WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts.
This issue has been fixed in version 2.5.
WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.
This issue has been fixed in version 2.5.
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.
This issue has been fixed in version 2.5.
Multiple security vulnerabilities have been identified in the Ruby programming language as packaged for Red Hat Enterprise Linux 10. These include a double free issue in the regular expression parser and several integer overflow issues in various regular expression compilers. Red Hat has released an update rebased to Ruby 3.3 that addresses these issues. The update is rated as having a moderate security impact.
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.
This issue has been fixed in version 2.5.
CVE-2026-124622 is a time-of-check to time-of-use (TOCTOU) vulnerability in olivier-ls PHP-FTS versions 1.1.0 through 1.1.3. It affects the TrigramIndex::open function in Storage.php and requires local attack conditions where an attacker has write access to the index directory but is a different user than the application process. The vulnerability is considered a hardening issue rather than a remotely exploitable flaw. Upgrading to version 1.1.4 resolves the issue.
Red Hat issued a security advisory for the nodejs:24 module addressing multiple vulnerabilities in Node.js and its dependencies, including undici, brace-expansion, minimatch, and sqlite. The vulnerabilities include denial of service via unrequested WebSocket subprotocol, uncontrolled recursion, stack exhaustion, unhandled stream errors, TLS renegotiation issues, certificate validation bypass, heap-based buffer overflow, and arbitrary code execution. The update is rated as Important by Red Hat Product Security and affects Red Hat Enterprise Linux 9 and related variants. The advisory provides fixes for these issues and directs users to apply the update to remediate the vulnerabilities.
A sophisticated phishing campaign targets hospitality customers by impersonating Booking.com and other hotel services with fake reservation pages. The campaign uses personalized reservation details to increase credibility and employs advanced features such as real-time card validation, interactive verification workflows, and multi-language support. It focuses particularly on Japanese hotels but is designed for global deployment. The phishing kit uses multiple backend endpoints to track victim progression and can prompt additional verification after initial card submission.
Red Hat has issued a security advisory for Node.js 22 on Red Hat Enterprise Linux 9, addressing multiple vulnerabilities including denial of service and certificate validation bypass issues in components such as brace-expansion and undici. The update rebases Node.js 22 to the latest release and fixes several security flaws that could lead to denial of service or TLS certificate validation bypass. No CVSS scores are provided, but the advisory rates the impact as Important. The update is available for various Red Hat Enterprise Linux 9 variants and architectures.
A malicious Ruby gem named strutil-core version 1.0.1 was published and quickly removed after it was found to execute a large credential-stealing worm during installation. This worm, a descendant of the Shai-Hulud toolkit, steals credentials from various cloud services, CI systems, package registries, SSH, AI coding tools, and cryptocurrency wallets. It propagates through multiple package managers and platforms including RubyGems, npm, PyPI, JFrog Artifactory, GitHub, GitLab, and SSH. The malware installs a Python backdoor controlled via signed GitHub commits, poisons AI tool configurations to maintain persistence, and contains a conditional wiper that deletes the user's home directory if a stolen GitHub token is revoked. It targets Linux and macOS systems on x86-64 and ARM64 architectures, excluding Russian-speaking locales.
The Iris Plaza online shopping platform suffered a data breach due to compromise of an external cloud service. Personal information of approximately 7.7 million individuals was potentially exposed, including names, addresses, phone numbers, email addresses, dates of birth, gender, and encrypted passwords for platform members. Non-members who made purchases without registration also had some personal data exposed. No credit card information or physical stores were affected. The company has blocked attacker access, notified authorities, and suspended the platform while investigating and remediating the incident.
CVE-2026-112171 is a medium-severity SQL Injection vulnerability in GALENO SISTEMI's MAGISTRA product version 3.12. It allows an attacker with low privileges and local access to inject malicious SQL statements via user-controlled input, potentially leading to unauthorized access, modification, or disclosure of database data.
Multiple security vulnerabilities have been identified and fixed in the dnsmasq packages used in Red Hat Enterprise Linux 8.8. These include heap buffer overflows, infinite loops, out-of-bounds reads, and source validation bypasses affecting DNS and DHCP functionalities. An update is available that addresses these issues along with a new DNSSEC trust anchor key for 2024.
GALENO SISTEMI MAGISTRA version 3.12 has a vulnerability where the software downloads upgrade files without performing integrity checks. This flaw allows the installation of tampered updates, potentially compromising the system.
MAGISTRA software version 3.12 by GALENO SISTEMI contains an undocumented backdoor that enables authentication bypass. This flaw allows attackers to create privileged user accounts without credential verification, posing a significant security risk. The vulnerability is classified under CWE-288 (Authentication Bypass) and CWE-912 (Hidden Functionality).
CVE-2026-112168 affects GALENO SISTEMI's MAGISTRA software version 3.12. The vulnerability involves the use of weak custom encryption, reliance on an outdated compression algorithm for database protection, and the presence of embedded secrets, leading to cleartext storage of sensitive information.
A use-after-free vulnerability exists in Samsung Open Source Escargot before commit 8bc35b7b88f0f96c66a42aa965a1a710308b61d5. This flaw allows pointer manipulation, potentially leading to a denial of service. The vulnerability has a medium severity rating with a CVSS score of 5.1.
A vulnerability in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS) allows an attacker who can control or inject content into a manifest URL to include file:// URIs. This causes the application to read arbitrary local files, potentially disclosing sensitive information. The issue affects certain versions of GStreamer plugins used in Red Hat Enterprise Linux 10.2 and later, Fedora 43, and others. The vulnerability has a high confidentiality impact but does not affect integrity or availability.
This vulnerability involves XML parsers that process attacker-controlled update manifests or network responses with external entity resolution enabled, which can lead to XML External Entity (XXE) attacks. XXE vulnerabilities allow attackers to interfere with the processing of XML data, potentially leading to information disclosure or denial of service. The vulnerability is rated critical with a CVSS score of 9.2. No specific affected software versions or patches are provided in the available data.
This vulnerability involves shared telemetry and logging components that store or transmit sensitive patient and doctor identifiers, clinical information, and low-entropy identifiers without sufficient pseudonymization or protection. The issue could lead to exposure of sensitive healthcare data due to inadequate data handling practices.
