Critical severity threats

CVE-2026-122013 is a critical path traversal vulnerability in the Comfast CF-WR632AX device version 2.6.0.1. The flaw exists in the Multipart Parser component of the /usr/bin/webmgnt file, allowing remote attackers to manipulate the filename argument to perform path traversal. Exploit code is publicly available, and the vendor has not responded to disclosure requests.

vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.

WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.

Sonatype Nexus Repository 3 Pro versions from 3.86.0 up to but not including 3.98.0 contain a critical authentication vulnerability. The product does not verify the local account status when users authenticate via configured SAML or OAuth2/OpenID Connect identity providers. This allows users whose Nexus accounts have been disabled or locked by an administrator to sign in again using valid identity provider credentials and regain access with their original roles. The vulnerability requires a valid identity provider account and does not affect anonymous users.

CVE-2026-121933 is a critical vulnerability in Linksys E5350 version 1.0.00.037 affecting the Setup Wizard component. The flaw allows remote attackers to bypass authentication by manipulating the wizard_router_pwd argument in the save_settings function of /wizard/apply.cgi. Exploit code has been published, but no vendor response or patch is currently available.

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary and potentially corrupting TEE control-flow data for code execution, denial of service, or system crashes. Both secure-service ecall and interrupt entry paths contain the vulnerable ordering. This issue is fixed in version 5.5.6 and is scheduled to be fixed in versions 6.0.4 and 6.1.1.

bitcoinjs-lib versions from 2.3.0 up to but not including 5.2.1, 6.0.0 up to 6.1.8, and 7.0.0-rc.0 up to 7.0.2 contain a vulnerability in Merkle root validation. The library's fastMerkleRoot function pads odd Merkle-tree levels by hashing the final node with itself but does not detect adjacent duplicate hashes, allowing a peer to append duplicate transactions without changing the Merkle root or block identifiers. This can cause consumers relying on block-root validation, such as explorers or SPV clients, to process duplicated transactions or reject valid blocks. The issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2.

CVE-2026-121932 is a critical OS command injection vulnerability in Linksys E5350 version 1.0.00.037. It affects the system function in /wizard/apply.cgi, where manipulation of the ping_ip or traceroute_ip arguments allows remote attackers to execute arbitrary OS commands. The exploit code is publicly available, and the vendor has not responded to disclosure attempts.

CVE-2026-121931 is a critical OS command injection vulnerability in the Linksys WRT54GL router firmware version 4.30.18. The flaw exists in the Traceroute Diagnostic Function's apply.cgi file, specifically in the system function handling the traceroute_ip argument. This vulnerability allows remote attackers to execute arbitrary OS commands. The exploit code has been publicly disclosed. The product is no longer supported by the vendor, and no patch or vendor response is available.

CVE-2026-121930 is a critical OS command injection vulnerability in the Linksys WRT54GL router firmware version 4.30.18. The flaw exists in the Ping Diagnostic component's apply.cgi file, specifically in the system function, where manipulation of the ping_ip argument allows remote attackers to execute arbitrary OS commands. Exploit code is publicly available. The product is no longer supported by the vendor, and no patch or vendor response has been provided.

In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.

A security update for rsyslog addresses a critical vulnerability (CVE-2026-92709) in the omfile dynaFile template, where untrusted input is used as a path component without secure-path handling, potentially allowing arbitrary code execution. Additionally, a separate issue involving RainerScript replace() length wrap is fixed.

The Red Hat Trusted Artifact Signer (RHTAS) Tech Preview release of the Sigstore A2A image 0.0.2 enables signing and verification of AI/ML workloads. A related vulnerability (CVE-2026-102267) in the PyJWT library involves improper validation of HTTP redirects when retrieving cryptographic keys from JSON Web Key Set (JWKS) endpoints. This flaw allows an attacker who can influence the response of a trusted endpoint to redirect key requests to an untrusted server, potentially leading to acceptance of forged verification keys or exposure of sensitive credentials. No fix is currently available that meets Red Hat's criteria for deployment and stability. The vulnerability is rated as important by Red Hat, with a critical severity assigned to the overall advisory.

The Red Hat Cost Management Metrics Operator for OpenShift has a security advisory addressing multiple vulnerabilities, including CVE-2026-6368. This operator collects OpenShift usage data by querying Prometheus hourly and uploads metrics to Red Hat's Cost Management service. The advisory references several CVEs with critical severity, including a notable out-of-bounds write vulnerability in the PCRE2 library (CVE-2026-103111) that could lead to arbitrary code execution or denial of service in applications using vulnerable JIT compilation of regular expressions. The advisory does not explicitly list affected versions or confirm patch availability for CVE-2026-6368 but provides guidance to apply all relevant errata and operator updates. No known exploits in the wild are reported.

A critical vulnerability exists in PyJWT, a library used for JSON Web Token handling, where improper validation of public keys allows an attacker to forge valid authentication tokens. This occurs when applications accept both symmetric and asymmetric signing algorithms, causing the library to misinterpret asymmetric public keys as symmetric secrets. This flaw enables unauthenticated remote attackers to bypass authentication without the private key. Deployments that enforce a single algorithm type or use JSON Web Key sets are not affected. No patch or mitigation meeting Red Hat's criteria is currently available.

FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a crash.

HP Poly EagleEye Cube USB devices version 1.3.1-001267 have a vulnerability in the administrator authentication flow where session management and access controls are not enforced on the device. This flaw allows unauthenticated users to bypass login and perform administrative actions, including exporting configuration files containing internal administrator credentials and other network system credentials.