Critical severity threats

MBasov OMN-Go versionCode 26080824 has insecure permissions that allow unauthorized attackers to invoke an exported component. This vulnerability can lead to arbitrary data access and control of data flow within the application.

Yet Another UPnP Controller versionCode 50200 contains insecure permissions that allow unauthorized attackers to invoke an exported component. This vulnerability can lead to arbitrary data access and control over application data.

LeafPad / Leaf Note version 1.21 has insecure permissions that allow unauthorized attackers to read other users' note data.

An insecure permissions vulnerability in rubenalfon Pile version 1.1.3 allows unauthorized attackers to invoke an exported component, which can lead to arbitrary data access and overwriting.

The wbpxre150 Shopping List application version 11.0 (versionCode 11) contains insecure permissions that allow unauthorized attackers to invoke an exported component. This vulnerability can lead to manipulation of the shopping-list data within the application.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a critical vulnerability that allows remote attackers to execute arbitrary code. This is due to improper neutralization of special elements used in operating system commands, classified under CWE-94. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

lz233 Tarnhelm version 1.8.2 (versionCode 20250630) contains insecure permissions that allow unauthorized attackers to invoke an exported component. This vulnerability can lead to arbitrary data access and overwriting by unauthorized parties.

Two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP. These flaws involve improper memory handling during fatal error processing with longjmp(), allowing attackers to execute arbitrary code remotely. CVE-2026-109618 arises from uninitialized request memory after out-of-memory errors, while CVE-2026-109619 involves global memory pointing to freed regions exploitable in subsequent requests. Over 22.6 million exposed instances have been identified. Palo Alto Networks provides protections via multiple security products and recommends immediate patching. At least one European government took precautionary measures by taking its website offline. Users should consult the PHP Group’s security advisory for patching guidance.

Red Hat has announced a Technology Preview container image for the satellite/foreman-mcp-server-rhel9, designed for advanced reporting and AI-driven data analysis within Red Hat Satellite. Among multiple CVEs associated with this advisory, CVE-2026-102267 is detailed as a significant vulnerability in the PyJWT library used for JSON Web Key Set (JWKS) retrieval. This flaw allows an attacker who can manipulate a trusted JWKS endpoint's HTTP redirect responses to redirect key requests to untrusted servers, potentially leading to acceptance of forged cryptographic keys or exposure of sensitive credentials. No patches or mitigations meeting Red Hat's criteria are currently available for this issue. The advisory does not specify affected product versions or confirm active exploitation in the wild.

Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher so that the reported size is truncated, the caller allocates insufficient memory, and later block processing causes memory corruption. The C++ API and normally used C API modes such as CBC and CTR are unaffected. This issue is fixed in version 3.13.0.

A critical vulnerability in libretro RetroArch version 1.22.2 and several other specified versions allows attackers to force a user into loading attacker-supplied code under their user ID, resulting in arbitrary code execution without requiring user interaction.

CVE-2026-118762 is a critical vulnerability in the Monkeytype repository's CI workflow prior to version 26.43.0. The workflow runs on pull_request_target with repository write permissions and executes code from forked pull requests with elevated privileges. This allows an external contributor whose pull request is labeled for formatting to run arbitrary code, access the GITHUB_TOKEN, and push changes or modify pull requests and issues. The vulnerability affects only the repository's CI workflow and not the Monkeytype application or user data. The issue is fixed in version 26.43.0.

Red Hat has released a new satellite/iop-host-inventory-rhel9 container image for Red Hat Lightspeed in Satellite, which analyzes system health and configuration locally. The advisory references multiple CVEs, including CVE-2026-102267, which involves a flaw in PyJWT's PyJWKClient failing to validate HTTP redirect destinations when retrieving cryptographic keys from a JWKS endpoint. This can allow an attacker to supply forged verification keys or expose sensitive credentials if they can manipulate the trusted endpoint's response. No fix is currently available for this PyJWT vulnerability, and mitigation options are limited. The advisory does not list affected product versions explicitly and does not confirm any known exploitation in the wild.

CVE-2026-119145 is a critical path traversal vulnerability in Frappe versions before 15.121.0 and 16.x before 16.34.0. The flaw allows authenticated attackers to upload crafted files to arbitrary locations outside the intended storage directory, potentially leading to remote code execution on the server. This occurs because the file-upload handling does not properly validate destination paths before writing files to disk. The vulnerability has a CVSS 4.0 score of 9.4, indicating high severity. Fixed versions are 15.121.0 and 16.34.0.

ZITADEL versions 4.0.0 up to but not including 4.19.5 have an authentication bypass vulnerability in the Login V2 UI. This flaw allows unauthenticated attackers to set the first credential for users who do not have any authentication method configured. Attackers can generate a valid verificationCheck cookie using the user ID and browser fingerprint, enabling them to set passwords, register passkeys, or link identity providers, effectively taking over user accounts. The vulnerability is fixed in version 4.19.5.

CVE-2026-90868 is a critical OS command injection vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. This flaw could allow an attacker with limited privileges to execute arbitrary commands without user interaction under certain configurations. The vulnerability has a CVSS score of 9.9, indicating a severe risk to confidentiality, integrity, and availability. Fixed versions 2024.0.7 and 2025.0.4 have been released to address this issue.

CVE-2026-90866 is a critical path traversal vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. A delegated Host Administrator could exploit this flaw to access unauthorized file system locations, potentially leading to remote code execution.