Threat database

The Apache Airflow connections API failed to mask the apprise provider's config connection extra, which may contain notification-service credentials. This flaw allows users with permission to read connections to retrieve these credentials in cleartext. The issue is addressed in Apache Airflow version 3.4.0 and later, where connection credentials are treated as write-only.

The example_dag_decorator example DAG in Apache Airflow improperly validates an IP address fetched over HTTP, allowing shell command injection via crafted IPv6 zone identifiers. This vulnerability is an incomplete fix of CVE-2025-54941. Users should upgrade to Apache Airflow 3.4.0 or later or disable example DAGs in production.

Apache Airflow's Task Execution API allowed tasks to store XCom values without enforcing the reserved-key check, enabling a DAG author to write XComs that could cause the API server to instantiate classes from the airflow namespace with attacker-controlled arguments when deserialized. This vulnerability is a partial bypass of the fix for CVE-2026-59242, affecting users who applied the fix in version 3.3.1. Users should upgrade to version 3.4.0 or later to fully remediate the issue.

CVE-2026-95648 is a high-severity vulnerability in C-Prot AppDefense before version 1.0.2729. It involves improperly controlled modification of dynamically-determined object attributes, which can lead to privilege escalation. The vulnerability is fixed in version 1.0.2729.

Italian Foreign Minister Antonio Tajani's personal data was leaked on the dark web, exposing him and his family to threats and intimidation. The Italian Prime Minister Giorgia Meloni attributed the leak to pro-Russian hackers. The leak is part of a broader pattern of cyber threats and attacks in Europe, including hoax bomb threats and attacks on critical infrastructure. Tajani has not specified the exact nature of the leaked data but indicated the threat is ongoing.

rConfig Core versions 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 have a critical deserialization of untrusted data vulnerability. This flaw allows unauthenticated network attackers to execute arbitrary code by pushing crafted serialized jobs onto the Redis-backed Laravel Horizon queue, which lacks authentication in affected deployments. Exploitation enables attackers to run arbitrary PHP and OS commands, write persistent web shells, and access sensitive credentials. The vulnerability is fixed in versions 8.2.19 and 8.4.1.

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.

CVE-2026-123158, known as 'SSHole,' is a high-severity authentication bypass vulnerability in OpenSSH that affects certain Linux distributions using musl libc with PAM disabled, such as Alpine Linux. The flaw arises from a misinterpretation of password hashes, allowing attackers to authenticate with any password between 257 and 1024 characters for accounts that should not accept passwords, including root. Exploitation attempts have been observed in the wild, primarily by botnets and crypto miners. OpenSSH has released patches, and users are advised to update to version 10.6p2 and consider disabling password authentication as a mitigation.

Red Hat has issued a security advisory for nodejs-nodemon addressing two denial of service vulnerabilities in the brace-expansion package. These vulnerabilities involve uncontrolled recursion and stack exhaustion caused by crafted nested brace patterns. The flaws can cause the nodemon tool, used to monitor and restart node.js applications during development, to crash or become unresponsive. The advisory rates the impact as Important and provides updated packages for Red Hat Enterprise Linux 10 and its variants.

A critical security vulnerability (CVE-2026-97631) exists in the edk2 package used by Red Hat Enterprise Linux 10 and related products. The flaw is a pre-boot remote code execution (RCE) vulnerability in the EDK II PXE driver, which is part of the UEFI firmware sample for QEMU and KVM virtual machines. Red Hat has issued a security advisory and released updates to address this issue.

Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iubenda-cookie-law-solution allows HTTP DoS.This issue affects iubenda: from n/a through 3.13.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway invoice-gateway-for-woocommerce allows Reflected XSS.This issue affects Invoice Gateway for WooCommerce – Invoice Payment Gateway: from n/a through 1.1.6.

Multiple security vulnerabilities have been identified in OpenSSL, a widely used cryptographic library implementing SSL and TLS protocols. These include a heap buffer overflow in CMS key unwrapping (CVE-2026-63072), an invalid pointer dereference in the CMP server via crafted protectionAlg (CVE-2026-63076), and an issue with DTLS retransmitting handshake messages from a stale buffer offset (CVE-2026-84782). Red Hat has released security updates addressing these issues in OpenSSL packages for Red Hat Enterprise Linux 9.4 and related variants.

Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise.

Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.

CVE-2026-118792 is a vulnerability in CompuGroup Medical Wingesfar where default credentials allow unauthorized access through the AcuXDBC interface. This issue affects versions prior to 2026.07a. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.1. A fix is available in version 2026.07a.

CompuGroup Medical Wingesfar versions prior to 10.2.1 implement software update functionality without adequate authenticity and integrity validation. This allows update packages to be accepted without sufficient cryptographic verification, potentially enabling malicious code to be installed during updates.

CVE-2026-118790 is a vulnerability in CompuGroup Medical Wingesfar involving multiple hardcoded credentials embedded in product components and administrative functionalities. These hardcoded credentials could allow unauthorized users to gain privileged access to accounts, services, or application features. The vulnerability affects versions prior to 2026.07a. A fix is available in version 2026.07a. The CVSS 4.0 base score is 7.2, indicating a high severity level.

CVE-2026-118468 is an XML External Entity (XXE) vulnerability in CompuGroup Medical Infantia. The issue arises because XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled. This improper restriction of XML external entity references can lead to potential security risks. The vulnerability affects multiple versions of Infantia up to and including 6.01.1, 4.51.0, and 8.33.2. It has a high severity rating with a CVSS score of 7.2.

CVE-2026-118467 is a vulnerability in CompuGroup Medical Infantia where shared telemetry and logging components improperly store or transmit sensitive patient and doctor information without adequate pseudonymization or protection. This includes identifiers and clinical data being logged in a way that could expose sensitive information.