A security update for nginx version 1.24 addresses two vulnerabilities in the ngx_http_core_module, including a heap-based buffer overflow triggered via alias with rewrite referencing $request_filename (CVE-2026-15176) and another unspecified vulnerability (CVE-2026-97205). These issues affect Red Hat Enterprise Linux 8 distributions and have been rated as important by Red Hat Product Security. The update mitigates potential security risks associated with these flaws.
The npm package 'xsdsh-purge-next' version 1.0.0 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate rotation of all secrets and keys from a different, uncompromised computer is advised. Removal of the package alone may not eliminate all malicious software introduced by the package.
An XML External Entity (XXE) vulnerability exists in Apache XML Graphics Batik versions up to 1.19. This vulnerability is classified as CWE-611, indicating improper restriction of XML external entity references. The issue is resolved in version 1.20, which users are advised to upgrade to.
Multiple security vulnerabilities have been identified and fixed in the xorg-x11-server component of Red Hat Enterprise Linux 9.6 Extended Update Support. These include several arbitrary code execution flaws, privilege escalation, use-after-free, double-free, out-of-bounds write, and buffer overflow issues affecting various parts of the X.Org server and Xwayland. The update addresses these critical issues to prevent potential exploitation.
Siemens has addressed multiple vulnerabilities in various products including SIMATIC and COMOS. The specific vulnerabilities are not detailed, and no CVSS score or exploit information is provided. No affected versions or patch details are explicitly stated.
Multiple security vulnerabilities have been identified in the gcc compiler packages provided by Red Hat, affecting various language compilers and related support libraries. The issues include integer wrap, out-of-bounds read/write, stack overflow, and out-of-bounds read in different parts of the libstdc++ library and standard components. These vulnerabilities have been assigned CVE identifiers CVE-2026-114690, CVE-2026-114691, CVE-2026-115455, and CVE-2026-115456. Red Hat has released an update for Red Hat Enterprise Linux 10 to address these moderate severity issues.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRockz Delivery & Pickup Date Time for WooCommerce woo-delivery allows Stored XSS.This issue affects Delivery & Pickup Date Time for WooCommerce: from n/a through 1.3.90.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows Stored XSS.This issue affects BP Better Messages: from n/a through 3.2.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Reflected XSS.This issue affects GeoDirectory: from n/a through 2.8.202.
Multiple vulnerabilities in Beckhoff's TcRouter.sys driver expose IOCTL interfaces with insufficient access control, potentially allowing full compromise of affected devices. These flaws affect the x64 version of the product and have been assigned CVE identifiers CVE-2026-18767, CVE-2026-18768, and CVE-2026-18769. No CVSS score or patch information is currently available.
The Wpcdoor backdoor malware was distributed through a South Korean company's DVR management software (CMS). The attack involves DLL side-loading to install a first-stage downloader that retrieves a second-stage downloader, which then executes the Wpcdoor backdoor in memory. Wpcdoor exfiltrates sensitive system information including screenshots, clipboard contents, browser credentials, and cryptocurrency wallet extension data. It targets wallets such as MetaMask, Coinbase, and Phantom. The attacker group Larva-26013 continues to deploy Wpcdoor via multiple vectors beyond the initial DVR software compromise.
CVE-2026-112174 is a local privilege escalation vulnerability in Iperius Backup 8.8.3. It arises from insufficient separation between the GUI running with elevated privileges and local low-privilege users. When the backup service runs persistently with Administrator privileges, a local attacker can exploit native Windows dialogs to execute programs with SYSTEM or Administrator privileges, compromising the Windows system.
CVE-2026-124737 is a heap buffer overflow vulnerability in the BusyBox TFTP client used in Red Hat Enterprise Linux 6. The flaw occurs when the client requests a custom small block size but falls back to the default block size without resizing the allocated memory buffer upon receiving a standard response. A malicious TFTP server can exploit this by sending standard-sized packets, potentially leading to arbitrary code execution or denial of service by crashing the client application.
This security advisory from Red Hat addresses two vulnerabilities affecting Grafana and the klauspost/compress library. The first vulnerability (CVE-2026-88967) involves the Azure Monitor data source in Grafana potentially leaking its Azure access token. The second vulnerability (CVE-2026-116591) is a denial of service issue in the klauspost/compress zstd compression library triggered by crafted compressed input. Red Hat has released updates for Grafana in Red Hat Enterprise Linux 9 to fix these issues.
A URL associated with attacker activity was observed in the wild, linked to CVE-2021-41773 and CVE-2021-42013 vulnerabilities. The URL was seen 182 times on a single day and is related to the T1105 technique (Ingress Tool Transfer), indicating its use in attacker payload delivery or callbacks. The attacker infrastructure was identified in the US. This URL should be blocked and monitored in proxy, web, and WAF logs to detect potential exploitation attempts.
CVE-2026-18769 is a vulnerability in TcRouter.sys that allows a local low privileged attacker to move arbitrary physical memory content via exposed IOCTL function calls. This flaw can lead to a full compromise of affected devices.
Progressive Robot hMailServer 6.3.7's Windows installer has a vulnerability involving incorrect default permissions during installation in certain folder locations. When installed into a new program folder with permissive parent folder permissions (e.g., root of a drive), a local authenticated user can exploit a timing window before the installer hardens folder permissions. This allows the user to place malicious files in the Bin folder, which the installer then executes with administrator privileges, enabling code execution as the installing administrator. Installations under Program Files are not affected due to stricter default permissions.
A vulnerability in Progressive Robot hMailServer versions 6.3.6 and 6.3.7 involves inefficient algorithmic complexity in the JSON reader. This flaw allows a remote unauthenticated attacker to cause denial of service by holding mail delivery threads or REST API worker threads, making mail delivery, REST API, and webmail unavailable. The issue arises from the JSON reader's handling of member names in a hash set that can be manipulated to degrade performance significantly. The attack surface includes TLS-RPT reports mailed to a hosted domain's report mailbox, REST API requests without authentication, webmail routes, and the send API. The vulnerability has a CVSS score of 7.5 (high severity).