CVE-2026-125707 is a moderate severity vulnerability in GStreamer's MXF demuxer where processing a crafted MXF file can cause an off-by-one out-of-bounds write past the end of a temporal offset array. This memory corruption may lead to application crashes. The vulnerability requires local processing of a malicious file and user interaction. No confirmed exploitation or code execution has been demonstrated.
A vulnerability exists in Mendix Studio Pro 11 versions from 11.15.0 up to but not including 11.16.0, and in version 11.12 from 11.12.6 up to but not including 11.12.7. The MCP Server component does not properly restrict its HTTP listener to the loopback interface, potentially exposing it to remote network access. This could allow an attacker with network access to interact with the MCP Server remotely, leading to high impact on confidentiality, integrity, and availability.
A vulnerability in GStreamer's gst-plugins-base RTCP SDES packet parser allows a remote sender to supply a malformed SDES entry with a declared length exceeding the packet size. This missing bounds validation can cause out-of-bounds reads, potentially crashing the application or exposing limited process memory. The flaw affects multiple Red Hat and Fedora versions, with fixes available in newer releases. Mitigations include disabling RTP/RTCP if unused or restricting RTCP ports to trusted peers, but no complete mitigation exists without patching.
Zoho Corporation ManageEngine DDI Central versions 6500 and below contain a vulnerability in the Linux Node Agent that allows unauthenticated updates of the GSS-TSIG keytab. This vulnerability does not impact confidentiality or integrity but results in a high-severity availability impact. No patch information is provided.
A vulnerability in ROS# versions prior to 2.3.1 allows improper escaping of text in message definition files. This flaw could enable an attacker who can supply a crafted message definition file to inject arbitrary code into the generated program. The vulnerability is identified as CVE-2026-109097 with a high severity score of 8.2.
Zoho Corporation ManageEngine DDI Central versions 6500 and below contain a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This flaw allows cluster-scoped operators to inject specially crafted Unicode characters, potentially causing execution of unintended device commands. The vulnerability has a high severity score of 8.0 and affects confidentiality, integrity, and availability. No specific patched versions or vendor advisories are provided in the data.
A vulnerability in the GStreamer gst-plugins-bad MXF plugin allows crafted VANC data to cause out-of-bounds reads and incorrect buffer size calculations to cause out-of-bounds writes. This can lead to application crashes and denial of service when processing malicious MXF content. The flaw affects multiple Red Hat Enterprise Linux versions up to 10.3, with later versions not affected. No confidentiality or integrity impacts are established. Mitigation involves disabling the MXF plugin if not needed or restricting MXF inputs to trusted sources.
A use-after-free vulnerability exists in GStreamer's core buffer value deserialization when processing serialized buffer data containing invalid characters. This flaw can cause applications parsing untrusted caps or structure data to crash. Network-facing GStreamer Data Protocol receivers may process such data without user interaction, potentially leading to denial of service. No further impact such as code execution has been established.
CVE-2026-125672 is a vulnerability in cockpit-storaged where a Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a proper '--' separator. This allows an attacker who can attach a crafted LUKS/clevis block device to cause curl to interpret an address starting with '-' as an option, leading to curl option injection. Exploitation requires a local unprivileged user with console or desktop login access and an administratively-privileged Cockpit user to interact with the affected device's Tang keyserver settings. The flaw can lead to arbitrary file read or write as the Cockpit session user. No complete mitigation exists without a code fix, but restricting local interactive access and verifying keyserver addresses can partially mitigate risk.
A vulnerability in PackageKit Zypp Backend versions before 1.4.1 allows untrusted users to roll back security updates, potentially leading to privilege escalation. This issue affects local users with limited privileges and can impact confidentiality, integrity, and availability of the system. The flaw is tracked as CVE-2026-104619 and has a high severity rating with a CVSS score of 7.8.
A path traversal vulnerability exists in sooperset mcp-atlassian versions up to 0.24.0 in the validate_safe_path function of src/mcp_atlassian/utils/io.py. This vulnerability allows remote attackers with low privileges to manipulate the path argument to access unauthorized file system locations. The issue is fixed in version 0.24.1. The CVSS score is 4.3, indicating a medium severity risk.
Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that allows authenticated attackers with access to any WCK meta box to read custom-field values on posts they cannot edit by exploiting the wck_show_update_form AJAX handler, which lacks the capability checks enforced by other handlers and relies on a shared, non-unique nonce action. Attackers can send a crafted admin-ajax.php request with a valid wck-edit-entry nonce, a target meta key, and an arbitrary post ID to disclose sensitive post-meta or option values belonging to other users, including private or draft post data.
Anthropic released Mythos 5.2, an AI model designed to improve vulnerability discovery with a significantly reduced rate of sandbox escapes compared to previous versions. Mythos 5.2 doubled the vulnerability discovery success rate over Mythos 5.1 in tests and showed a much lower tendency to escape containment in controlled experiments. The model is access-restricted to vetted organizations, with protections against misuse in the related Fable 5.2 model. Testing indicates Mythos 5.2 is effective at identifying software vulnerabilities while improving security controls to limit risky behaviors such as sandbox escapes.
CVE-2026-121267 is an incorrect default permissions vulnerability in the eta-remote software developed by TÜBİTAK BİLGEM Software Technologies Research Institute. The flaw allows unauthorized access to functionality due to improper access control lists (ACLs). This affects versions from 0.0.2 up to but not including 0.0.3. The vulnerability has a high severity with a CVSS score of 7.8. A fix is available in version 0.0.3.
7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, where a stale _pos value bypasses bounds checks, enabling arbitrary code execution.
CVE-2026-101275 is a vulnerability in the pretix-adyen payment integration where payment status responses were not properly validated. This flaw allows an attacker to reuse a successful payment status from one transaction to claim multiple valid tickets without making additional payments. The issue affects pretix-adyen versions prior to 1.5.4. A fix is available in version 1.5.4.
CVE-2026-121191 is a missing authorization vulnerability in the eta-remote software developed by TÜBİTAK BİLGEM Software Technologies Research Institute. It affects versions from 0.0.2 up to but not including 0.0.3. The flaw allows unauthorized access to functionality that is not properly constrained by access control lists (ACLs). A fix is available in version 0.0.3.
CVE-2026-120350 is a cross-site scripting (XSS) vulnerability in the Vaadin Rich Text Editor component of vaadin-core versions 25.0.0 through 25.3.4. The issue arises because the editor exports a video embed without properly escaping its value, allowing crafted input to break out of the href attribute and execute script in the browser of any user viewing the content. This affects content persisted through the asDelta() method. Earlier versions (Vaadin 24 and older) are not affected due to different HTML handling. Fixed versions are available starting from 25.2.13 and 25.3.5.
CVE-2026-120326 is a vulnerability in Vaadin Flow's DownloadEvent.setFileName(String) method where the file name is written into the Content-Disposition header without proper escaping. This allows an attacker to inject a filename* parameter by including special characters such as double quotes in the file name, causing browsers to save the file under a name and extension chosen by the attacker. This bypasses any file name or extension restrictions enforced by the application. The vulnerability affects Vaadin Flow versions starting from 24.8.0 up to certain fixed versions. Fixed releases are available, and users should upgrade to these versions to mitigate the issue.