CVE-2026-102082 is a medium severity vulnerability in Juniper Networks Junos OS on SRX Series devices. It involves improper handling of a missing special element in the SSL plugin when 'ssl-proxy' is configured. An unauthenticated network attacker can send a malformed TLS message during a TLS session resumption attempt, causing an invalid pointer access and a Packet Forwarding Engine (PFE) crash. This results in a temporary denial-of-service (DoS) due to loss of traffic forwarding until automatic recovery occurs. The vulnerability affects multiple Junos OS versions prior to specific patched releases.
CVE-2026-102083 is an improper resource locking vulnerability in the UTM WebFiltering subsystem of Juniper Networks Junos OS on SRX Series devices. When the WebFiltering cloud server is unreachable, sustained HTTP traffic can cause the UTM process to crash and restart, resulting in a denial-of-service (DoS) condition. This affects both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF).
CVE-2026-102084 is a high-severity vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series devices. It involves improper validation of syntactic correctness of input, leading to a buffer overflow when processing malformed attributes in AutoDiscovery VPN (ADVPN) messages from peers. Exploitation requires the attacker to be authenticated and possess or have compromised the shared secret to impersonate a peer. Successful exploitation can result in remote code execution and complete control over the affected device. Multiple versions of Junos OS on SRX Series are affected, with patches available in specified fixed versions.
CVE-2026-102086 is a NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series devices. It allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS) by triggering an FPC crash. The issue occurs when multiple DNS queries in a single flow session involve both a Security Intelligence feed match and a DNS Domain Generation Algorithm analysis, leading to an error in asynchronous logging. This vulnerability affects multiple versions of Junos OS prior to specific fixed releases.
A NULL pointer dereference vulnerability was identified and fixed in the Linux kernel's dmaengine ti k3-udma-glue driver. The issue occurs in the k3_udma_glue_release_rx_chn() function when devm_kcalloc() fails to allocate memory for rx_chn->flows, leading to a NULL dereference during cleanup. The fix involves skipping the flow release loop if rx_chn->flows is not allocated.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
* kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
* kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
* kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
* kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
* kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)
* kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
* kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
* kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-84420 is an out-of-bounds read vulnerability in Citrix Workspace app for Windows. It affects versions before 2603.20 CR, before LTSR 2607, and before LTSR 2507 CU3. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.8. No patch or remediation information is provided in the available data.
A vulnerability exists in Fortinet FortiSandbox versions 4.4 (all versions), 5.0.0 through 5.0.6, and 5.2.0 through 5.2.1, including their Cloud counterparts. The issue involves the use of a hard-coded cryptographic key, which may allow an attacker to escalate privileges by sending specially crafted HTTP requests. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity.
CVE-2026-109890 is a missing authorization vulnerability in LeapWorx Premium Addons for Elementor that affects versions from initial release up to 4.11.110. This flaw allows unauthorized users to exploit incorrectly configured access control security levels. The vulnerability has a medium severity with a CVSS score of 5.3, indicating limited impact on confidentiality and no impact on integrity or availability.
A Just-In-Time (JIT) miscompilation vulnerability exists in the JavaScript engine component of Mozilla Firefox. This flaw can lead to high impact on confidentiality and integrity without affecting availability. The issue was addressed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-57143 is an improper input validation vulnerability in MervinPraison's praisonaiagents before version 1.6.62. The vulnerability involves the searxng_search and search_web SearxNG providers passing an LLM-controlled URL parameter directly to requests.get without validating its scheme, host, port, or resolved address. This allows prompt-injected content to access internal JSON services, probe internal ports, and attempt cloud metadata requests, with the results incorporated into the agent context. The issue is fixed in version 1.6.62.
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 have an issue where successful authentication events are not consistently recorded in audit logs. This inconsistency could hinder detection and investigation of unauthorized access or credential misuse. The vulnerability has a high severity rating with a CVSS score of 7.5.
LibreNMS versions prior to 26.9.0 have a path traversal vulnerability in the nfsen_channel_common.inc.php file. This flaw allows authenticated users to read unauthorized RRD data by injecting '../' sequences into the channel parameter. Exploiting this, attackers with access to one NFSen-enabled device can view traffic and NetFlow graphs of devices outside their authorized scope. The vulnerability has a medium severity with a CVSS score of 4.3.
A memory leak vulnerability exists in the SVG encoder (WriteSVGImage) of ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32. This flaw causes allocated memory to not be released when processing crafted SVG images, potentially leading to denial of service through resource exhaustion.
CVE-2026-108482 is a stored cross-site scripting (XSS) vulnerability in LeapWorx Premium Addons for Elementor. It affects versions from the initial release up to 4.11.110. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The CVSS 3.1 base score is 6.5, indicating a medium severity level. Exploitation requires low privileges and user interaction, and it can impact confidentiality, integrity, and availability. No official patch or remediation information is provided in the source data.
Parse Server versions before 8.6.95 and versions from 9.0.0 up to but excluding 9.10.2-alpha.3 contain a vulnerability where file references lacking a URL are not resolved before being passed to Cloud Code triggers and LiveQuery. This causes an uncaught exception that terminates the server process. Attackers with the ability to write to classes with Cloud Code save, find, or delete triggers or LiveQuery enabled can exploit this to crash the server or disrupt subsequent requests. This includes unauthenticated users if public write access or sign-up is allowed.