CVE-2026-109506 is an improper authentication vulnerability in TP-Link Systems Inc. RE190 v5 Wi-Fi range extenders. The devices use a custom reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture legitimate administrator login traffic may derive alternative credentials to gain administrator access. Exploitation requires the login to use HTTP and the attacker to observe session key, dictionary, and login values. Successful exploitation allows modification of device configuration settings.
CVE-2026-55573 is a critical deserialization vulnerability in the e107 content management system prior to version 2.3.7. The vulnerability exists in install.php, which unserializes attacker-controlled data without restricting allowed classes, enabling unauthenticated remote code execution. This flaw allows an attacker to execute arbitrary PHP functions with the web server's privileges, potentially leading to full server compromise. The issue is fixed in version 2.3.7.
CVE-2026-55572 is a critical SQL injection vulnerability in the e107 content management system prior to version 2.3.7. It affects the bundled alt_auth plugin's otherdb and e107db authentication backends, which interpolate the submitted login username directly into SQL queries without proper sanitization. This allows unauthenticated attackers to inject SQL commands when alt_auth is installed and configured with a live external database connection. The vulnerability can lead to exposure or modification of data accessible by the database account and may disclose query details through debug messages. The issue is fixed in e107 version 2.3.7.
FOGProject's fogproject prior to version 1.5.10.1870 contains a vulnerability where the management adInfo() endpoint discloses the default domain-join password in a JSON response without requiring authentication. This exposure allows remote unauthenticated actors to obtain sensitive credentials, potentially compromising domain-join security. The issue is fixed in version 1.5.10.1870.
CVE-2026-0322 is a high-severity remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS software. It allows an authenticated attacker with network access to execute arbitrary code with root privileges on affected firewalls. The vulnerability affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series), but not Cloud NGFW or Prisma Access. Access to the management interface should be restricted to trusted internal IPs to minimize risk. Multiple PAN-OS versions prior to specific fixed releases are affected.
CVE-2026-101954 is a critical improper authentication vulnerability in the J-Web management interface and NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated network attacker to gain root-level device configuration access and take over the device via reachable J-Web HTTP or HTTPS services when web management is enabled.
CVE-2026-102174 is a stack-based buffer overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series. It allows an authenticated remote-access VPN client to execute code with root privileges or cause a denial of service. The vulnerability affects multiple Junos OS versions prior to specific patch releases. The CVSS score is 8.8, indicating high severity.
CVE-2026-102037 is a high-severity XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper Networks Junos OS on SRX Series devices. It allows an unauthenticated network attacker to execute arbitrary device configuration commands with root privileges by exploiting a malicious response from a configured custom URL-feed server. The vulnerability affects multiple versions of Junos OS prior to specific patch releases. The CVSS score is 8.1, indicating a high impact on confidentiality, integrity, and availability.
CVE-2026-102025 is a high-severity vulnerability in Juniper Networks Junos OS and Junos OS Evolved affecting the routing protocol daemon (rpd). It involves mismatched memory management routines triggered by a BGP route update when extended next-hop tunneling and SRv6 service processing are enabled. This flaw allows an authenticated network-based attacker to cause a denial of service (DoS) condition. The vulnerability does not impact confidentiality or integrity but results in service disruption. Multiple versions of Junos OS and Junos OS Evolved are affected, with no explicit patch information provided in the input data.
CVE-2026-101956 is a critical improper authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS. It allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web interface. The vulnerability affects multiple versions of Junos OS prior to specific patch releases. The CVSS score is 9.8, indicating a high severity with network attack vector, no privileges or user interaction required, and full confidentiality, integrity, and availability impact.
KEDA versions 2.20.2 and earlier contain a critical improper privilege management vulnerability. A namespace administrator can exploit this by creating TriggerAuthentication and ScaledObject resources that cause KEDA to send the operator pod's ServiceAccount token to a malicious Vault endpoint. This allows the attacker to gain the operator's cluster-wide permissions, including broad secret access and workload control. The issue is fixed in version 2.21.0.
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.
CVE-2026-101978 is an OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series devices. It allows an unauthenticated attacker on the management LAN to execute arbitrary commands as root via a crafted gRPC response. The vulnerability affects multiple specific versions of Junos OS Evolved. The CVSS score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.
Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.
Security Fix(es):
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198)
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197)
* FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)
* freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)
* freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)
* ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
* ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)
* freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-73802 is a privilege management vulnerability in Gitea Runner versions before 3.0.0. It allows workflow authors to bypass container isolation by exploiting improper handling of Docker container options, enabling access to host namespaces and root command execution on the runner host.
CVE-2026-110633 is a local privilege escalation vulnerability in Report One's MyReport Updater up to version 2.1.1. It allows low-privileged users to exploit the SYSTEM updater service to install attacker-controlled archives into arbitrary directories. By manipulating UpdaterManager.exe over gRPC, attackers can set malicious parameters to plant a DLL loaded by a system process, thereby gaining SYSTEM privileges.
VentureDrake Laravel CRM versions prior to 2.4.0 have an incorrect authorization vulnerability in the user management module. Authenticated administrators with user-management access can exploit this flaw to assign unrestricted roles, including the Owner role or roles from other teams. They can also delete users across different teams via an unscoped delete method. This vulnerability allows privilege escalation and unauthorized user management actions.
A vulnerability in the Linux kernel's RDMA/efa driver was addressed to ensure proper management of admin queues during IRQ registration. The issue involved the IRQ handler accessing queues that were not fully constructed or already destroyed, leading to potential use-after-free conditions. The fix involves initializing queues with interrupts masked, requesting IRQs before enabling interrupts, and properly resetting the device and freeing IRQs before destroying queues.
CVE-2026-98391 is a vulnerability in the Linux kernel's drm/xe driver related to runtime power management (PM) during virtual machine (VM) teardown. The flaw allows the device to autosuspend while stale page faults from a torn-down VM are still queued, causing an assertion failure when the page-fault worker attempts to acknowledge these faults on a suspended device. The issue is addressed by holding a runtime PM reference across the entire page-fault queue worker to prevent autosuspension during fault acknowledgment.
Papermerge Core versions up to 3.5.3 have a missing authorization vulnerability that allows authenticated users to manipulate other users' pages. The vulnerability arises because certain page management and OCR endpoints do not enforce permission checks. Attackers with knowledge of page UUIDs can rotate, delete, extract pages, or trigger OCR tasks on pages they do not own.