Critical severity threats

CVE-2026-115829 is a critical authentication bypass vulnerability in Delinea Secret Server (On-Prem) versions earlier than 12.3.1. It allows an attacker to generate a two-factor authentication (2FA) PIN code for any account without prior authentication and then bypass the initial login step by authenticating using only the second factor.

CVE-2026-115828 is a critical improper access control vulnerability in Delinea Secret Server (On-Prem) versions earlier than 12.3.1. The issue arises because the software did not always validate the PIN or biometric check when using a FIDO2-compliant device, potentially allowing unauthorized access.

CVE-2026-61850 is a critical improper privilege management vulnerability in akuity kargo affecting versions from 0.6.0 up to but not including 1.8.14, 1.9.9, and 1.10.8. It allows authenticated users with delegated permission to manage a Project's Roles or ServiceAccounts to escalate privileges beyond their own by creating or modifying roles and bindings improperly. This can lead to Project-administrator level access, disclosure of Project secrets and credentials, and modification or deletion of Project resources. The vulnerability is fixed in versions 1.8.14, 1.9.9, and 1.10.8.

PinePods versions prior to 0.9.0 contain a server-side request forgery (SSRF) vulnerability that allows authenticated low-privilege users to make the server perform HTTP GET and HEAD requests to arbitrary internal and external URLs. This occurs because the application does not validate or restrict URLs in podcast RSS feed enclosures, enabling attackers to access internal services, including cloud metadata endpoints. The vulnerability is fixed in version 0.9.0.

Multiple critical security vulnerabilities have been identified in the python-pillow library used in Red Hat Enterprise Linux 8. These include heap buffer overflows in TIFF saving and FlashPix JPEG decoding, as well as an argument injection vulnerability in Ghostscript calls that could lead to remote code execution. Red Hat has issued a security advisory with updates to address these issues.

CVE-2026-78403 is a critical stack-based buffer overflow and missing authorization vulnerability in Thalesgroup Sentinel Keys Server on Windows. The vulnerability arises because the server does not validate the length of the first field in an HTTP request. An attacker can exploit this flaw by sending a crafted HTTP request, potentially leading to remote code execution with NT AUTHORITY\SYSTEM privileges. This affects Sentinel Keys Server versions prior to 1.3.8.0.

An improper certificate validation vulnerability exists in the HTTPS listener of Canonical LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.9. This flaw allows an unauthenticated attacker to impersonate any trusted client by using a crafted certificate chain, thereby gaining full access to the cluster and managed virtual machines. The issue is fixed in versions 4.0.15, 5.0.11, 5.21.9, and 6.10.1.

A vulnerability in Keyfactor EJBCA 9 allows a removed administrator to retain access longer than intended due to cached authentication sessions. Specifically, when an administrator is removed from their role while having an active TLS session, the system may cache their authentication beyond the configured maximum time (default 30 seconds), potentially allowing unauthorized continued access.

InternLM LMDeploy versions 0.9.0 through 0.18.0 have a critical unauthenticated remote code execution vulnerability. Attackers can send specially crafted pickled data to the /update_weights endpoint, which is deserialized without validation, allowing execution of arbitrary OS commands as the api_server process.

Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.

Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

CVE-2026-39738 is a critical deserialization of untrusted data vulnerability in Aman FunnelKit Automations (wp-marketing-automations) that allows object injection. It affects versions from initial releases up to 3.8.6.1. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. A fixed version 3.8.6.2 is available.

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.

CVE-2026-118697 is a critical vulnerability in JetBrains Toolbox App and several JetBrains IDEs where the jetbrainsd daemon improperly validates certificates, trusting compromised intermediate certificates. This affects versions before the specified fixed releases. The flaw allows an attacker to potentially perform man-in-the-middle attacks, compromising confidentiality, integrity, and availability.

FlowiseAI Flowise versions up to 3.1.4 contain a sandbox escape vulnerability that allows authenticated users to execute arbitrary OS commands. This occurs when the ALLOW_BUILTIN_DEP environment variable is set to true, enabling abuse of allowlisted langchain and mammoth modules. Attackers can submit JavaScript code to the /api/v1/node-custom-function endpoint, which writes a file into the mammoth package via LocalFileStore and requires it, thereby escaping the vm2 sandbox with the privileges of the Flowise process user.

Bazarr versions prior to 1.5.7-beta.14 contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities in the Plex API namespace due to missing authentication on certain resource handlers. This allows anonymous attackers to perform unauthorized API actions such as clearing credentials, persisting attacker-chosen API keys, and modifying configuration settings without proper authorization. These flaws enable persistent configuration tampering, denial of service of the Plex integration, and potential server-side request forgery with credential exposure. Version 1.5.7-beta.14 addresses the anonymous API mutation by adding authentication, though some OAuth state validation issues remain.

Multiple critical vulnerabilities have been identified and fixed in Red Hat Identity Management (IdM), also known as FreeIPA. These include unauthenticated denial-of-service, privilege escalation, cross-site scripting allowing arbitrary code execution, unauthorized LDAP writes, and unauthorized credential access. The vulnerabilities affect Red Hat Enterprise Linux Server Extended Lifecycle Support 7 and related architectures. Red Hat has released security updates addressing these issues.