Critical severity threats

A critical remote code execution vulnerability exists in Cisco Snort's sf_unfold_header component. This flaw allows unauthenticated remote attackers to execute arbitrary code on affected systems. The vulnerability has been assigned CVE-2026-20043 and carries a high severity rating of 9.8 by the Zero Day Initiative.

A critical security update has been issued for the Linux kernel packages in Red Hat Enterprise Linux 8.8. The update addresses two vulnerabilities: CVE-2026-98432, which fixes improper freeing of inet_opt and ireq_opt after an RCU grace period, and a local privilege escalation vulnerability related to improper ownership management in skb_zerocopy. These kernel vulnerabilities could impact system security due to the kernel's fundamental role. The update requires a system reboot to take effect.

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.

The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submitting a zero-byte file with the 'field_N_hidden' parameter during registration makes the plugin store the raw value, which is then resolved against the document root when the pending signup is activated. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted. Requires open registration and an image-type profile field on the signup form.

Multiple critical authentication bypass vulnerabilities were found in the pyjwt component used by the fence-agents packages in Red Hat Enterprise Linux 10.2 Extended Update Support. These flaws include acceptance of empty HMAC keys, improper public key validation, acceptance of DER public keys as HMAC secrets, unvalidated JWKS redirects, and token forgery via Unicode byte-order mark mishandling. Fence-agents provide scripts for remote power management in cluster environments, allowing forced restart and removal of failed nodes. Red Hat has released security updates addressing these issues.

An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint.

A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.

Red Hat has issued a critical security advisory for multiple vulnerabilities in the Linux kernel packages included in Red Hat Enterprise Linux 9.4. The update addresses several security flaws including out-of-bounds reads, improper ownership management, and validation issues across various kernel subsystems such as networking, HID, Bluetooth, SCTP, ARM64, SCSI, NVMe, and IPv4. The advisory also includes bug fixes and enhancements to prevent kernel panics and NULL-pointer dereferences. Systems must be rebooted after applying the update to ensure the fixes take effect.

CVE-2026-97718 is a critical cross-site request forgery (CSRF) vulnerability affecting version 14.60 of the Secure Access server. Due to a bypassed security control, an attacker can trick an administrator into creating an account under the attacker's control. This vulnerability allows unauthorized account creation through the admin interface via CSRF.

CVE-2026-58936 is a use-after-free vulnerability in the png_set_tRNS function of pngset.c that may cause memory corruption. Exploitation could lead to remote code execution without requiring additional privileges or user interaction.

A heap buffer overflow vulnerability exists in the onOutputReceived function of FrameDecoder.cpp, which can cause an out-of-bounds write. This flaw allows remote code execution without requiring additional privileges or user interaction.

A use-after-free memory safety issue exists in multiple locations, potentially allowing remote code execution without requiring additional privileges or user interaction.

The Ultra Addons for Contact Form 7 WordPress plugin versions up to 3.5.54 contain a critical vulnerability that allows unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient file path validation in the _getObjAttr function. Exploitation requires the PDF Generator add-on to be active and a Contact Form 7 form configured for PDF generation. Successful exploitation can lead to remote code execution by deleting critical files such as wp-config.php.

An unauthenticated arbitrary file upload vulnerability exists in Joomla Extension Custom Tables versions prior to 3.7.8. Attackers can upload files with attacker-controlled extensions to a web-accessible temporary directory via a public submission form. The uploaded files are served as static content, enabling hosting of malicious content such as phishing or malware pages under the victim's domain.

The Joomla extension DJ-Classifieds versions prior to 3.11.3 contains an unauthenticated SQL injection vulnerability in the frontend search functionality. This flaw allows attackers to execute arbitrary SQL commands without authentication, potentially leading to severe impacts on data confidentiality, integrity, and availability. The vulnerability is rated critical with a CVSS score of 9.3. No patch or remediation details are provided in the available data.

DJ-Classifieds Joomla extension versions prior to 3.11.3 contain an authenticated arbitrary file upload vulnerability. This flaw allows an authenticated user with limited privileges to upload files that can lead to full remote code execution (RCE) on the affected system. The vulnerability is critical with a CVSS score of 9.4.

The s2Member WordPress plugin is vulnerable to remote code execution via the 'item_name' parameter due to insufficient sanitization of PHP code tags. Authenticated users with custom-level access or higher can exploit this to execute arbitrary code on the server. This affects all versions up to and including 260927. The vulnerability arises from the strip_php_tags_deep() function only removing literal '<?' sequences, allowing attackers to reconstruct valid PHP openers after interpolation in email templates.

CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.