Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.
CVE-2026-57197 is a heap-based buffer overflow vulnerability in Asterisk's handling of OGG/Speex audio packets. It occurs due to an unbounded memcpy operation in the format_ogg_speex component when processing corrupted Speex audio files. An attacker must supply a crafted file and have it played by Asterisk, requiring elevated privileges or administrator cooperation. This flaw can cause Asterisk to crash. Fixed versions include Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases.
The Gentlemen is a Russian-speaking ransomware-as-a-service (RaaS) group active since mid-2025. It operates a double-extortion model by encrypting files and exfiltrating data to pressure victims into paying ransoms. The group targets Windows, Linux, NAS, and BSD systems and has claimed over 800 victims, primarily in the US and Europe. It aggressively offers affiliates up to 90% of ransom revenue. The group uses EDR-killing tools and deletes forensic artifacts to evade detection. A breach of its infrastructure in May 2026 exposed internal communications and affiliate details, providing insights into its operations and links to other ransomware groups.
CVE-2026-109090 is a heap-based buffer overflow vulnerability in the x.org libXi library versions prior to 1.8.4. It occurs when a malicious X server sends an excessively large DEVICE_ENABLE reply, causing libXi to overflow its heap buffer. This flaw was fixed in version 1.8.4.
Authlib versions from 0.15 up to but not including 1.9.1 contain an authorization bypass vulnerability in the ClientConfigurationEndpoint implementations. These implementations improperly verify client permissions by only checking if the target client is editable, without confirming that the request credential belongs to that client. This flaw allows any client with a valid registration access token to read, modify, or delete other clients' registrations. Modifying redirect_uris could lead to authorization code or token interception, and deleting registrations can cause denial of service for affected clients. The vulnerability is fixed in version 1.9.1.
CVE-2026-117512 is a medium severity vulnerability in the oretnom23 php-travel-agency-system. It involves an unrestricted file upload flaw in the admin/employee_insert.php component, specifically via manipulation of the employee photo argument. The vulnerability can be exploited remotely without authentication. Public exploit code exists, but the vendor has not yet responded or issued a patch.
CVE-2026-109088 is an infinite loop vulnerability in the X.org libXtst library versions prior to 1.2.6. A malicious X server can send malformed RECORD EnableContext replies that cause a client using the parse_reply_call_callback function to enter an endless loop, potentially leading to denial of service.
The adyen-web-v6 npm package contains malicious code that compromises any computer on which it is installed or running. Systems with this package should be considered fully compromised, necessitating immediate rotation of all secrets and keys from a separate, secure machine. Removal of the package alone may not eliminate all malicious software introduced by it.
Adobe Substance 3D Painter contains an out-of-bounds read vulnerability that may allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 12.1.5. The issue has a medium severity rating with a CVSS score of 5.5.
Adobe Substance 3D Painter versions up to 12.1.5 are affected by a stack-based buffer overflow vulnerability. This flaw could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability has a high severity rating with a CVSS score of 7.8.
Adobe Creative Cloud Desktop Application versions up to 6.10.0.252.41 are affected by an Uncontrolled Search Path Element vulnerability (CWE-427) that could allow a low-privileged attacker to execute arbitrary code with the current user's privileges. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability has a high severity with a CVSS score of 7.3.
The npm package 'buttoncontent' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean machine. Removing the package alone may not fully remove the malicious software or restore system integrity.
CVE-2025-64394 is a vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.6.0.1102 that allows a low-privileged local user to write arbitrary files with SYSTEM privileges during installation. This insecure operation on Windows junction or mount points can lead to privilege escalation or denial of service. The vulnerability has a medium severity score of 4.3 and requires user interaction for exploitation.
CVE-2026-108141 is a path traversal vulnerability in Veeam Backup and Replication that allows an authenticated user with the Restore Operator role, who can control a backed-up NAS share, to write files to arbitrary paths on the backup server via relative path traversal. This flaw affects versions 13.0 up to but not including 13.0.3 and 13.1 up to but not including 13.1.2. The vulnerability has a medium severity with a CVSS score of 5.9. Fixed versions are 13.0.3 and 13.1.2.
CVE-2026-106078 is a medium severity vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.6.0.1102. It allows an unauthenticated attacker to bypass REST API authentication by using a forged federation token, enabling access to certain REST API endpoints that do not invoke the backup service.
CVE-2026-107671 is a high-severity vulnerability in Veeam ONE versions 13.1 through 13.1.0.7233 that allows an attacker with valid Administrator credentials to bypass multi-factor authentication (MFA). The attacker can disable MFA globally before completing the MFA verification process, effectively circumventing this security control.
CVE-2026-108142 is a critical vulnerability in Veeam Backup and Replication affecting versions 13.0 up to but not including 13.0.3 and 13.1 up to but not including 13.1.2. It allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service due to a failing open authorization check (CWE-636). The vulnerability has a high CVSS 4.0 score of 9.1, indicating network exploitable with no user interaction required and high impact on confidentiality, integrity, and availability. Fixed versions 13.0.3 and 13.1.2 address this issue. No known exploits in the wild have been reported.
CVE-2026-106077 is a high-severity vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.5.0.1014. It allows a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges, potentially exposing sensitive data. A patch is available for this issue.
CVE-2026-106076 is a critical SQL injection vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.5.0.1014. It allows an authenticated organization-transfer peer to inject SQL commands into the source server's configuration database, potentially enabling cross-tenant data access and remote code execution as the PostgreSQL service account.
CVE-2026-108140 is a path traversal vulnerability in Veeam Backup and Replication that allows an authenticated user with the Restore Operator role, who can control backed-up NAS share contents, to write files to arbitrary paths on the backup server. This flaw affects versions 13.0 up to but not including 13.0.3 and 13.1 up to but not including 13.1.2. The vulnerability is fixed in versions 13.0.3 and 13.1.2.