CVE-2026-124738 is a vulnerability in BusyBox's HTTP daemon (httpd) when pre-compressed file support is enabled. The flaw causes authentication checks to be performed only against the requested URL path, not the actual pre-compressed file served. This allows a remote attacker to bypass password protections by requesting the uncompressed file path with gzip encoding, potentially exposing sensitive files. The issue mainly affects niche configurations and BusyBox httpd is typically used in recovery or initramfs environments, limiting exposure in default Red Hat installations. Mitigations include configuring directory-level authentication, protecting both uncompressed and compressed filenames, or restricting network access to the service.
A use-after-free vulnerability exists in the librsvg2 library when XML includes contain duplicated entities. This security flaw affects the Scalable Vector Graphics (SVG) library based on libart, used in Red Hat Enterprise Linux 10. The issue is identified as CVE-2026-96889 and has been rated with an Important security impact by Red Hat. A security update is available to address this vulnerability.
Dreeze is a startup that has launched a platform called Application Revival designed to recover entire cloud applications after cyberattacks or operational failures. Unlike traditional backup solutions that focus on data recovery, this platform reconstructs applications including configurations, secrets, infrastructure, and dependencies. The platform continuously scans cloud environments to map resources to applications and generates recovery plans stored in an immutable vault under customer control. It supports automated recovery and isolated recovery testing. The AWS version is generally available, with Microsoft Azure support expected in early 2027. This solution addresses the challenge that restoring data alone does not guarantee application availability after incidents.
CVE-2026-78287 is a critical code injection vulnerability in Staggs STAGGS software versions prior to 3.4.0. It allows remote attackers to include and execute arbitrary code on affected systems without any privileges or user interaction. The vulnerability is fixed in version 3.4.0.
CVE-2026-124253 is a high-severity vulnerability in codepeople's Calculated Fields Form plugin that allows DOM-based Cross-site Scripting (XSS) attacks. The flaw exists in versions prior to 5.5.2.9 and involves improper neutralization of input during web page generation, enabling attackers to execute malicious scripts in the context of the victim's browser.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI Engine ai-engine allows Stored XSS.This issue affects AI Engine: from n/a through 3.9.1.
Red Hat has released an important security update for Red Hat Build of Apache Camel 4.22 for Quarkus 3.40 (RHBQ 3.40.1.GA) addressing multiple vulnerabilities. These include security constraint bypass, information disclosure through improper credential handling and property placeholder evaluation, unauthorized file access via path traversal, XML external entity injection, and manipulation of route behavior via injected MIME headers. The update improves security and stability by fixing these issues.
A critical security advisory from Red Hat addresses multiple vulnerabilities in the ANGLE component used by Chromium-based browsers within the webkitgtk4 package. These vulnerabilities include arbitrary code execution, information disclosure, use-after-free, buffer overflow, improper input validation, and uninitialized resource issues. The advisory provides updates for Red Hat Enterprise Linux 7 Extended Lifecycle Support to fix these issues. No CVSS scores are provided, but the impact is rated critical by Red Hat Product Security.
CVE-2026-118965 is a critical path traversal vulnerability in Checkmk discovered host label synchronization affecting versions before 2.5.0p19, 2.4.0p40, and the EOL version 2.3.0. It allows an attacker controlling a remote site in a distributed monitoring setup to write arbitrary files on the central site, leading to code execution as the central site user.
An uncontrolled recursion vulnerability exists in Apache XML Graphics Batik affecting versions up to 1.19. This flaw can lead to potential issues such as application crashes or denial of service. The Apache Software Foundation has addressed this vulnerability in version 1.20, which users are advised to upgrade to.
CVE-2026-120495 is a critical path traversal vulnerability in the Synthetic Monitoring "Robotmk" test service of Checkmk versions prior to 2.5.0p19 and 2.4.0p40, and in version 2.3.0 (EOL). An attacker who can control the agent output of a monitored host can inject crafted robot output to manipulate the generated HTML log's content and location, resulting in code execution as the site user.
CVE-2026-121374 is a critical argument injection vulnerability in the Kubernetes special agent component of Checkmk versions 2.3.0, and versions prior to 2.5.0p19 and 2.4.0p40. It allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user by exploiting crafted node roles in the 'Exclude nodes based on their role' rule option. This can lead to code execution with the privileges of the site user.
CVE-2026-124741 is a vulnerability in the BusyBox udhcpc6 DHCPv6 client used in Red Hat Hardened Images. The client does not properly validate the size of network options from a DHCPv6 server, leading to a stack-based buffer overflow. This flaw can be exploited by a malicious DHCPv6 server on the local network to cause a denial of service or achieve arbitrary code execution with root privileges. The vulnerability primarily affects specialized or embedded environments where BusyBox's udhcpc6 is explicitly used, as standard Red Hat Enterprise Linux installations use NetworkManager instead. No mitigation or patch currently meets Red Hat's criteria for ease of use and deployment.
CVE-2026-124739 is a stack-based buffer overflow vulnerability in BusyBox's httpd web server when processing subdirectory configuration files with overly long index page names. An attacker with write permissions to these configuration files could exploit this flaw to execute arbitrary code with elevated privileges or cause a denial of service by crashing the server process. The vulnerability requires BusyBox httpd to be actively running and serving content from directories writable by untrusted users. Red Hat notes that BusyBox is not deployed as a standard web server by default in Red Hat Enterprise Linux 6, limiting exposure in typical installations.
Siemens and other industrial technology vendors have disclosed multiple high-severity vulnerabilities affecting various ICS/OT products, including Siemens' ROS#, Simcenter Femap, Mendix Studio Pro MCP Server, Simatic SCADA and PCS 7, Meta-iot2050, and Simatic WinCC Graphics Designer. Some advisories also address the impact of the Node2Shell vulnerability. Exploitation attempts of Node2Shell have been observed, though not specifically targeting Siemens products. Additional vulnerabilities affect products from Schneider Electric, Beckhoff, Johnson Controls, Hitachi Energy, and others, with issues ranging from arbitrary code execution to privilege escalation. Siemens notes that patches are not yet available for several affected products, and some versions will not receive fixes, recommending customers apply mitigations. The flaws can lead to code injection, unauthorized data access, and system compromise.
A security update for nginx version 1.24 addresses two vulnerabilities in the ngx_http_core_module, including a heap-based buffer overflow triggered via alias with rewrite referencing $request_filename (CVE-2026-15176) and another unspecified vulnerability (CVE-2026-97205). These issues affect Red Hat Enterprise Linux 8 distributions and have been rated as important by Red Hat Product Security. The update mitigates potential security risks associated with these flaws.
The npm package 'xsdsh-purge-next' version 1.0.0 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate rotation of all secrets and keys from a different, uncompromised computer is advised. Removal of the package alone may not eliminate all malicious software introduced by the package.
An XML External Entity (XXE) vulnerability exists in Apache XML Graphics Batik versions up to 1.19. This vulnerability is classified as CWE-611, indicating improper restriction of XML external entity references. The issue is resolved in version 1.20, which users are advised to upgrade to.
Multiple security vulnerabilities have been identified and fixed in the xorg-x11-server component of Red Hat Enterprise Linux 9.6 Extended Update Support. These include several arbitrary code execution flaws, privilege escalation, use-after-free, double-free, out-of-bounds write, and buffer overflow issues affecting various parts of the X.Org server and Xwayland. The update addresses these critical issues to prevent potential exploitation.
Siemens has addressed multiple vulnerabilities in various products including SIMATIC and COMOS. The specific vulnerabilities are not detailed, and no CVSS score or exploit information is provided. No affected versions or patch details are explicitly stated.