A code injection vulnerability exists in Fengoffice Feng Office versions up to 3.11.13.11 and 4.2.1.2 in the Translation Tool component's write_translations function. The flaw arises from manipulation of the 'lang' argument, allowing remote attackers to inject code. Public exploit code is available. The vendor has not responded to disclosure requests, and no patch information is provided.
A cross-site scripting (XSS) vulnerability exists in Convene Azeus Convene Board Management Portal version 7.0.2.7_3 p72. The flaw is due to improper handling of the REDIRECT_URL argument in the /jsp/ge/dummy_launcher.jsp file, allowing remote attackers to execute script code. The vulnerability has a low CVSS score of 3.5 and requires low privileges with user interaction. The vendor has not responded to the disclosure, and no patch information is available.
A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability in B&R Industrial Automation GmbH products related to OpenSSL could allow an attacker to cause the product to stop functioning or to execute arbitrary code. The issue affects product versions prior to and including 6.6.0. A fix is available in version 6.6.0.
CVE-2026-124504 is a SQL injection vulnerability in the erupts erupt product up to version 2.3.0. The flaw exists in the ReportService.queryBiData function within ReportService.java, where manipulation of the 'sort' argument can lead to SQL injection. This vulnerability can be exploited remotely without user interaction. A public exploit is available. Upgrading to version 2.4.0 resolves the issue.
CVE-2026-124502 is a medium severity vulnerability in yungifez Skuul School Management System versions 2.6.0 through 2.6.3. It involves missing authorization in the GraduationController::resetGraduation function, allowing remote attackers to manipulate the student argument without proper authorization. The issue is fixed in version 3.0.0.
Ruby 4.0 contains an integer overflow vulnerability in its regular expression compiler (CVE-2026-110264) that could potentially lead to security issues. This vulnerability is one of several integer overflow issues addressed in the ruby4.0 update. The update also includes bug fixes and enhancements, rebasing ruby4.0 to the latest release. The vulnerability affects versions prior to 4.0.9-38.el10_2 and related builds. A patch is available from Red Hat as part of their security advisory RHSA-2026:96233.
A use-after-free vulnerability exists in curl's HTTP/2 upload functionality, identified as CVE-2026-92392. This flaw affects the curl library and utility used for transferring data with various protocols. The vulnerability has been addressed in curl version 8.12.1-4.el10_2.8 and later.
The util-linux package, essential for Linux system utilities including fdisk and login, has multiple security vulnerabilities. One of these is a heap use-after-free in libblkid nested partition probing (CVE-2026-13595). Additional issues include a TOCTOU race condition in the mount program and an integer overflow in the DOS partition parser. These vulnerabilities could lead to system instability or compromise of partition metadata. A security update fixing these issues is available for Red Hat Enterprise Linux 8 and related distributions.
A security update for webkit2gtk3 addresses multiple vulnerabilities in the Skia graphics library used by chromium-browser, including information leaks, use-after-free, cross-origin data disclosure, integer overflow, out-of-bounds reads, memory corruption, and improper input validation. These issues could lead to information disclosure and memory corruption. The vulnerabilities affect versions of webkit2gtk3 prior to 2.54.2-2.el8_10. A patch is available and has been released in version 2.54.2-2.el8_10.
Multiple security vulnerabilities have been identified in the Data Plane Development Kit (dpdk) affecting versions prior to 23.11-3.el8_10. These include various memory safety issues such as buffer overflows, use-after-free, type confusion, out-of-bounds writes, and time-of-check/time-of-use (TOCTOU) flaws in components like vhost, vhost-crypto, and the nfp vDPA driver. The vulnerabilities collectively pose risks to host system stability and security when processing packets in user space. A security update fixing these issues is available.
A security vulnerability identified as CVE-2026-61642 affects Squid, a high-performance proxy caching server. The issue involves HTTP request smuggling via the Transfer-Encoding header. This vulnerability has been addressed in updated versions of Squid and related libecap packages. The fix is available and has been released by Red Hat for multiple architectures and versions of Red Hat Enterprise Linux 8. No known exploits in the wild have been reported.
CVE-2026-124501 is a medium severity vulnerability in Tidelift moto up to version 5.2.4 involving improper privilege management in the AWS Batch Emulation component. The flaw arises from manipulation of the privileged/volumes argument in the moto/batch/models.py file. Remote exploitation is possible, and public exploit code is available. The vendor has not responded to the disclosure. A patch is available, and the service is cloud-hosted, so vendor-managed remediation is expected.
A vulnerability identified as CVE-2026-19133 affects IBM Tape Library products, which are tape storage solutions. The vulnerability allows an attacker to gain user privileges. No specific affected versions or CVSS score are provided.
Multiple vulnerabilities have been identified in Kyverno, an open-source policy engine for Kubernetes that validates, mutates, and generates policies as code. These issues affect versions prior to 1.19.2. A fix is available in version 1.19.2.
Multiple security vulnerabilities have been identified in Red Hat OpenShift Container Platform, specifically affecting version 4.16.75. One notable issue is in the openshift-ansible installer container, which downloads and executes a remote inventory script without verifying its integrity. Red Hat has released updated packages and images to address these issues and recommends upgrading to these versions promptly.
A vulnerability in the Qt C++ class library for cross-platform graphical user interface programming allows denial of service. The issue affects versions prior to 6.8.10 and is fixed in version 6.8.10.