CVE-2026-126613 is a high-severity vulnerability in Progressive Robot Ltd's hMailServer versions 6.3.2 through 6.3.7. It involves allocation of resources without limits in the JSON reader, allowing remote attackers to exhaust server memory and threads. This causes unavailability of mail delivery, the REST API, and webmail services. The issue arises because the JSON reader builds a large tree of values without bounding the number of values, leading to excessive memory use from specially crafted JSON documents up to 16 MB in size. The vulnerability can be triggered via TLS-RPT reports, REST API requests, and webmail routes under certain configurations. This defect is distinct from CVE-2026-107574 and has no known exploits in the wild.
CVE-2026-126612 is a vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.7. It involves improper link resolution in the Windows installer, allowing a local authenticated user to execute code with elevated privileges by exploiting symbolic links or junctions that redirect installation paths. The default installation under Program Files is not affected. The vulnerability has a high severity score of 7.8.
CVE-2026-126610 is a vulnerability in Progressive Robot Ltd's hMailServer versions 6.3.4 through 6.3.7 when configured with a MySQL or MariaDB database and TlsMode=verify-full. The issue arises because the server fails to provide the database client with the correct CA file if the CA file name contains non-ASCII characters on Linux or characters above U+00FF on Windows. This causes the client to verify the database server's certificate against the system trust store rather than the intended CA, allowing an attacker who can intercept the database connection to read and modify traffic by presenting a certificate from any authority or even a self-signed certificate under certain conditions. The vulnerability is related to improper certificate validation (CWE-295) and is exacerbated by specific behaviors in MariaDB Connector/C versions 3.4.2 to 3.4.10.
CVE-2026-126611 is a vulnerability in Progressive Robot Ltd's hMailServer versions 6.3.4 through 6.3.7 when configured with MySQL or MariaDB, TlsMode=verify-full, and no TlsCaFile. The server does not properly verify the database server's certificate issuer or name for connections treated as local by MariaDB Connector/C. This allows a local attacker who can impersonate the database server to intercept database credentials and read or modify traffic between hMailServer and the database.
CVE-2026-126607 is an uncontrolled search path element vulnerability in Progressive Robot Ltd's hMailServer versions 6.2.3 through 6.3.7 on Windows when using MySQL or MariaDB databases. The issue arises from how the MariaDB Connector/C client interprets the plugin folder path using system ANSI code pages, allowing a local authenticated user to execute code with the hMailServer service's privileges by placing a malicious DLL in a crafted folder path. Version 6.3.8 addresses this by properly handling folder paths and restricting plugin loading to secure locations. Linux builds are not affected.
A denial of service vulnerability exists in the Tornado Python library's CurlAsyncHTTPClient due to a decompression bomb. This issue is identified as CVE-2026-103262 and affects Red Hat Enterprise Linux 10 distributions. The vulnerability can cause service disruption by exhausting resources during decompression of crafted data. Red Hat has issued a security advisory and released updates to address this flaw.
hMailServer versions 6.2.25 through 6.3.7 on Windows with PostgreSQL configured to require SSL certificate validation may improperly validate the root certificate file due to encoding mismatches. This allows a local attacker who can place a specially named file in certain directories to cause hMailServer to trust a malicious certificate authority, enabling interception and modification of database traffic including credentials. The issue affects configurations using PostgreSQLSslRootCert or TlsCaFile with certain client libraries. Linux builds and default configurations without a root certificate file named are not affected.
A denial of service vulnerability exists in iperf3 due to an infinite loop in the UDP receive worker. This flaw can cause the affected system to become unresponsive when processing UDP traffic. Red Hat has issued a security update addressing this issue in iperf3 on Red Hat Enterprise Linux 10.
Red Hat has issued an important security advisory for Delve, a debugger for the Go programming language, addressing multiple denial of service vulnerabilities and a man-in-the-middle attack vector. The update to Delve version 1.27 for Red Hat Enterprise Linux 10 includes fixes for excessive recursion in ASN.1 unmarshalling, unencrypted HTTP/2 connection DoS, indefinite TLS KeyUpdate message DoS, crafted HTTP Range header DoS, multiple ECH extension DoS, and untrusted intermediate certificate MITM attacks.
