A threat actor exploited a vulnerability in the RMM+ extension for ConnectWise ScreenConnect to bypass authentication and deploy malware. The campaign compromised at least 6 managed service providers (MSPs) and 288 hosts across 48 organizations within 90 minutes. Attackers used the vulnerability to run commands on managed endpoints, deploying rogue ScreenConnect clients and a malware toolkit called SCKit that provides persistent backdoor access and can self-replicate. ConnectWise disabled five RMM+ family extensions as a mitigation measure.
Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a ten-entry lookup table without checking its range, reading heap memory past the end of the table. An unauthenticated client could trigger this by sending a crafted XML request to a server built with Guththila, the default parser, causing the request to be parsed incorrectly or, in some cases, the process to crash. The memory read is not returned to the client. This issue affects Apache Axis2/C: through 2.0.0. The fix is available in commits 23110287924e79d05a5b4712298c355d1f05c606 and f01683ec10e8fddb87279ec9351b3239021223e6 and will be included in the next release.
A security vulnerability in GNU Aspell allows arbitrary code execution via a crafted dictionary file. This flaw affects Red Hat Enterprise Linux 8.8 variants. Red Hat has issued an important security update to address this issue.
CVE-2026-123765 is a cross-site scripting (XSS) vulnerability in Apache Sling XSS prior to version 2.4.14. The vulnerability arises because the xssAPI.getStyleToken() function improperly neutralizes input, allowing markup in unquoted URLs. This flaw can lead to injection of malicious scripts during web page generation. The issue is fixed in Apache Sling XSS version 2.4.14.
Multiple security vulnerabilities have been identified and fixed in the OpenSSH implementation used by Red Hat Enterprise Linux 8.4. These include local man-in-the-middle attacks on X11 forwarding, client-side denial of service due to double free errors, sftp client file location control by attackers, security bypasses in forwarding and tunneling options, information disclosure via compression side-channels, credential disclosure through failed GSSAPI authentication, denial of service via oversized decompressed packets, and command injection via unvalidated usernames. Red Hat has released an important security update addressing these issues.
CVE-2026-124699 is a code injection vulnerability in Progress Software's Telerik UI for WinForms affecting versions from 2026.3.1007 up to but not including 2026.4.1111. The flaw allows an attacker to supply a crafted expression that leads to unauthorized code execution within the affected application context. This vulnerability has a high severity rating with a CVSS score of 7.8. The issue is fixed in version 2026.4.1111.
CVE-2026-118975 is an XML External Entity (XXE) vulnerability in Progress Software's Telerik Reporting versions prior to 20.3.26.1110. It allows an authenticated low-privilege attacker who can supply SVG content to a report to read local or UNC files or trigger server-side network requests from the host rendering the report. The flaw arises because external XML entities in SVG content are resolved without enforcing strict resource resolution and report path validation. The disclosed data is limited by the permissions of the rendering process and the report output exposure.
The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application.
CVE-2026-106140 is a deserialization of untrusted data vulnerability in Progress Software's Telerik Reporting .NET Framework report designers prior to version 20.3.26.1110. This flaw allows a local attacker with low privileges to execute arbitrary code within the designer process when performing certain editing operations. The vulnerability is rated high severity with a CVSS score of 7.3.
A security researcher publicly disclosed over 30 zero-day vulnerabilities affecting N-able's N-central product, leading to active scanning and probing of exposed instances. N-able responded by taking hosted environments offline, urging customers to disconnect on-premises deployments, and releasing patches for all unauthenticated vulnerabilities. Remaining vulnerabilities require authenticated access and will be addressed in subsequent updates. The disclosed flaws include critical issues such as XXE, XSS, SSRF, privilege escalation, and remote code execution. N-able reports no confirmed compromises in hosted environments but acknowledges ongoing scanning activity leveraging the published proof-of-concept code.
A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows remote unauthenticated attackers to bypass JMX/RMI administrative access restrictions by spoofing the client host address. Exploiting this flaw can grant administrative access to the MBean server and potentially lead to remote code execution. Azul Payara Micro is affected only if its JMX connector is enabled.
A Cross-Site Request Forgery (CSRF) vulnerability exists in Nicu Micle Simple JWT Login plugin versions up to and including 3.6.8. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user by exploiting the lack of proper request validation.
A vulnerability in the Microchip TimePictra platform involves a hard-coded root password present in installation files. This flaw could allow an attacker who gains access to these files to obtain privileged credentials, potentially leading to unauthorized administrative control. The vulnerability has a high severity rating with a CVSS score of 8.8.
CVE-2026-40820 is an unauthenticated SQL Injection vulnerability in the getVpnData function that can be exploited by a high privileged remote attacker. The flaw arises from improper neutralization of special elements in a SQL SELECT command, potentially leading to total loss of confidentiality. The vulnerability has a medium severity score of 4.9 and does not affect availability or integrity. No affected software versions or patches are specified.
A critical vulnerability in the administration REST interface of Azul Payara allows remote, unauthenticated attackers to bypass secure-admin remote-access restrictions by using an arbitrary X-GlassFish-authToken HTTP header. This bypass leads to password-based authentication fallback, which succeeds without credentials on default domains with empty admin passwords, enabling execution of arbitrary administrative commands and full server compromise.
An incorrect authorization vulnerability in AWX, the automation controller component of Red Hat Ansible Automation Platform, allows a user with job template administration rights to attach a webhook token credential they do not have permission to use. This flaw can lead to disclosure of another user's personal access token when a webhook event triggers AWX to send the decrypted token to an attacker-controlled destination. The impact is limited to confidentiality of the credential, with no direct integrity or availability effects. Red Hat rates this flaw as Moderate with a CVSS score of 6.5.
Akaunting version 3.3.0 has a stored cross-site scripting (XSS) vulnerability in the invoice import feature. An authenticated user with permission to create invoices can import HTML content into an invoice status field. This malicious content is stored and later rendered unsafely in a hidden input field when another authenticated user opens the invoice edit form, allowing execution of attacker-controlled markup within the victim's Akaunting session.
CVE-2026-8331 is a vulnerability in the Microchip TimePictra platform involving unrestricted file uploads of dangerous types. This flaw allows attackers to bypass access control restrictions, potentially leading to remote code execution. The vulnerability is rated high severity with a CVSS score of 8.8. No affected versions or patch information are provided in the available data.
CVE-2026-47832 is a vulnerability in the handling of application credentials within BOSH deployments, specifically affecting bosh-openstack-cpi-release versions v55 through v55.0.4 inclusive. The flaw relates to improper credential management, which can lead to high impact security issues. The vulnerability has a CVSS 4.0 base score of 7.3, indicating a high severity level.
CVE-2026-82292 is a medium severity vulnerability involving a NULL pointer dereference in the Qt Framework's QDomDocument::setContent() function within the XML parsing path of the Qt XML module (qtbase). This flaw could potentially cause application crashes or denial of service when processing crafted XML content.