A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory
.
Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.
The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks.
This content discusses the concept of consolidating cybersecurity tools and programs into a unified security platform, referred to as 'platformization.' It is based on a study by IBM and Palo Alto Networks exploring how such platforms can generate business value by bridging silos among multiple security tools. The discussion is conceptual and does not describe a specific vulnerability or exploit.
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
InterSystems IRIS for Health versions 2025.3.0.226, 2026.1.0.235, and 2026.2.0.221 have TLS/SSL encryption disabled by default. This configuration may allow attackers to intercept transmitted data and potentially use it to log into the device. The vulnerability is identified as CWE-319 (Cleartext Transmission of Sensitive Information) and has a high severity CVSS score of 8.1.
The npm package @factiii/runner contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is recommended, but due to potential full control by an attacker, complete remediation may require additional measures such as rotating all secrets from a different, uncompromised system.
This research project documents a remote code execution (RCE) vulnerability in PHP version 8.4.26 under the official production configuration. The exploit chain uses only HTTP requests and includes an ASLR bypass via out-of-bounds memory disclosure. It does not require enabling display_errors or modifying the default 128 MB memory limit. The attack involves multi-stage exploitation including PHP session-state corruption, heap manipulation, and control-flow hijacking. The exploit was successfully reproduced on an Apache prefork configuration with a 10/10 success rate in the tested environment. The repository provides detailed technical documentation, code comments, and evidence of the exploit's effectiveness. The translation effort makes the original Chinese research accessible to the international security community.
Railway, a cloud platform hosting developer applications and services, detected suspicious activity on its environment variable storage systems, potentially exposing decrypted secrets such as API keys and credentials. The company warns users to immediately rotate all stored secrets and credentials due to possible unauthorized access. The incident is linked to a series of attacks targeting AI inference providers. Railway has paused deployments during the ongoing investigation and will notify affected users directly.
A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.
CVE-2026-115221 is a medium severity vulnerability in FreeIPA on Red Hat Enterprise Linux 10. It involves an incorrect authorization check that allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. The flaw arises because ownership verification relies solely on matching the host name to the certificate's subject Common Name (CN), without confirming actual ownership in the directory service. This can enable an enrolled host to disrupt services by revoking certificates belonging to other entities.
CVE-2026-115424 is a vulnerability in the OpenShift client 'oc' used in Red Hat OpenShift Container Platform 4. The flaw occurs during extraction of container image layers with the 'oc image extract' command, where symbolic and hard link targets are not properly sanitized if they point to absolute paths or sibling directories outside the extraction destination. This allows an attacker supplying a malicious container image to write files to arbitrary locations on the host filesystem with the privileges of the user running the command, potentially modifying files outside the intended directory.
tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process.
This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.