Eclipse Kura versions 5.0.0 through 5.6.2 contain a vulnerability in the Wire Graph update functionality of the Web UI and the Wire Service REST API v1. The flaw allows an authenticated user with limited wires management permissions to modify configurations of components outside the Wire Graph, including security-relevant components, by relying on untrusted factory identifiers in requests. This can lead to escalation to full administrative privileges and potential device disruption. The issue requires at least one Driver installed on the device and is fixed in version 5.6.3.
A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges.
Eclipse Kura versions 0.7.0 through 5.6.2 have a vulnerability where deployment packages and REST upload requests can be downloaded or uploaded without any size limit. This can lead to exhaustion of local storage or RAM-backed temporary directories, causing denial of service conditions such as failed configuration persistence, failed logging, and potential crashes of the framework or other services. The vulnerability arises from the lack of limits on the size of data received from remote or local sources.
CVE-2026-120399 is a vulnerability in Red Hat Edge Manager 1's flightctl component where a TLS handshake is performed synchronously without a deadline in the HTTP server's connection-context callback. This allows a network-reachable unauthenticated client to stall the handshake process, causing the affected listener to stop accepting new connections. Existing connections remain unaffected. The issue results in a denial of service (DoS) by resource exhaustion.
CopperDragon is a digital quartermaster entity linked to multiple China-nexus threat actors using the Sparrow malware framework to target telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe. The threat operates through three distinct clusters—SilentDelivery, OceanGate, and DarkWire—each employing different toolsets and initial access techniques, including selective watering-hole attacks and compromising internet-facing infrastructure. The malware framework includes Windows and Linux variants with passive backdoor capabilities and connections to other backdoors like Melofee. SilentDelivery notably uses Trojanized MSI installers disguised as certificate repair utilities delivered via compromised websites in government, shipping, and IT sectors. The campaigns have been ongoing for over a year, targeting high-profile organizations with sophisticated multi-stage infection chains.
Red Hat has released a security advisory for the unbound DNS resolver addressing three vulnerabilities: a DNS cache poisoning issue via promiscuous additional section RRSet acceptance (CVE-2026-42960), a DNSSEC validator NSEC3 hash calculation limit bypass leading to denial of service (CVE-2026-42923), and a denial of service caused by locking inconsistency during RPZ XFR reload (CVE-2026-44608). These issues affect Red Hat Enterprise Linux 10 and related products. The update includes bug fixes and enhancements, updating unbound to version 1.26.1-2.el10_3. The vulnerabilities have been rated with moderate security impact by Red Hat.
CVE-2026-124950 is a same-origin policy bypass vulnerability in the CSS Parsing and Computation component of Mozilla Firefox. This security flaw allows bypassing the same-origin policy, which is a critical browser security mechanism. The vulnerability was fixed in Firefox version 160. The impact of this vulnerability is considered high. No public exploit code or in-the-wild exploitation has been reported.
CVE-2026-124949 is a security vulnerability in the SVG component of Mozilla Firefox. It was addressed and fixed in Firefox version 160. The vulnerability is classified with high impact according to the Mozilla advisory. No specific technical details or exploitation methods are provided beyond the general classification as an 'other issue' in the SVG component.
CVE-2026-124946 is a vulnerability involving an invalid pointer in the JavaScript Engine's Just-In-Time (JIT) compilation component of Mozilla Firefox. This security flaw was addressed and fixed in Firefox version 160. The vulnerability is classified with high impact severity by Mozilla. No public exploit or active exploitation in the wild has been reported. The vendor advisory confirms the fix and recommends updating to Firefox 160 to remediate the issue.
CVE-2026-124945 is a high-impact vulnerability involving an invalid pointer in the Layout: Text and Fonts component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 160. The issue is part of a broader set of high-impact security vulnerabilities resolved in this release.
CVE-2026-124937 is a security vulnerability affecting the Media component in Firefox for Android. The issue was addressed and fixed in Firefox version 160. The vendor advisory classifies the impact of this and related vulnerabilities as high. No specific technical details or exploitation methods are provided for this particular issue.
CVE-2026-124936 is a spoofing vulnerability in the Address Bar component of Mozilla Firefox. This issue could allow an attacker to mislead users by displaying deceptive information in the browser's address bar. The vulnerability was fixed in Firefox version 160.
CVE-2026-124928 is a mitigation bypass vulnerability in the SVG component of Mozilla Firefox. This security flaw was addressed and fixed in Firefox version 160. The vulnerability is classified with high impact by Mozilla, indicating serious security concerns if exploited. No public exploit code or in-the-wild exploitation has been reported. Users are advised to update to Firefox 160 or later to remediate this issue.
CVE-2026-124923 is a sandbox escape vulnerability in the Agent component of Mozilla Firefox. This security flaw allows code running in a restricted sandbox environment to break out of those restrictions. The vulnerability was fixed in Firefox version 160. The impact of this vulnerability is considered high due to the potential for sandbox escape. No public exploit code or in-the-wild exploitation has been reported. Users are advised to update to Firefox 160 or later to remediate this issue.
CVE-2026-124921 is a sandbox escape vulnerability in the Graphics: WebGPU component of Mozilla Firefox. This vulnerability was addressed and fixed in Firefox version 160. The issue allows an attacker to break out of the browser's sandbox environment, potentially leading to unauthorized access or control beyond the browser's normal restrictions.