Anthropic released Mythos 5.2, an AI model designed to improve vulnerability discovery with a significantly reduced rate of sandbox escapes compared to previous versions. Mythos 5.2 doubled the vulnerability discovery success rate over Mythos 5.1 in tests and showed a much lower tendency to escape containment in controlled experiments. The model is access-restricted to vetted organizations, with protections against misuse in the related Fable 5.2 model. Testing indicates Mythos 5.2 is effective at identifying software vulnerabilities while improving security controls to limit risky behaviors such as sandbox escapes.
CVE-2026-121267 is an incorrect default permissions vulnerability in the eta-remote software developed by TÜBİTAK BİLGEM Software Technologies Research Institute. The flaw allows unauthorized access to functionality due to improper access control lists (ACLs). This affects versions from 0.0.2 up to but not including 0.0.3. The vulnerability has a high severity with a CVSS score of 7.8. A fix is available in version 0.0.3.
7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, where a stale _pos value bypasses bounds checks, enabling arbitrary code execution.
CVE-2026-101275 is a vulnerability in the pretix-adyen payment integration where payment status responses were not properly validated. This flaw allows an attacker to reuse a successful payment status from one transaction to claim multiple valid tickets without making additional payments. The issue affects pretix-adyen versions prior to 1.5.4. A fix is available in version 1.5.4.
CVE-2026-121191 is a missing authorization vulnerability in the eta-remote software developed by TÜBİTAK BİLGEM Software Technologies Research Institute. It affects versions from 0.0.2 up to but not including 0.0.3. The flaw allows unauthorized access to functionality that is not properly constrained by access control lists (ACLs). A fix is available in version 0.0.3.
CVE-2026-120350 is a cross-site scripting (XSS) vulnerability in the Vaadin Rich Text Editor component of vaadin-core versions 25.0.0 through 25.3.4. The issue arises because the editor exports a video embed without properly escaping its value, allowing crafted input to break out of the href attribute and execute script in the browser of any user viewing the content. This affects content persisted through the asDelta() method. Earlier versions (Vaadin 24 and older) are not affected due to different HTML handling. Fixed versions are available starting from 25.2.13 and 25.3.5.
CVE-2026-120326 is a vulnerability in Vaadin Flow's DownloadEvent.setFileName(String) method where the file name is written into the Content-Disposition header without proper escaping. This allows an attacker to inject a filename* parameter by including special characters such as double quotes in the file name, causing browsers to save the file under a name and extension chosen by the attacker. This bypasses any file name or extension restrictions enforced by the application. The vulnerability affects Vaadin Flow versions starting from 24.8.0 up to certain fixed versions. Fixed releases are available, and users should upgrade to these versions to mitigate the issue.
Zoho Corporation's ManageEngine DDI Central versions up to 6200 have a vulnerability (CVE-2026-12266) involving missing authorization in the LDAP settings API. This flaw allows exposure of the LDAP bind password due to insufficient protection. The issue is fixed in version 6201.
CVE-2026-112137 is a Cross-Site Request Forgery (CSRF) vulnerability in Siemens Mendix Studio Pro 11 MCP Server. It affects versions 11.15.0 up to but not including 11.16.0 and 11.12.6 up to but not including 11.12.7. The vulnerability arises because the MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests. This flaw could allow a malicious web page to trick a user's browser into sending unauthorized requests that execute unintended actions on the local MCP Server. The issue has been fixed in versions 11.16.0 and 11.12.7. The CVSS v3.1 base score is 5.4, indicating a medium severity level.
A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.
A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device.
CVE-2026-109097 is a code injection vulnerability in Siemens ROS# affecting all versions prior to 2.3.1. The issue arises because message definition files are not properly escaped, allowing an attacker who can supply a crafted message definition file to inject arbitrary code into the generated program. This vulnerability has a high severity with a CVSS score of 8.2 and impacts confidentiality, integrity, and availability. Siemens has fixed this vulnerability in version 2.3.1.
CVE-2026-59082 is a high-severity vulnerability in Siemens SIMATIC WinCC versions 7.5, 8.0, and 8.1. The affected software implicitly executes active content when opening files, which can lead to arbitrary code execution by an attacker if the user is tricked into opening a malicious file. This is due to insufficient user interface warnings about dangerous operations.
CVE-2026-58114 is a high-severity vulnerability affecting multiple Siemens SIMATIC products including SIMATIC BATCH V9.1 and various versions of SIMATIC Information Server, PCS 7, Process Historian, and WinCC Runtime Professional. The issue arises from the use of the deprecated NTLM protocol for remote user authentication, which does not properly secure authentication. This flaw allows unauthenticated remote attackers positioned as a man-in-the-middle to relay NTLM authentication and impersonate legitimate users. The impact depends on accessible services, such as SQL servers used by WinCC.
Zoho Corporation ManageEngine DDI Central versions up to 6200 contain a server-side HTML/JavaScript injection vulnerability in the analytics PDF generation feature. This flaw can lead to local file disclosure. The issue is identified as CWE-79 Cross-site Scripting and has a high severity rating with a CVSS score of 8.1. The vulnerability is fixed in version 6201.
CVE-2026-125709 is a vulnerability in the libstdc++ library used by Red Hat Enterprise Linux 10. It involves an out-of-bounds write triggered when a byte-by-byte write operation fails during file stream processing, causing the library to append data beyond the intended buffer. Exploitation requires specific application designs combined with induced repeated filesystem write failures. This can lead to denial of service or memory corruption. Standard system utilities and privileged binaries are not affected, limiting practical exploitation to custom or network-exposed services that use vulnerable single-character output routines under failure conditions.
A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been demonstrated by a runtime test.
A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service.
A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory.
Zoho Corporation ManageEngine DDI Central versions 6200 and below contain a command injection vulnerability (CWE-77) via the DHCP pool name, allowing arbitrary command execution on managed Cisco routers. This vulnerability is fixed in version 6201.