CVE-2026-78179 is a medium severity vulnerability in rexrainbow phaser3-rex-notes up to version 1.80.17. It involves improper control of object prototype attribute modification via the SetValue function in the BehaviorTree Blackboard Data Interface component. The vulnerability allows remote attackers to manipulate the argument key, potentially leading to prototype pollution.
CVE-2025-26238 is a high-severity vulnerability in the D-Link DI-8100G firmware version 17.12.20. It involves the 'flag' parameter in the msp_info component, which can be exploited to execute arbitrary code without user interaction or privileges. This vulnerability impacts confidentiality and integrity but does not affect availability.
In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Tear down DMA paths before stopping the rings tbnet_tear_down() stops both rings and frees their frame buffers before calling tb_xdomain_disable_paths(). tb_ring_stop() zeroes the ring's descriptor base and tbnet_free_buffers() unmaps and frees the pages the frames sit in, so by the time __tb_path_deactivate_hop() polls the hop's 'pending' bit, anything still in flight has nowhere to drain to. The teardown sequence has been in this order since the driver was added. The setup path has not: commit ff7cd07f3064 ("net: thunderbolt: Enable DMA paths only after rings are enabled") moved the path enable to the end of tbnet_connected_work() and documented why: /* Both logins successful so enable the rings, high-speed DMA * paths and start the network device queue. * * Note we enable the DMA paths last to make sure we have primed * the Rx ring before any incoming packets are allowed to * arrive. */ Teardown was never updated to match, so the rings and the paths now come down in the same order they go up instead of in reverse. On an ASMedia ASM4242 host router the 'pending' bit then never clears: every teardown burns the full 500 ms timeout and __tb_path_deactivate_hop() returns -ETIMEDOUT. Raising the timeout to 5 s does not help, so the hop is not slow to drain, it never drains at all. The failure is invisible above the thunderbolt core. __tb_path_deactivate_hops() is void and only calls tb_port_warn(); tb_path_deactivate(), tb_tunnel_deactivate() and __tb_disconnect_xdomain_paths() are void as well, and tb_disconnect_xdomain_paths() ends in an unconditional "return 0". So tb_xdomain_disable_paths() reports success and the netdev_warn() below it never fires. Repeated teardowns eventually take the XDomain control channel down, after which the peer node is gone and only a power cycle brings the controller back. Deactivating the paths first fixes it. Measured with kretprobes on a stock v6.17 tree with no other patches applied, on a link that was up and had just carried traffic: before: __tb_path_deactivate_hop() returns 0 for the first hop, then -ETIMEDOUT for the second 500335 us later after: 0 for both, 525 us apart Alternating the two orderings ABBA over three load levels, four teardowns per arm: every teardown failed before the change (21 of 21 that ran), none failed after (0 of 24). The before arms ran short because the link died partway through. The same split shows up when the interface is enslaved to a bond instead of just brought down, which is how I ran into this in the first place. Throughput and latency after the change are unchanged. Hosts whose routers drain the hop despite the stale descriptor base see no functional difference, since the paths end up deactivated either way.
CVE-2026-74695 is a high-severity vulnerability in the Linux kernel's netfilter nf_flow_table component. It involves improper handling of skb destination entries (dst_entry) when calling skb_dst_set_noref(), which can lead to reference count leaks and kernel warnings. This flaw affects Linux kernel versions from 4.16.15 up to and including 4.18. A fix has been implemented in versions 4.17, 4.18, and related commits.
Netty versions from 4.2.0.Final through 4.2.16.Final and up to 4.1.136.Final disable TLS hostname verification on the OpenSSL client path when using a plain X509TrustManager and Unsafe-based trust-manager wrapping is unavailable (Java 25+). This allows a man-in-the-middle attacker to present a certificate for a different hostname that is accepted without validation. The issue is fixed in versions 4.2.17.Final and 4.1.137.Final.
FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: *. Because the embedded server is local and unauthenticated, a malicious website visited by the user can read cross-origin responses. The /media endpoint accepts a filesystem path, allowing a drive-by page to read files accessible to the server process and exfiltrate them without additional clicks. The allowed_origins configuration and FIFTYONE_ALLOWED_ORIGINS environment variable now make cross-origin access explicit, while the default policy is same-origin. This issue is fixed in version 1.17.0.
Multiple security vulnerabilities were discovered in the Linux kernel for NVIDIA systems (linux-nvidia-6.17). These issues affect a wide range of kernel subsystems and drivers, potentially allowing an attacker to compromise the system. The vulnerabilities are addressed in the linux-nvidia-6.17.0-1031.31 update, which requires a system reboot and recompilation of third-party kernel modules due to an ABI change.
ProfilePress WordPress plugin versions before 4.17.1 contain a vulnerability where shortcodes are not stripped from two profile fields before rendering on public pages. This allows unauthenticated attackers to store shortcodes that execute when the page is viewed, potentially disclosing a user's email address, login, and registration date.
CVE-2026-59296 is a medium severity vulnerability in Spring Micrometer involving improper output neutralization for logs (CWE-117). It arises from using untrusted, non-normalized input directly in metrics data such as metric names, tag keys, or tag values. This can lead to injection issues affecting the integrity of logs or monitoring data. The affected versions include Micrometer 1.17.0, 1.16.0 through 1.16.6, 1.15.0 through 1.15.12, 1.14.0 through 1.14.16, and 1.9.18 and earlier. No known exploits are reported in the wild, and no official patch or remediation details are provided in the input data.
Bulletin ID: 2026-009-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/03/17 12:15 PM PDT Description: Kiro is an AI-powered IDE for agentic software development. We identified CVE-2026-4295, where improper trust boundary enforcement allowed arbitrary code execution when a user opened a maliciously crafted project directory. Impacted versions: < 0.8.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
CVE-2026-75910 is a vulnerability in the ClickHouse connector deployment template for Amazon Athena Federated Query prior to version 2026.17.1. It involves incorrect privilege assignment that could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account. This occurs if the attacker points the connector's connection string to an unrelated secret and a database endpoint under their control, causing the secret to be transmitted to that endpoint. The issue is fixed in version 2026.17.1. Users should upgrade to this version or later, or redeploy the connector with the current template and specify a non-empty SecretNamePrefix value to mitigate the risk.
CVE-2026-66787 is a vulnerability in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. It involves insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this flaw to redirect legitimate service traffic to malicious endpoints, enabling transparent Man-in-the-Middle (MITM) attacks on cross-cluster communications. This can lead to unauthorized information disclosure and data manipulation. The vulnerability has a high severity with a CVSS score of 8.7. Red Hat has addressed this issue in version 2.17 with security fixes and updated container images.
CVE-2026-55095 is a medium severity vulnerability in OpenProject, an open-source project management software. In versions 17.5.1 and earlier, authenticated non-admin project members can access a read-only dialog that reveals hidden comment text of a raw custom project field. This disclosure does not include the custom field's value nor does it allow modification. The issue is fixed in version 17.6.0.
A NULL pointer dereference vulnerability exists in the X.509IF protocol dissector of Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. This vulnerability can cause Wireshark to crash, resulting in a denial of service condition. The issue is identified as CWE-476 and has a CVSS v3.1 score of 7.5, indicating high severity.
CVE-2026-76926 is a reachable assertion vulnerability in the BUSMASTER file parser component of Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. This vulnerability can cause Wireshark to exit abnormally, resulting in a denial of service condition. The issue has a low severity rating with a CVSS score of 3.1. No known exploits are reported in the wild, and no official patch or remediation information is currently available.
CVE-2026-76889 is a heap-based buffer overflow vulnerability in the UMTS FP protocol dissector of Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service. The vulnerability has a medium severity rating with a CVSS score of 4.7.
A NULL pointer dereference vulnerability exists in the Bluetooth BR/EDR FHS protocol dissector of Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition.