A Use After Free vulnerability (CWE-416) exists that may allow arbitrary code execution if a local attacker convinces a user to open a specially crafted malicious SSD file. The vulnerability requires local access and user interaction. It has a medium severity rating with a CVSS score of 4.6. No patch or remediation details are currently provided.
CVE-2026-123868 is a vulnerability in Node.js versions 24.x and 26.x where an unauthenticated HTTP/2 client can exhaust server memory. The issue arises because inbound DATA frames queued on an undrained stream are not properly accounted against the session memory budget, allowing excessive memory retention. This can lead to denial of service by exhausting server resources.
CVE-2026-123829 is a permission model bypass vulnerability in Node.js recursive file watching on macOS and Windows. It allows processes with read permission on a directory to learn the names and timing metadata of files and directories within subdirectories they cannot read. This occurs because the native libuv watcher forwards file names without verifying read permissions on each path. The vulnerability does not expose file contents and requires files created by another actor under the watched directory. It affects Node.js versions 22.x, 24.x, and 26.x.
A reachable assertion vulnerability in Node.js HTTP/2 session teardown allows any unauthenticated client to abort the server process. This occurs because an Http2Stream holding nghttp2-allocated header buffers can outlive its session, causing a failed assertion during session destruction. The issue affects Node.js versions 26.x (since 26.9.0) and 24.x (since 24.22.0) and is a variant of a previously fixed vulnerability (CVE-2024-27983).
Node.js versions 22.x, 24.x, and 26.x disclose proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. This occurs because certain error paths interpolate the raw proxy URL, including sensitive credentials, into error messages that are exposed to stderr, logs, and crash reporting services. The vulnerability results from incomplete redaction of proxy credentials in error outputs.
A vulnerability in the Node.js zlib streaming API allows an uncatchable exception to crash a process when a peer disconnects during compression. This occurs because zlib.params() queues a flush operation that completes in a callback, which asserts on a native handle that may no longer exist if the stream is destroyed, causing an internal assertion error that terminates the process. The issue affects Node.js versions 22.x, 24.x, and 26.x and requires the application to call deflate.params() while streaming to a peer, which is uncommon.
A one-byte heap buffer overflow vulnerability exists in Node.js HTTP/2 Alt-Svc handling. This flaw allows a remote, unauthenticated attacker to corrupt process memory by sending a specially crafted request with a long :authority header. The vulnerability affects Node.js versions 24.x and 26.x and can cause the process to abort due to out-of-bounds memory writes.
CVE-2026-123866 is a use-after-free vulnerability in Node.js HTTP/2 stream teardown that can leak response memory, including data from other connections' response buffers, to a peer. This occurs when a stream is torn down while a write is still backpressured, causing freed or unrelated heap memory to be sent instead of the intended response. The flaw affects Node.js versions 22.x, 24.x, and 26.x. The vulnerability has a high severity score of 7.5 and impacts confidentiality but not integrity or availability.
A certificate validation bypass vulnerability exists in Node.js https.Agent where cached TLS sessions authenticated under a broader CA policy can be reused in connections with stricter CA policies. This occurs because the session cache key does not differentiate between omitted and empty CA arrays, allowing a TLS 1.3 session authenticated with the default trust store to be resumed in a connection that explicitly supplies an empty CA list. This leads to unauthorized acceptance of TLS sessions and potential exposure of confidential data. The issue affects Node.js versions 22.x, 24.x, and 26.x.
A command injection vulnerability exists in the xfs_admin utility of xfsprogs due to improper validation of user-supplied parameters. A local attacker with access to supply crafted input arguments can execute arbitrary operating system commands, potentially leading to local privilege escalation depending on the execution context of xfs_admin. On standard Red Hat Enterprise Linux systems, administrative restrictions limit exposure, but environments passing untrusted inputs without validation are at risk. No official patch or mitigation currently meets Red Hat's criteria for deployment.
CVE-2026-126262 is a critical SQL injection vulnerability affecting multiple versions of Fortinet FortiAnalyzer and FortiManager. It allows an unauthenticated attacker with access to the OFTP port to execute unauthorized code or commands on the affected systems. The vulnerability impacts FortiAnalyzer versions 7.2.0 through 8.0.1 and FortiManager versions 7.2.0 through 8.0.0. An official fix is available for this issue.
CVE-2026-121528 is an improper certificate validation vulnerability in Fortinet FortiOS versions 6.4.0 through 6.4.16, 7.0.0 through 7.0.19, 7.2.0 through 7.2.13, 7.4.0 through 7.4.9, and 7.6.0 through 7.6.4. This flaw may allow a remote and unauthenticated attacker to conduct a Man-in-the-Middle (MitM) attack on the communication channel between the SSLVPN web portal and the backend destination website. The vulnerability has a high severity with a CVSS score of 7.7. An official fix is available from the vendor.
CVE-2026-126259 is a critical vulnerability in Fortinet FortiOS versions 7.0.0 through 8.0.0 that allows unauthenticated attackers to execute commands as super admin. The flaw arises from missing authentication for critical functions related to HA FGSP + standalone-config-sync or autoscale, enabling command execution via crafted HA packets.
CVE-2026-126263 is a critical SQL injection vulnerability in Fortinet FortiMail versions 7.4.0 through 7.4.6, 7.6.0 through 7.6.4, and 8.0.0 through 8.0.1. It allows an authenticated attacker to execute unauthorized code or commands via specially crafted requests due to improper neutralization of special elements in SQL commands.
A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an unauthenticated attacker to bypass authentication via specially crafted credentials.
CVE-2026-126256 is an out-of-bounds read vulnerability in Fortinet FortiOS versions 7.0 through 8.0.1. This flaw may allow a remote attacker without privileges to execute arbitrary code or commands by sending specially crafted packets. The vulnerability affects multiple FortiOS release lines and has a high severity rating with a CVSS score of 7.4. An official fix is available from Fortinet.
CVE-2026-121527 is a vulnerability in Fortinet FortiClientEMS versions 7.2.0 through 7.2.15, 7.4.0 through 7.4.1, and 7.4.3 through 7.4.7 that allows an authenticated local attacker with administrative privileges to escalate to root shell access via CLI commands. This flaw involves execution with unnecessary privileges. The vulnerability has a CVSS score of 6.3, indicating a medium severity level. An official fix is available for the affected versions.
CVE-2026-126254 is a critical numeric truncation error vulnerability in Fortinet FortiOS versions 7.2.0 through 7.2.13, 7.4.0 through 7.4.12, 7.6.0 through 7.6.7, and 8.0.0 through 8.0.1. It allows a configured iBGP neighbor to send malicious or malformed attributes that can cause denial of service to all connected routers.
CVE-2026-126258 is a stack-based buffer overflow vulnerability in Fortinet FortiOS versions 8.0.0 and 7.6.7. It allows an unauthenticated attacker with access to the wad port to crash proxy or ZTNA sessions by sending crafted HTTP or HTTPS requests. The vulnerability has a high severity with a CVSS score of 7.1. An official fix is available from the vendor.
CVE-2026-126257 is a critical vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. It involves a hard-coded password that may allow an unauthenticated attacker to bypass credential validation under certain conditions, leading to unauthorized access and privilege escalation.