A Blind SQL Injection vulnerability exists in Futurum Software’s management software due to insufficient validation and sanitization of user inputs in database queries and an incorrect Web Application Firewall (WAF) configuration. This flaw allows attackers to bypass protection mechanisms by sending manipulated HTTP requests. Exploitation could enable unauthenticated attackers to execute arbitrary SQL queries, extract the database structure, and access sensitive customer data including personally identifiable information (PII).
A China-linked threat actor exploited chained vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) and a Linux kernel privilege escalation flaw (CVE-2026-46300, Fragnesia) to gain root access to firewalls of a US government-affiliated organization. The attackers used an internet asset search engine to identify vulnerable firewalls, successfully compromised 25 devices, and deployed persistent PHP root webshells on 24 of them. They further used a reverse SSH tunnel to access an internal firewall management server, extracting sensitive configurations and credentials, and attempted Active Directory backdoor creation. The attacks targeted firewalls in the US, Japan, Taiwan, and South Korea, indicating a strategic focus on these regions. The incident highlights a sophisticated multi-stage exploitation chain with significant impact on network security and domain control.
A vulnerability in the Linux kernel's drm/vc4 HDMI driver caused a kernel crash due to improper handling of Packet RAM power management. Audio infoframe writing could occur when Packet RAM was disabled, leading to a kernel warning and crash. The issue was fixed by moving Packet RAM enablement to runtime power management hooks.
A vulnerability in the Linux kernel's futex subsystem related to FUT_OFF_MMSHARED futexes has been fixed. The issue allowed processes to wait on shared futexes linked to a freed memory management structure (MM), potentially causing wakeups intended for new MMs to be consumed incorrectly. The fix involves using a unique 64-bit ID per MM to key FUT_OFF_MMSHARED futexes, preventing cross-MM wakeup consumption.
A resource leak vulnerability was identified and fixed in the Linux kernel's viai2c-wmt driver. The issue involved the clock reference count not being decremented properly in the wmt_i2c_probe() function, leading to a clock leak. The fix involved switching from manual clock management with of_clk_get() to automatic management using devm_clk_get().
A vulnerability in the Linux kernel's iSCSI implementation allows a target to reference invalid task slots in the task pool, leading to null pointer dereferences and kernel crashes. This occurs because the task validation in management responses does not sufficiently verify that the task is active and valid. The issue has been fixed by requiring that tasks be in flight and not SCSI commands, preventing invalid task references.
A vulnerability in the Linux kernel's AMDGPU driver (amdgpu_gpr) causes a runtime power management reference count underflow when reading wave registers on Navi31 hardware. This occurs because the runtime PM reference is dropped twice if copying data to userspace fails, potentially leading to improper power management state.
A vulnerability in the Linux kernel's KVM x86 memory management unit (MMU) handling causes improper processing of the SS bit in nested page fault (#NPF) exit codes. This leads to out-of-bounds accesses in permission_fault(), resulting in kernel warnings or undefined behavior sanitizer (UBSAN) reports. The issue arises when running Hyper-V on Windows 11 guests under KVM, due to unexpected SS bit settings in nested page fault error codes. The Linux kernel has fixed this by adjusting error code handling to drop unexpected bits while preserving the SS bit when reflecting faults to the L1 hypervisor.
A memory management vulnerability in the Linux kernel's AMDGPU driver causes user pointer ranges to leak when command submission (CS) fails after the parser_bos stage. This leak occurs because certain error paths do not free allocated HMM ranges, resulting in resource leakage including memory and buffer object references. The issue has been fixed in recent Linux kernel commits.
A vulnerability in the Linux kernel scheduler subsystem was fixed to correct improper handling of bypass dispatch claims among schedulers bypassed by an ancestor. The flaw caused incorrect claim propagation in scheduler bypass depth tracking, leading to potential leaks of bypass dispatch claims and warnings during power management suspend/resume cycles. This fix ensures that every descendant scheduler properly claims and releases bypass dispatches according to their depth changes.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including specific LTS releases, contain a missing authorization vulnerability (CWE-862). This flaw allows a low privileged remote attacker to perform unauthorized operations. The vulnerability has a high severity score of 7.1 and affects multiple release lines. Fixed versions are available starting from 8.9.0.0 and corresponding LTS patch releases.
Cisco has addressed multiple vulnerabilities in its Secure Firewall ASA, Threat Defense, and Management Center products. These vulnerabilities have been grouped into eight different classes, each assigned a unique CVE identifier. No specific technical details, affected versions, or impact information are provided in the available data.
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access to managed systems.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including multiple LTS releases, contain a missing authorization vulnerability (CWE-862). This flaw allows a low privileged attacker with remote access to potentially perform unauthorized system operations on managed systems. The vulnerability has a critical severity with a CVSS score of 9.6. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 depending on the release line.
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Infisical, a secrets management company, has raised $40 million in Series B funding, valuing it at $600 million. The company provides tools for managing secrets, encryption keys, digital certificates, and privileged access across cloud, on-premises, and AI infrastructures. Its Agent Vault technology enables AI agents to access sensitive systems without exposing underlying credentials by injecting secrets at a proxy and logging all requests. Over 1,300 organizations use Infisical's products. The funding will be used to enhance product development and AI agent security capabilities.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and certain LTS releases contain an SQL Injection vulnerability (CWE-89). This flaw allows a low privileged remote attacker to potentially disclose information by exploiting improper neutralization of special elements in SQL commands. The vulnerability has a medium severity with a CVSS score of 4.3. Fixed versions are available starting from 8.9.0.0 and corresponding LTS release updates.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain an SQL Injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially expose information. The vulnerability does not impact integrity or availability and has a low CVSS score of 2.7.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and certain LTS releases contain an SQL Injection vulnerability. This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability has a low CVSS score of 2.7, indicating limited impact. No public exploits or patches are currently documented.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including several LTS releases, contain an authentication bypass vulnerability that allows a low privileged remote attacker to elevate privileges. This flaw could also affect other managed Data Domain systems.