pdfmake versions from 0.3.0-beta.1 up to but not including 0.3.14 have a vulnerability involving shared resource caching. This flaw allows attackers to access cached resources across different documents by exploiting a process-wide virtual file system that keys only by URL, without enforcing request headers or per-document access controls. As a result, attackers can retrieve resources fetched with other users' credentials or from URLs that would normally be restricted by access policies, leading to cross-document information disclosure and bypass of URL access restrictions. The issue is fixed in version 0.3.14.
The npm package '@massnerder/x402-scraper-mcp' version 1.0.0 has been identified as malicious due to its communication with a domain linked to malicious activity. This behavior classifies the package as malware within the software supply chain.
CVE-2026-124624 is a vulnerability in PipraPay version 3.0.0 involving hard-coded credentials in the hash_hmac function within the pp-token anti-CSRF handler component. This weakness allows remote attackers to exploit the hard-coded credentials. The vulnerability has a medium severity rating with a CVSS score of 6.9. Public exploit code is available, but no official response or patch has been provided by the vendor as of the publication date.
Threat actors are exploiting a chain of four vulnerabilities known as Plex2Shell in the Plex Media Server application on QNAP NAS devices. These vulnerabilities allow attackers to execute arbitrary code with Plex service privileges without requiring valid credentials. The vulnerabilities were patched in Plex Media Server version 1.43.3. QNAP NAS operating systems themselves are not affected. Users are advised to update Plex Media Server promptly and take additional precautions to secure remote access.
CVE-2026-119613 is a vulnerability in ash-project's ash_ai versions 1.5.0 up to but not including 1.5.1. It allows an attacker calling an AshAi tool to obtain internal error details, such as module names and data values, by causing a tool call to fail. The issue arises because error messages include sensitive information from exceptions or inspected error terms, which are sent directly to clients and the model without logging. The vulnerability is fixed in version 1.5.1 by logging errors under an error ID and returning only that ID to the caller.
A use of uninitialized memory vulnerability exists in the GStreamer gst-plugins-bad package's H.265 bitstream parser when processing Video Parameter Sets with multiple HRD parameter sets. This flaw can be triggered by a crafted H.265 media file or stream, causing unpredictable parser behavior and potentially crashing applications using GStreamer for H.265 playback, resulting in denial of service.
CVE-2026-121601 is a vulnerability in the GStreamer MXF demuxer plugin (gst-plugins-bad) used in Red Hat Enterprise Linux 10 and other related products. It involves an out-of-bounds read when processing specially crafted MXF media files, leading to potential application crashes and limited heap memory disclosure. Exploitation requires a local attacker to trick a user into opening a malicious MXF file. No code execution or write primitives have been demonstrated. Affected versions include GStreamer 1.22.x through 1.28.8 shipped in RHEL 9.4 and later minor releases, RHEL 10, and Fedora streams. Mitigation involves avoiding untrusted MXF files or disabling the mxfdemux plugin until a fix is available.
CVE-2026-119610 is a vulnerability in GStreamer's gst-plugins-good H.264 RTP depayloader element affecting multi-time aggregation RTP packets (MTAP16/MTAP24). A signed/unsigned integer conversion error can cause an out-of-bounds heap read of up to 64 KiB when processing truncated packets. This can lead to denial of service by crashing the GStreamer pipeline and potentially leaking adjacent heap memory in relay or transcoding scenarios where output is attacker-accessible. The flaw is present in upstream gst-plugins-good starting from version 1.28.0. Red Hat Enterprise Linux 10 currently ships versions below 1.28.0 and is expected not to include the vulnerable code path until a future rebase. Fedora 44 is affected pending confirmation. Mitigations include blocking untrusted H.264 RTP streams at the network perimeter or avoiding the vulnerable element for untrusted sources.
