CVE-2026-125926 is a server-side request forgery (SSRF) vulnerability in the server registration and update API of Amazon's mcp-gateway-registry prior to version 1.35.0. An authenticated remote user could exploit this flaw to send requests from the gateway to internal network services and cloud instance metadata endpoints, potentially reading sensitive responses. The vulnerability has a high severity with a CVSS score of 8.5. AWS has released version 1.35.0 to address this issue.
CVE-2026-65957 is an origin validation error in the gethelio helio MCP proxy prior to version 0.8.0. The proxy incorrectly validated CORS request origins by matching hostnames against private network string prefixes instead of validating IP addresses. This allowed attacker-controlled public DNS names that start with private IP prefixes (e.g., 192.168.attacker.com) to bypass origin checks, causing the proxy to echo the attacker origin in Access-Control-Allow-Origin. The issue is fixed in version 0.8.0.
A missing authorization vulnerability in the external management API of AWS mcp-gateway-registry versions 1.0.9 through 1.24.7 allows an authenticated remote user to escalate privileges by assigning the registry administrator scope to their own identity group. This grants administrative control over all registered gateway assets. AWS has released version 1.25.0 to address this issue.
CVE-2026-126815 is an improper authentication vulnerability in XauenDevs Lagarto Chivato versions 0.1.0 through 0.4.2. It allows remote unauthenticated attackers to hijack accounts by planting a password on an unregistered email address that becomes valid when the victim first logs in without a password. This flaw affects the authentication flow and can lead to account takeover.
CVE-2026-0323 is a server-side request forgery (SSRF) vulnerability in Palo Alto Networks Checkov by Prisma Cloud. It allows a local unauthenticated user to make unauthorized network requests from the host to internal services. The vulnerability affects versions from 0 up to but not including 3.4.2. A fix is available in version 3.4.2. The CVSS 4.0 score is low, reflecting limited impact and exploitability.
CVE-2026-0324 is a vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by Palo Alto Networks GlobalProtect on Windows. It allows a locally authenticated non-administrative user to escalate privileges to SYSTEM due to incorrect privilege assignment. Versions from 4.3.0 up to but not including 4.3.4822 are affected. The issue has been fixed in version 4.3.4822. The vulnerability has a medium severity with a CVSS 4.0 score of 5.9.
Two critical denial of service vulnerabilities have been identified in the brace-expansion component used by the cockpit-image-builder frontend in Red Hat Enterprise Linux 10.2 Extended Update Support. These vulnerabilities involve uncontrolled recursion and stack exhaustion caused by crafted brace patterns. Red Hat has issued a security update to address these issues in the cockpit-image-builder package.
Two security vulnerabilities have been identified in the podman container management tool, part of the libpod library used for container pods. The first vulnerability (CVE-2025-11395) allows arbitrary file write when importing an OCI archive. The second vulnerability (CVE-2026-94603) allows the 'podman run' command to disable almost all sandboxing, including user-requested sandboxing, via image annotation. These issues affect Red Hat Enterprise Linux 9.8 Extended Update Support and related variants. Red Hat has released security updates to address these vulnerabilities.
CVE-2026-0325 is an authorization bypass vulnerability in the GlobalProtect gateway component of Palo Alto Networks PAN-OS software. It allows an authenticated attacker with valid GlobalProtect credentials to bypass IP address restrictions and circumvent network access controls that rely on source IP filtering. The vulnerability does not affect the Cloud NGFW service. A fix is available in PAN-OS versions 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, and 11.1.16-h5.
CVE-2026-0326 is a buffer overflow vulnerability in Palo Alto Networks PAN-OS software that allows an unauthenticated attacker to cause a service process crash or memory corruption. This vulnerability affects specific versions of PAN-OS but does not impact Panorama or Prisma Access. The vulnerability has a low severity rating and has been fixed in later versions.
