The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application.
The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking.
Multiple security vulnerabilities have been identified and fixed in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include remote code execution, denial of service, information disclosure, use-after-free, and heap buffer overflow issues. The vulnerabilities affect the xfreerdp client and related components, potentially impacting connections to RDP servers such as Microsoft Windows, xrdp, and VirtualBox. Red Hat has issued an important security update for FreeRDP on Red Hat Enterprise Linux 7 Extended Lifecycle Support to address these issues.
@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed. An unauthenticated remote client can trigger this with a single preflight request, so the impact is availability only, and exploitation requires the non-default onSend configuration. The issue is fixed in @fastify/cors 11.4.0, where onSend is no longer an accepted hook value and registration fails with a clear error instead of crashing at request time, and users should upgrade to 11.4.0 or later. As a workaround, use any other hook such as the default onRequest, or set preflight to false.
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. There is no workaround other than upgrading.
The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements.
A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.
When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.
A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets.
Multiple security vulnerabilities have been identified and fixed in GIMP (GNU Image Manipulation Program), including heap and stack buffer overflows, integer overflows, and out-of-bounds writes in various image file parsers and plugins. These flaws could lead to arbitrary code execution or remote code execution when processing crafted image files such as PSD, TIF, ICO, FITS, APNG, and SGI formats. The update addresses these issues to prevent potential exploitation.
The RubyGems package 'shoaib-unity' version 1.0.1 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain associated with malicious activity. No CVSS score or detailed technical exploit information is provided.
In May 2026, a critical security incident was reported involving the Bash project infrastructure. An attacker exploited a vulnerability allowing code execution via a crafted email address, escalating privileges to superuser, impersonating the Bash maintainer, and gaining push access to the upstream Bash repository. Further exploitation of an unpatched kernel vulnerability granted root access and control over a GNU backup server. The incident was responsibly disclosed to the Free Software Foundation (FSF) and documented in an FSF incident report.
Polymarket experienced a supply chain attack via a compromised third-party provider, DebugBear, whose DNS records were hijacked through its domain registrar. Malicious JavaScript served from DebugBear's address was injected into Polymarket's site, targeting logged-in traders to manipulate their portfolios by dumping positions or transferring assets to attacker-controlled wallets. Approximately 726 wallets were affected, with Polymarket returning a total of $3.9 million to traders, covering stolen funds and losses from trading halts. DebugBear's internal systems were not compromised, and the attack appears to have targeted a single customer. The investigation is ongoing, and law enforcement is involved.
A security vulnerability in the perl-HTTP-Daemon package allows arbitrary code execution via OS command injection in the send_file() function. This affects the HTTP::Daemon class, which is used as an HTTP/1.1 server listening on sockets. The issue is tracked as CVE-2026-8450 and has been rated with a high severity impact by Red Hat. A security update is available for Red Hat Enterprise Linux 9.6 Extended Update Support to address this vulnerability.
CVE-2026-107457 is a memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. It occurs under certain MQTT 5 connection settings between client and server and may cause the application to crash.
A denial of service (DoS) vulnerability exists in the DSoftBus module. Exploiting this flaw could impact system availability by causing service disruption. No specific affected versions or patch information are provided.
CVE-2026-101186 is a denial-of-service (DoS) vulnerability in the window module. Exploiting this vulnerability can disrupt the availability of the affected system or service. No specific affected versions or patch information are provided.
A denial-of-service (DoS) vulnerability exists in the DSoftBus module. Exploitation of this flaw can impact system availability but does not affect confidentiality or integrity. The vulnerability has a medium severity rating with a CVSS score of 5.7.
Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 contain an authenticated remote code execution vulnerability. This flaw allows an authenticated user to execute arbitrary code on the affected systems without requiring user interaction. The vulnerability has a high severity score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.
CVE-2026-101171 is a permission control vulnerability in the background task management module. Exploiting this flaw may impact service integrity. The vulnerability has a low severity score and does not affect confidentiality or availability. No affected versions or patches are specified.