@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.
When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.
A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets.
Multiple security vulnerabilities have been identified and fixed in GIMP (GNU Image Manipulation Program), including heap and stack buffer overflows, integer overflows, and out-of-bounds writes in various image file parsers and plugins. These flaws could lead to arbitrary code execution or remote code execution when processing crafted image files such as PSD, TIF, ICO, FITS, APNG, and SGI formats. The update addresses these issues to prevent potential exploitation.
The RubyGems package 'shoaib-unity' version 1.0.1 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain associated with malicious activity. No CVSS score or detailed technical exploit information is provided.
In May 2026, a critical security incident was reported involving the Bash project infrastructure. An attacker exploited a vulnerability allowing code execution via a crafted email address, escalating privileges to superuser, impersonating the Bash maintainer, and gaining push access to the upstream Bash repository. Further exploitation of an unpatched kernel vulnerability granted root access and control over a GNU backup server. The incident was responsibly disclosed to the Free Software Foundation (FSF) and documented in an FSF incident report.
CVE-2026-118871 is a SQL injection vulnerability in ZTE ElasticNet RNIA R18 NGI that allows authenticated attackers to steal database information. The vulnerability requires the attacker to be logged in and has a medium severity rating with a CVSS score of 6.5.
Polymarket experienced a supply chain attack via a compromised third-party provider, DebugBear, whose DNS records were hijacked through its domain registrar. Malicious JavaScript served from DebugBear's address was injected into Polymarket's site, targeting logged-in traders to manipulate their portfolios by dumping positions or transferring assets to attacker-controlled wallets. Approximately 726 wallets were affected, with Polymarket returning a total of $3.9 million to traders, covering stolen funds and losses from trading halts. DebugBear's internal systems were not compromised, and the attack appears to have targeted a single customer. The investigation is ongoing, and law enforcement is involved.
A security vulnerability in the perl-HTTP-Daemon package allows arbitrary code execution via OS command injection in the send_file() function. This affects the HTTP::Daemon class, which is used as an HTTP/1.1 server listening on sockets. The issue is tracked as CVE-2026-8450 and has been rated with a high severity impact by Red Hat. A security update is available for Red Hat Enterprise Linux 9.6 Extended Update Support to address this vulnerability.
CVE-2026-107457 is a memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. It occurs under certain MQTT 5 connection settings between client and server and may cause the application to crash.
A denial of service (DoS) vulnerability exists in the DSoftBus module. Exploiting this flaw could impact system availability by causing service disruption. No specific affected versions or patch information are provided.
CVE-2026-101186 is a denial-of-service (DoS) vulnerability in the window module. Exploiting this vulnerability can disrupt the availability of the affected system or service. No specific affected versions or patch information are provided.
A denial-of-service (DoS) vulnerability exists in the DSoftBus module. Exploitation of this flaw can impact system availability but does not affect confidentiality or integrity. The vulnerability has a medium severity rating with a CVSS score of 5.7.
Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 contain an authenticated remote code execution vulnerability. This flaw allows an authenticated user to execute arbitrary code on the affected systems without requiring user interaction. The vulnerability has a high severity score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.
CVE-2026-101171 is a permission control vulnerability in the background task management module. Exploiting this flaw may impact service integrity. The vulnerability has a low severity score and does not affect confidentiality or availability. No affected versions or patches are specified.
CVE-2026-101170 is a denial-of-service (DoS) vulnerability in a file parsing module that may impact system availability if successfully exploited. The vulnerability does not affect confidentiality or integrity. It has a medium severity rating with a CVSS score of 4. No affected versions or patch information are provided.
CVE-2026-101184 is a permission control vulnerability in the Bluetooth module that may impact system availability if exploited. It has a medium severity rating with a CVSS score of 5.5. No affected versions or patch information are provided.
An out-of-bounds (OOB) read vulnerability exists in the peripheral module. Exploitation of this flaw may compromise service confidentiality. The vulnerability has a medium severity rating with a CVSS score of 5.9. No affected versions or patch information are provided.
CVE-2026-101183 is a use-after-free (UAF) vulnerability in the location service module. Exploiting this flaw may impact system availability. The vulnerability has a medium severity rating with a CVSS score of 5.9. No affected versions or patch information are provided.
CVE-2026-101179 is a buffer overflow vulnerability in the file preview module. Exploitation may impact system availability. The vulnerability has a medium severity score of 4.7 and does not affect confidentiality or integrity. No affected versions or patch information are provided.