A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service.
A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.
CVE-2026-120999 is an improper authentication vulnerability in nerves_hub_web affecting versions from 2.3.0 up to but not including 2.5.3. It allows an attacker to register another person's email address and gain access to that person's account once they sign in via Google or follow an email confirmation link. The flaw arises because the system signs in users and confirms emails without verifying ownership of the email address, enabling account sharing without proper authorization. The issue is fixed in version 2.5.3.
CVE-2026-120295 is an incorrect authorization vulnerability in the nerves_hub_web component of nerves-hub. It allows an authenticated user with manage role in one organization and only view role in another to move devices into the second organization's product improperly. This occurs because the system checks membership in the target organization but does not verify the user's manage role there. The vulnerability affects versions from 1.0.0 up to but not including 2.5.3 and was fixed in version 2.5.3.
A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established.
Two vulnerabilities in Helmholz myREX24V2/myREX24V2.virtual allow unauthenticated remote code execution, leading to complete compromise of confidentiality, integrity, and availability.
The Bender EDGE500IP device contains vulnerabilities in its Linux kernel TLS implementation (CVE-2025-39682) and the AF_ALG crypto socket interface (CVE-2025-39964). These vulnerabilities can be exploited by an attacker with local code execution capabilities to compromise the confidentiality, integrity, and availability of the device. Exploitation in the wild is confirmed, and the issue is considered critical. No specific affected versions or patch information is provided.
Multiple vulnerabilities have been identified in Helmholz myREX24V2 and myREX24V2.virtual products. These vulnerabilities collectively can lead to a total loss of confidentiality, integrity, and availability of the affected systems. The specific CVE entries provide detailed information on each individual flaw. No affected versions or patch information are provided at this time.
N-able's N-central product was taken offline after a security researcher publicly disclosed over 30 zero-day vulnerabilities, collectively named Able2Shell. These vulnerabilities could allow attackers to execute remote code with elevated privileges, steal credentials, create unauthorized administrator accounts, and leak sensitive data. The researcher released proof-of-concept code for all flaws. N-able is working on patches and has advised keeping on-premises deployments offline until fixes are available. There is no evidence of exploitation in the wild so far.
A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validate_safe_path of the file src/mcp_atlassian/utils/io.py. The manipulation of the argument path leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.24.1 is capable of addressing this issue. Upgrading the affected component is recommended. This CVE was requested by the vendor.
Two critical vulnerabilities affecting IBM Aspera Faspex and SignalWire FreeSwitch have been exploited in attacks. CVE-2026-123218 is an authorization bypass in IBM Aspera Faspex allowing authenticated users to gain full administrative privileges. CVE-2026-116779 is a code injection vulnerability in SignalWire FreeSwitch that can lead to sensitive information disclosure, arbitrary call control, and command execution. Both vulnerabilities have high severity scores (9.8) and have been added to CISA's Known Exploited Vulnerabilities catalog with urgent patching guidance.
CVE-2026-60043 is a critical cross-site scripting (XSS) vulnerability that allows an unauthenticated remote attacker to execute malicious scripts in the context of a logged-in backend user. Exploitation can lead to execution of critical system actions such as shutting down the server or restoring backups, impacting system integrity and availability.
CVE-2026-60045 is a vulnerability that allows a high privileged remote attacker to upload arbitrary files to a guessable location. This can lead to loss of availability and may be exploited in combination with other vulnerabilities. The vulnerability has a medium severity with a CVSS score of 4.9.
CVE-2026-60046 is a vulnerability allowing an unauthenticated remote attacker to reset passwords for any user if the username and email are known. The attack can be performed without rate limiting, potentially causing a total loss of availability by resetting user passwords.
A vulnerability exists in the application where backups are protected by a weak static password. This flaw allows unauthenticated remote attackers to access backup contents, leading to a complete loss of confidentiality.
CVE-2026-60037 is a vulnerability where a high privileged remote attacker can inject code via the OpenSSL component in the frontends device importer function, potentially leading to full system compromise including loss of confidentiality, integrity, and availability.