CVE-2026-124635 is a vulnerability in kevquirk PureBlog versions 3.7.0 through 3.7.2 affecting the admin/upload-image.php component. It allows remote attackers to perform unrestricted file uploads. The issue is resolved in version 3.7.3, which should be applied to mitigate the risk.
CVE-2026-124625 is a SQL injection vulnerability in PipraPay version 3.0.0 affecting the deleteData function in the Admin Panel component. The vulnerability arises from improper handling of the selected_ids/ItemID argument, allowing remote attackers to execute SQL injection attacks. The vulnerability has been publicly disclosed and exploit code may be available. No official response or patch has been issued by the vendor yet.
CVE-2026-121841 is a moderate impact vulnerability described as 'Other issue' in Firefox for iOS. It was fixed in Firefox for iOS version 160.0. The specific technical details of the vulnerability are not provided in the advisory.
CVE-2026-16283 is an OS command injection vulnerability in Osbil Technology Ltd.'s oPanel software. The flaw arises from improper neutralization of special elements used in OS commands, allowing an attacker with limited privileges to execute arbitrary commands on the affected system. This vulnerability affects oPanel versions before 1.20.66. A fix is available starting from version 1.20.66.
pdfmake versions from 0.3.0-beta.1 up to but not including 0.3.14 have a vulnerability involving shared resource caching. This flaw allows attackers to access cached resources across different documents by exploiting a process-wide virtual file system that keys only by URL, without enforcing request headers or per-document access controls. As a result, attackers can retrieve resources fetched with other users' credentials or from URLs that would normally be restricted by access policies, leading to cross-document information disclosure and bypass of URL access restrictions. The issue is fixed in version 0.3.14.
The npm package '@massnerder/x402-scraper-mcp' version 1.0.0 has been identified as malicious due to its communication with a domain linked to malicious activity. This behavior classifies the package as malware within the software supply chain.
CVE-2026-124624 is a vulnerability in PipraPay version 3.0.0 involving hard-coded credentials in the hash_hmac function within the pp-token anti-CSRF handler component. This weakness allows remote attackers to exploit the hard-coded credentials. The vulnerability has a medium severity rating with a CVSS score of 6.9. Public exploit code is available, but no official response or patch has been provided by the vendor as of the publication date.
Threat actors are exploiting a chain of four vulnerabilities known as Plex2Shell in the Plex Media Server application on QNAP NAS devices. These vulnerabilities allow attackers to execute arbitrary code with Plex service privileges without requiring valid credentials. The vulnerabilities were patched in Plex Media Server version 1.43.3. QNAP NAS operating systems themselves are not affected. Users are advised to update Plex Media Server promptly and take additional precautions to secure remote access.
CVE-2026-119613 is a vulnerability in ash-project's ash_ai versions 1.5.0 up to but not including 1.5.1. It allows an attacker calling an AshAi tool to obtain internal error details, such as module names and data values, by causing a tool call to fail. The issue arises because error messages include sensitive information from exceptions or inspected error terms, which are sent directly to clients and the model without logging. The vulnerability is fixed in version 1.5.1 by logging errors under an error ID and returning only that ID to the caller.
A use of uninitialized memory vulnerability exists in the GStreamer gst-plugins-bad package's H.265 bitstream parser when processing Video Parameter Sets with multiple HRD parameter sets. This flaw can be triggered by a crafted H.265 media file or stream, causing unpredictable parser behavior and potentially crashing applications using GStreamer for H.265 playback, resulting in denial of service.
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
CVE-2026-119610 is a vulnerability in GStreamer's gst-plugins-good H.264 RTP depayloader element affecting multi-time aggregation RTP packets (MTAP16/MTAP24). A signed/unsigned integer conversion error can cause an out-of-bounds heap read of up to 64 KiB when processing truncated packets. This can lead to denial of service by crashing the GStreamer pipeline and potentially leaking adjacent heap memory in relay or transcoding scenarios where output is attacker-accessible. The flaw is present in upstream gst-plugins-good starting from version 1.28.0. Red Hat Enterprise Linux 10 currently ships versions below 1.28.0 and is expected not to include the vulnerable code path until a future rebase. Fedora 44 is affected pending confirmation. Mitigations include blocking untrusted H.264 RTP streams at the network perimeter or avoiding the vulnerable element for untrusted sources.
A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8.
Red Hat has issued a security advisory for Cockpit, a web-based server administration tool for GNU/Linux. The update addresses three vulnerabilities: two denial of service issues (CVE-2026-91147 and CVE-2026-91149) related to URL-root handling and unbounded connection thread spawning, and an unauthenticated remote memory leak (CVE-2026-76235) via the CockpitLang cookie in the login HTML response. These vulnerabilities affect Red Hat Enterprise Linux 10 and its variants. The advisory rates the impact as Important and provides updated packages to remediate the issues.