A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.
An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.
An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
Multiple critical vulnerabilities in the Linux kernel have been resolved, including a use-after-free issue in the CAN esd_usb driver, an extent movement flaw in OCFS2, an off-by-one error in NTFS mapping pairs decoding, an out-of-range enum validation in hdac_hdmi codec driver, and a memory leak in the SMC LLC event handler. These flaws could lead to memory corruption, data loss, or denial of service. The vulnerabilities are fixed in Linux kernel version 5.10.0-340.0.0.241.oe2203sp4.
perl-Cpanel-JSON-XS versions before 4.80-1.oe2403sp1 contain multiple security vulnerabilities including memory leaks, type confusion, memory exhaustion, and out-of-bounds writes. These issues arise from improper handling of duplicate keys, malformed UTF-8 in keys, large numeric exponents, incremental parsing buffers, and canonical encoding of tied or shared hashes. The vulnerabilities can lead to process crashes, memory exhaustion, and potential denial of service. A fixed version 4.80-1.oe2403sp1 is available addressing these issues.
Multiple critical security vulnerabilities affecting Mozilla Firefox and Thunderbird were fixed in versions Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. These include same-origin policy bypasses, sandbox escapes, privilege escalations, information disclosures, and numerous use-after-free issues across various components such as DOM, JavaScript engine, graphics, networking, layout, audio/video, and storage. The vulnerabilities have a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
A critical heap memory corruption vulnerability exists in the FlashPix JPEG-tile decoder of the python-pillow library prior to version 13.0.0. This flaw allows crafted OLE2 FlashPix files to cause buffer overflows during image decoding, potentially enabling arbitrary code execution. The issue is fixed in version 13.0.0.
CVE-2026-18963 is a vulnerability in WAGO version 7.36.156 involving the credential recovery process that allows unauthorized account takeover. Exploiting this flaw could enable attackers to access application resources with the privileges of the compromised user, potentially leading to unauthorized access to sensitive data, misuse of privileged functions, and modification of system settings.
Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.
Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Privilege Escalation.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.8.2.
Red Hat Advanced Cluster Security for Kubernetes (RHACS) version 4.11.7 includes critical security and bug fixes. The update addresses vulnerabilities identified by CVE-2026-114406 and CVE-2026-116591. Users of earlier RHACS versions are advised to upgrade to 4.11.7 to benefit from these security patches and enhancements.