Multiple heap out-of-bounds write and stack buffer overflow vulnerabilities have been identified in the Tesseract OCR engine, as used in Red Hat Enterprise Linux 8.8. These flaws can lead to information disclosure, arbitrary code execution, denial of service, and heap corruption when processing crafted data or .traineddata files. Red Hat has issued an important security update addressing these issues.
CVE-2026-118465 is a vulnerability in CompuGroup Medical Infantia where shared components use hard-coded credentials for Access, workgroup, CCBasic, DBISAM, and related databases. These credentials are identical across different installations, potentially allowing unauthorized access if discovered.
CVE-2026-118464 is a vulnerability in CompuGroup Medical Infantia where shared cryptographic services use hard-coded cryptographic keys and weak cryptographic practices such as deterministic IVs, null salts, and reversible transformations. These weaknesses affect the protection of credentials, inter-process communication data, configuration values, and clinical fields. The vulnerability affects versions from 0 up to and including 5.1.1. It has a CVSS 4.0 base score of 5.8, indicating medium severity.
CVE-2026-118462 is a critical vulnerability in CompuGroup Medical Infantia where update components download and execute code without proper authenticity verification. The update process relies on ignored hashes or forgeable checksums, allowing potential execution of unauthorized code. Some update paths also permit archive traversal or script execution, increasing the risk of malicious payload delivery.
CVE-2026-118461 is a high-severity vulnerability in CompuGroup Medical Infantia where the client accepts doctor identifiers for read and write operations without requiring authentication or authorization. This missing authentication for critical functionality allows unauthorized access to sensitive operations.
CVE-2026-118460 is a vulnerability in CompuGroup Medical Infantia where embedded private keys are protected by a shared password. This flaw allows attackers to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized requests for practitioner tokens. The vulnerability affects versions up to 6.09.1 and 5.1.1. It has a high severity with a CVSS 4.0 score of 8. There is no indication of known exploits in the wild or available patches at this time.
CVE-2026-118459 is a vulnerability in CompuGroup Medical Infantia versions up to 5.1.1 involving a weak password recovery mechanism. The emergency password used for forgotten password recovery is derived from time and can be calculated using publicly available application code. This flaw allows an attacker to authenticate without possessing legitimate credentials. The vulnerability has a medium severity with a CVSS score of 6.3.
CVE-2026-118458 is a high-severity vulnerability in CompuGroup Medical's Phronesis product where hard-coded credentials are used. The shared AIS login routing mistakenly selects a production-shipped test Data Access Object (DAO) and performs plaintext comparison for certain application codes, allowing fixed administrator accounts to be accepted.
CVE-2026-118450 is a medium severity vulnerability in CompuGroup Medical's Venere product version 8.33.2. The software is installed outside the Program Files directory and loads or registers unsigned components from locations where unprivileged users can create files. This uncontrolled search path element issue (CWE-427) can lead to the loading of malicious components.
CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.
CVE-2026-121629 is a vulnerability in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS) used in Red Hat Enterprise Linux 10. It allows an attacker who controls or can inject content into a media manifest to include file:// URIs that cause the application to read arbitrary local files. This can lead to disclosure of sensitive local files in automated or server-side deployments. The vulnerability affects RHEL 10.2 and later streams shipping gstreamer1-plugins-good 1.26.x or newer, Fedora 43, and Fedora 44 and Rawhide versions prior to 1.28.9. RHEL 9 and earlier are not affected. Mitigations include avoiding untrusted manifest sources and restricting filesystem access via containers or namespaces.
Multiple integer overflow vulnerabilities were identified in the Ruby 4.0 regular expression compiler, including one affecting CI/CD pipelines. These issues could potentially lead to incorrect behavior or security risks when processing regular expressions. Red Hat has released an update for Ruby 4.0 in Red Hat Enterprise Linux 10 to address these vulnerabilities along with other bug fixes and enhancements.
The npm package @hello.nrfcloud.com/proto-map versions 18.0.0 and 18.1.0 contain malicious code. Any computer with this package installed or running is considered fully compromised, with potential unauthorized control by an outside entity. Immediate rotation of all secrets and keys stored on the affected computer is recommended. Removing the package alone may not fully eliminate the malicious presence.
CVE-2026-124684 is a use-after-free vulnerability in Samsung Open Source Escargot that allows pointer manipulation. It affects versions before commit 8bc35b7b88f0f96c66a42aa965a1a710308b61d5. The vulnerability has a CVSS 3.1 base score of 5.1, indicating medium severity, with an impact on availability but no confidentiality or integrity impact reported.
Amplifon Americas experienced a data breach in January 2026 where hackers accessed internal systems and stole personal, health, and insurance information of over 1.3 million individuals in the US. The compromised data includes names, contact details, government ID numbers, dates of birth, medical and hearing information, health insurance details, and for some, Social Security numbers and financial information. The breach was contained quickly, but the company took eight months to review the data and notify affected individuals. Amplifon has stated they are not aware of any fraudulent use of the stolen information.
A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.deletebook/Category.addcategory/Category.setcategory/Landing.sureadmin of the file src/view/MainInterface.java of the component Swing UI Layer. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.7.