Multiple denial of service vulnerabilities and heap-based buffer overflows have been identified in various protocol dissectors of Wireshark, a network protocol analyzer. These issues affect the C12.22, RRC, ESS, X.509IF, H.245, and SPDY protocol dissectors, potentially causing crashes or memory corruption. Red Hat has issued security updates for Wireshark in Red Hat Enterprise Linux 10 to address these vulnerabilities.
Multiple security vulnerabilities have been identified in libreswan, an implementation of IPsec and IKE for Linux. These include an IKEv2 Use-After-Free bug when using IKE-over-TCP, a pre-authentication Null Pointer Dereference in the EAP code, and a Null Pointer Dereference in the PKCS#7 bundle with no certificates. These issues affect Red Hat Enterprise Linux 10 across multiple architectures and have been rated with an important security impact by Red Hat.
CVE-2026-18769 is a high-severity vulnerability in Beckhoff Automation's TcRouter.sys driver for Windows x64. It involves exposed IOCTL function calls with insufficient access control, allowing a local low privileged attacker to move arbitrary physical memory content. This flaw can lead to a full compromise of affected devices. Fixed versions are 3.1.0.2365 and 3.18.1.
CVE-2026-18768 is a high-severity vulnerability in Beckhoff Automation's TcRouter.sys driver for Windows x64. It allows a local low privileged attacker to access arbitrary physical memory or define its mapping due to exposed IOCTL function calls with insufficient access control. This flaw can lead to a full compromise of affected devices. The vulnerability affects versions 1.0.0 up to but not including 3.1.0.2365 and 3.16.29 up to but not including 3.18.1. Fixed versions are 3.1.0.2365 and 3.18.1.
CVE-2026-18767 is a high-severity vulnerability in Beckhoff Automation's TcRouter.sys driver for Windows x64. It involves exposed IOCTL function calls that allow a local low privileged attacker or process to access I/O ports without sufficient access control. This flaw can lead to a full compromise of affected devices. The vulnerability affects versions 3.1.0.2364 and earlier up to but not including 3.1.0.2365, as well as versions 3.16.29 and earlier up to but not including 3.18.1. A fix is available in versions 3.1.0.2365 and 3.18.1.
Multiple vulnerabilities have been fixed in N-able N-central affecting versions older than 2026.4.1.26. These vulnerabilities include issues related to XML external entities, cross-site scripting, improper access control, and others as indicated by associated CWE identifiers.
CVE-2026-116468 is a vulnerability in the Red Hat build of Keycloak's keycloak-services component, specifically in the group-move and organization group reparenting endpoints. The flaw allows a delegated administrator to move a group they control under an administrative group without proper authorization checks, resulting in all members inheriting full realm-admin privileges. This grants complete control over the realm, including user management and security configurations. The issue is a missing authorization check and represents an incomplete fix of a prior vulnerability (CVE-2026-94000).
Two recently patched vulnerabilities in Barracuda appliances allow attackers to bypass authorization and gain root access. CVE-2026-116606 is an authentication bypass in Barracuda Email Security Gateway that lets an attacker with Admin UI access restore a crafted backup to modify configurations. CVE-2026-111560 is a command injection flaw affecting multiple Barracuda products, enabling an attacker with administrative access to execute OS commands as root. These vulnerabilities have been exploited in the wild against a small number of organizations. CISA has added both to its Known Exploited Vulnerabilities catalog and urges rapid patching.
HCL Domino Leap contains a stored cross-site scripting (XSS) vulnerability via malicious application titles in Manage page dialogs. This flaw allows attackers to execute arbitrary scripts in the context of a user's session, potentially leading to session takeover. The vulnerability requires high privileges and user interaction to exploit. It has a CVSS v3.1 base score of 6.8, indicating medium severity.
HCL Leap contains a stored cross-site scripting (XSS) vulnerability in the Manage page dialogs via malicious application titles. This flaw allows an attacker with high privileges to inject scripts that can hijack user sessions.