CVE-2026-124623 is a medium severity vulnerability in PipraPay version 3.0.0. It affects the system-settings-import function in the ZIP Archive Handler component, allowing an attacker to perform unrestricted file uploads remotely. The vulnerability has a CVSS 4.0 base score of 5.1. Public exploit code is available, but no official patch or vendor response has been reported yet.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8.
WidzialniCMS versions prior to 2.5 are vulnerable to a brute force protection bypass in the login functionality. The vulnerability arises because the cookie-based lockout mechanism can be circumvented by omitting the login_count and login_timeout cookies, allowing unlimited login attempts by unauthenticated attackers. This issue has been fixed in version 2.5.
WidzialniCMS versions prior to 2.5 are vulnerable to a reflected Cross-site Scripting (XSS) flaw in the /index.php endpoint. This vulnerability allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim's browser, potentially leading to session cookie theft. The issue has been fixed in version 2.5.
WidzialniCMS versions prior to 2.5 are affected by an unrestricted file upload vulnerability in the /panel/upload.php endpoint. This flaw allows unauthenticated attackers to upload arbitrary files to any server location due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter. Successful exploitation can lead to remote code execution. The vulnerability has been fixed in version 2.5.
Multiple security vulnerabilities have been identified in the Ruby programming language as packaged for Red Hat Enterprise Linux 10. These include a double free issue in the regular expression parser and several integer overflow issues in various regular expression compilers. Red Hat has released an update rebased to Ruby 3.3 that addresses these issues. The update is rated as having a moderate security impact.
WidzialniCMS versions prior to 2.5 contain an unrestricted file upload vulnerability in the /panel/controllers/save_photo.php endpoint. This flaw allows unauthenticated attackers to upload arbitrary files to any server location due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter. Successful exploitation can lead to remote code execution. The vulnerability has been fixed in version 2.5.
CVE-2026-124622 is a time-of-check to time-of-use (TOCTOU) vulnerability in olivier-ls PHP-FTS versions 1.1.0 through 1.1.3. It affects the TrigramIndex::open function in Storage.php and requires local attack conditions where an attacker has write access to the index directory but is a different user than the application process. The vulnerability is considered a hardening issue rather than a remotely exploitable flaw. Upgrading to version 1.1.4 resolves the issue.
Red Hat issued a security advisory for the nodejs:24 module addressing multiple vulnerabilities in Node.js and its dependencies, including undici, brace-expansion, minimatch, and sqlite. The vulnerabilities include denial of service via unrequested WebSocket subprotocol, uncontrolled recursion, stack exhaustion, unhandled stream errors, TLS renegotiation issues, certificate validation bypass, heap-based buffer overflow, and arbitrary code execution. The update is rated as Important by Red Hat Product Security and affects Red Hat Enterprise Linux 9 and related variants. The advisory provides fixes for these issues and directs users to apply the update to remediate the vulnerabilities.
A sophisticated phishing campaign targets hospitality customers by impersonating Booking.com and other hotel services with fake reservation pages. The campaign uses personalized reservation details to increase credibility and employs advanced features such as real-time card validation, interactive verification workflows, and multi-language support. It focuses particularly on Japanese hotels but is designed for global deployment. The phishing kit uses multiple backend endpoints to track victim progression and can prompt additional verification after initial card submission.
A malicious Ruby gem named strutil-core version 1.0.1 was published and quickly removed after it was found to execute a large credential-stealing worm during installation. This worm, a descendant of the Shai-Hulud toolkit, steals credentials from various cloud services, CI systems, package registries, SSH, AI coding tools, and cryptocurrency wallets. It propagates through multiple package managers and platforms including RubyGems, npm, PyPI, JFrog Artifactory, GitHub, GitLab, and SSH. The malware installs a Python backdoor controlled via signed GitHub commits, poisons AI tool configurations to maintain persistence, and contains a conditional wiper that deletes the user's home directory if a stolen GitHub token is revoked. It targets Linux and macOS systems on x86-64 and ARM64 architectures, excluding Russian-speaking locales.
