@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. There is no workaround other than upgrading.
In May 2026, a critical security incident was reported involving the Bash project infrastructure. An attacker exploited a vulnerability allowing code execution via a crafted email address, escalating privileges to superuser, impersonating the Bash maintainer, and gaining push access to the upstream Bash repository. Further exploitation of an unpatched kernel vulnerability granted root access and control over a GNU backup server. The incident was responsibly disclosed to the Free Software Foundation (FSF) and documented in an FSF incident report.
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.
Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.
A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
A critical vulnerability exists in WAVLINK WN536AX6-A firmware version V260507, involving an OS command injection flaw in the openvpn_cli handler component. The flaw is triggered by manipulation of the argument file_id in the /protocol.csp file. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of exploitation. No patch or remediation information is currently provided by the vendor.
A critical stack-based buffer overflow vulnerability exists in WAVLINK WN536AX6-A version V260507 in the OpenVPN Handler component. The flaw arises from improper handling of the openvpn_ip argument in the strcpy function within /protocol.csp. This vulnerability can be exploited remotely without authentication, potentially allowing full system compromise. Public exploit code is available. No patch or remediation information is currently provided by the vendor.
A critical vulnerability exists in WAVLINK WN536AX6-A version V260507 in the WireGuard component. The flaw is an OS command injection via the wireguard_cli_group handler function in /protocol.csp, triggered by manipulation of group_id or group_name arguments. This vulnerability can be exploited remotely without authentication and has a maximum CVSS score of 10. Public exploit code has been disclosed, increasing the risk of exploitation. The vendor was notified early, but no patch information is currently available.
Red Hat Identity Management (IdM) has multiple critical security vulnerabilities affecting authentication, authorization, and LDAP operations. These include unauthenticated denial of service via unbounded request body reads, privilege escalation through krbCanonicalName manipulation, unauthorized LDAP writes via trust relationships, cross-site scripting allowing arbitrary code execution, and unauthorized access to administrator credentials. The vulnerabilities impact FreeIPA components and trust relationships in IdM. Red Hat has issued security updates addressing these issues for Red Hat Enterprise Linux 8.4 variants.
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The shortcut was removed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
A critical vulnerability exists in WAVLINK WN536AX6-A V260507_2.0.0 affecting the Web Management Interface. The flaw is an OS command injection in the function sub_416760 of /bin/ioos triggered by manipulation of the argument group_name. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of attack.
A critical security vulnerability (CVE-2026-120277) exists in WAVLINK WN536AX6-A version V260507_2.0.0 affecting the WireGuard CLI Group Handler component. The vulnerability is an OS command injection via the group_name argument in the sub_41a1d8 function of /bin/ioos. This flaw can be exploited remotely without privileges or user interaction. Public exploit code has been disclosed, increasing the risk of exploitation.