GSocket is an open source remote access tool weaponized by threat actors to maintain persistent access on compromised Linux servers, especially web applications and hosting environments. It uses a public relay network for command and control, avoiding direct threat actor infrastructure and evading traditional inbound firewall rules. This allows attackers to maintain access even after patching the initial vulnerability. GSocket employs outbound-only encrypted connections, process renaming, memory-backed staging, and persistence mechanisms that survive reboots, complicating detection and remediation. Microsoft telemetry shows a significant increase in GSocket-related detections, primarily targeting PHP web applications and Apache servers in education and technology sectors. Defenders should focus on detecting GSocket deployment, persistence, privilege escalation, and outbound connections rather than relying solely on patching the exploited application.
CVE-2026-0327 is a privilege escalation vulnerability in the GlobalProtect gateway component of Palo Alto Networks PAN-OS software. It allows an authenticated user with lower privileges to gain the privileges and configuration access of a higher-privileged user. This vulnerability does not affect the Cloud NGFW or Panorama products. The issue is related to an untrusted search path (CWE-426).
CVE-2026-91151 is a local privilege escalation vulnerability in Red Hat Enterprise Linux 10's Cockpit component. It involves a privileged symlink dereference in the ssh-add-public-key.sh helper script, which runs with elevated privileges. An authenticated local user controlling a target account's home directory can exploit this flaw by manipulating symlinks in .ssh or authorized_keys paths, causing arbitrary changes to file ownership and permissions. This can impact system integrity, confidentiality, and availability. Exploitation requires user interaction and a privileged execution context, preventing remote or unauthenticated attacks.
CVE-2026-0328 is an authentication bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. It allows an unauthenticated user to bypass security restrictions and establish an unauthorized VPN connection. Other Palo Alto products such as Panorama, Cloud NGFW, and Prisma Access are not affected. The vulnerability has a low CVSS score of 2.7 and has been fixed in specific patched versions of PAN-OS.
CVE-2026-0329 is a buffer overflow vulnerability in Palo Alto Networks PAN-OS software that allows an unauthenticated attacker with network access to cause a denial of service (DoS) by sending specially crafted traffic to or through a dataplane interface. Cloud NGFW and Panorama products are not affected. Multiple PAN-OS versions prior to fixed releases are vulnerable.
CVE-2026-0330 is a remote code execution vulnerability in Palo Alto Networks PAN-OS software on Panorama. It allows an authenticated administrator with network access to execute arbitrary code with root privileges. The risk is mitigated by restricting management interface access to trusted internal IP addresses. Cloud NGFW, Prisma Access, and standalone PAN-OS firewalls are not affected. Fixed versions are available.
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update. These include numerous use-after-free flaws, sandbox escapes, privilege escalations, information disclosures, spoofing issues, and boundary condition errors across various components such as JavaScript GC, DOM, Graphics, Audio/Video, Networking, and Layout. The update is rated as important by Red Hat Product Security.
CVE-2026-0331 is an information disclosure vulnerability in Palo Alto Networks PAN-OS software that allows an unauthenticated remote attacker with network access to obtain sensitive firewall and session information by sending traffic to or through a dataplane interface. Panorama management software is not affected. Multiple versions of PAN-OS prior to certain fixed releases are vulnerable. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.6.
CVE-2026-126784 is a resource allocation vulnerability in Lagarto Chivato versions 0.1.0 through 0.4.1. The publicar_aviso RPC function lacks rate limiting, per-account submission quotas, and geographic validation, allowing remote authenticated users to flood the moderation queue with unlimited notice submissions containing arbitrary coordinates. This can lead to denial of service by exhausting moderation resources.
AsiaInfo BSS Platform versions 9.2.0 up to but not including 9.2.38 contain a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. Authenticated users with ordinary privileges can upload SVG files with embedded JavaScript. While normal menu rendering does not execute this script, exploitation occurs if a victim loads the SVG directly as a document, allowing script execution under the application origin.