Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.
CVE-2026-118792 is a vulnerability in CompuGroup Medical Wingesfar where default credentials allow unauthorized access through the AcuXDBC interface. This issue affects versions prior to 2026.07a. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.1. A fix is available in version 2026.07a.
CompuGroup Medical Wingesfar versions prior to 10.2.1 implement software update functionality without adequate authenticity and integrity validation. This allows update packages to be accepted without sufficient cryptographic verification, potentially enabling malicious code to be installed during updates.
CVE-2026-118790 is a vulnerability in CompuGroup Medical Wingesfar involving multiple hardcoded credentials embedded in product components and administrative functionalities. These hardcoded credentials could allow unauthorized users to gain privileged access to accounts, services, or application features. The vulnerability affects versions prior to 2026.07a. A fix is available in version 2026.07a. The CVSS 4.0 base score is 7.2, indicating a high severity level.
CVE-2026-118468 is an XML External Entity (XXE) vulnerability in CompuGroup Medical Infantia. The issue arises because XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled. This improper restriction of XML external entity references can lead to potential security risks. The vulnerability affects multiple versions of Infantia up to and including 6.01.1, 4.51.0, and 8.33.2. It has a high severity rating with a CVSS score of 7.2.
CVE-2026-118467 is a vulnerability in CompuGroup Medical Infantia where shared telemetry and logging components improperly store or transmit sensitive patient and doctor information without adequate pseudonymization or protection. This includes identifiers and clinical data being logged in a way that could expose sensitive information.
Multiple heap out-of-bounds write and stack buffer overflow vulnerabilities have been identified in the Tesseract OCR engine, as used in Red Hat Enterprise Linux 8.8. These flaws can lead to information disclosure, arbitrary code execution, denial of service, and heap corruption when processing crafted data or .traineddata files. Red Hat has issued an important security update addressing these issues.
CVE-2026-118465 is a vulnerability in CompuGroup Medical Infantia where shared components use hard-coded credentials for Access, workgroup, CCBasic, DBISAM, and related databases. These credentials are identical across different installations, potentially allowing unauthorized access if discovered.
CVE-2026-118464 is a vulnerability in CompuGroup Medical Infantia where shared cryptographic services use hard-coded cryptographic keys and weak cryptographic practices such as deterministic IVs, null salts, and reversible transformations. These weaknesses affect the protection of credentials, inter-process communication data, configuration values, and clinical fields. The vulnerability affects versions from 0 up to and including 5.1.1. It has a CVSS 4.0 base score of 5.8, indicating medium severity.
CVE-2026-118462 is a critical vulnerability in CompuGroup Medical Infantia where update components download and execute code without proper authenticity verification. The update process relies on ignored hashes or forgeable checksums, allowing potential execution of unauthorized code. Some update paths also permit archive traversal or script execution, increasing the risk of malicious payload delivery.
CVE-2026-118461 is a high-severity vulnerability in CompuGroup Medical Infantia where the client accepts doctor identifiers for read and write operations without requiring authentication or authorization. This missing authentication for critical functionality allows unauthorized access to sensitive operations.
CVE-2026-118460 is a vulnerability in CompuGroup Medical Infantia where embedded private keys are protected by a shared password. This flaw allows attackers to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized requests for practitioner tokens. The vulnerability affects versions up to 6.09.1 and 5.1.1. It has a high severity with a CVSS 4.0 score of 8. There is no indication of known exploits in the wild or available patches at this time.
CVE-2026-118459 is a vulnerability in CompuGroup Medical Infantia versions up to 5.1.1 involving a weak password recovery mechanism. The emergency password used for forgotten password recovery is derived from time and can be calculated using publicly available application code. This flaw allows an attacker to authenticate without possessing legitimate credentials. The vulnerability has a medium severity with a CVSS score of 6.3.
CVE-2026-118458 is a high-severity vulnerability in CompuGroup Medical's Phronesis product where hard-coded credentials are used. The shared AIS login routing mistakenly selects a production-shipped test Data Access Object (DAO) and performs plaintext comparison for certain application codes, allowing fixed administrator accounts to be accepted.
CVE-2026-118450 is a medium severity vulnerability in CompuGroup Medical's Venere product version 8.33.2. The software is installed outside the Program Files directory and loads or registers unsigned components from locations where unprivileged users can create files. This uncontrolled search path element issue (CWE-427) can lead to the loading of malicious components.
CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.
CVE-2026-121629 is a vulnerability in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS) used in Red Hat Enterprise Linux 10. It allows an attacker who controls or can inject content into a media manifest to include file:// URIs that cause the application to read arbitrary local files. This can lead to disclosure of sensitive local files in automated or server-side deployments. The vulnerability affects RHEL 10.2 and later streams shipping gstreamer1-plugins-good 1.26.x or newer, Fedora 43, and Fedora 44 and Rawhide versions prior to 1.28.9. RHEL 9 and earlier are not affected. Mitigations include avoiding untrusted manifest sources and restricting filesystem access via containers or namespaces.
Multiple integer overflow vulnerabilities were identified in the Ruby 4.0 regular expression compiler, including one affecting CI/CD pipelines. These issues could potentially lead to incorrect behavior or security risks when processing regular expressions. Red Hat has released an update for Ruby 4.0 in Red Hat Enterprise Linux 10 to address these vulnerabilities along with other bug fixes and enhancements.
The npm package @hello.nrfcloud.com/proto-map versions 18.0.0 and 18.1.0 contain malicious code. Any computer with this package installed or running is considered fully compromised, with potential unauthorized control by an outside entity. Immediate rotation of all secrets and keys stored on the affected computer is recommended. Removing the package alone may not fully eliminate the malicious presence.