stack-based buffer overflow vulnerability exists in Wazuh agent versions from 1.0.0 up to but not including 4.14.9 in the logcollector snort-full log reader. The flaw occurs due to miscalculation of remaining buffer space in the read_snortfull() function, allowing crafted multi-line log content to overflow a 65,280-byte stack buffer. This can cause the agent to crash or overwrite the SEH handler on 32-bit Windows agents running as SYSTEM.
Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-configuration attackers to corrupt root process memory via excess ar.conf entries. Attackers controlling ossec.conf active-response blocks can push over 64 commands to agents, overflowing ReadExecConfig() arrays and crashing Active Response fleet-wide.
Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in git.Middleware(). Attackers can use a single-depth path ../evil, or on Windows a payload ..\..\evil that defeats the slash-count guard entirely, to read or write arbitrary repositories outside the intended root via git-upload-pack, git-upload-archive, or git-receive-pack.
There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.
CVE-2026-123665 is a low-severity vulnerability in kubescape versions 4.0.0 through 4.0.15. It affects the GetWriter function in the Output component, where manipulation of the outputFile argument can cause permission issues. Exploitation requires local access and user interaction. Upgrading to version 4.0.16 resolves the issue.
Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows a remote attacker to control the host, scheme, and port of absolute URLs generated for the rest of the request, poisoning links in pages stored by a shared cache and in e-mails sent after the page was rendered.When a page renders an inline fragment (render() in Twig, or an ESI tag rendered inline), SubRequestHandler temporarily adds 127.0.0.1 to the trusted proxies, and RouterListener rebuilds the router context from the main request while that trust is still active, so the X-Forwarded-* and Forwarded headers of a request whose client address is 127.0.0.1 are trusted even though that address is not a configured trusted proxy. From that point on, every absolute URL the router generates for the rest of the main request takes its host, scheme, and port from headers sent by the client, including URLs produced by url() in Twig and by UrlGeneratorInterface::ABSOLUTE_URL.
Applications are affected when they are reached over HTTP from 127.0.0.1, for example behind a TLS terminator, reverse proxy, local HTTP cache, or sidecar proxy on the same host, and that proxy passes the client’s forwarded headers along. With the default configuration (framework.trusted_proxies unset), all forwarded headers, including X-Forwarded-Host, are trusted during that window. Applications served through php-fpm, mod_php, or a proxy on another host are not affected. When framework.trusted_hosts is configured, a forwarded host outside the list is rejected, but the scheme and port can still be changed.
This news roundup highlights multiple cybersecurity threats and developments including ransomware attacks targeting Synology NAS devices exploiting a patched vulnerability, a Chinese-language attack framework abusing a Flowise code injection flaw, LLMJacking incidents involving hijacked enterprise AI access generating fraudulent bills up to $1 million, and a reported hardware implant in Trezor wallets sold by a reseller that could steal recovery seeds. Additionally, SAP vulnerabilities are being weaponized within days of patch release, increasing ransomware interest. Chainalysis disclosed a breach exposing sensitive user credentials, and phishing campaigns impersonate major AI and tech events. These incidents collectively illustrate evolving threat tactics across hardware, software, AI, and cloud environments.
CVE-2026-87045 is a memory safety vulnerability in the HTTP/2 server component of Zephyr (subsys/net/lib/http/http_server_http2.c). It occurs because the server clears the stream binding at the start of every frame, but CONTINUATION frames do not open a new stream, leaving client->current_stream unset. Subsequent code writes through this NULL pointer, causing a crash. This can be triggered remotely without authentication by sending a CONTINUATION frame after the client preface requesting any unregistered path. The impact is a denial of service due to system halt. There is no confidentiality or integrity impact. The vulnerability affects Zephyr versions >=4.1.0 <4.3.2 and >=4.4.0 <4.5.0 and is fixed in versions 4.3.2 and 4.5.0.
CVE-2026-123664 is an improper authorization vulnerability in the Email Notification Handler component of nasa-gcn's gcn.nasa.gov system. The flaw involves manipulation of the Recipient argument in the /user/email processing, allowing unauthorized actions remotely. The issue affects versions up to commit b299b562af665878964b981a459f0a9c04b11adf. A fix has been developed but is pending acceptance in a pull request. Exploit code has been publicly released, increasing the risk of exploitation. The product uses a rolling release model, so specific affected versions are not defined.
CVE-2026-106019 is a vulnerability in Johnson Controls C-CURE 9000, Victor version 3.20 that involves the insertion of sensitive information into log files. This flaw allows the use of known operating system credentials, potentially exposing sensitive data through logs. The vulnerability has a high severity rating with a CVSS 4.0 score of 8.8.