OpsTree Solutions REMS version 1.0.0 and earlier contains a missing authentication vulnerability that allows unauthenticated remote attackers to access critical Governance API endpoints. Attackers can retrieve sensitive database credentials by sending requests without valid authorization tokens.
OpsTree Solutions REMS versions up to 1.0.0 have an authentication bypass vulnerability. An attacker can exploit this by sending a specially crafted login request with the is_local_auth field set to true and an invalid password for the admin account. This allows the attacker to obtain a valid JWT and gain SuperUser administrative access without proper authentication.
OpsTree Solutions REMS versions up to 1.0.0 contain a prompt injection vulnerability that allows authenticated users to disclose hidden system prompts by submitting crafted input to the chat API. This flaw enables attackers to bypass assistant rules and reveal internal orchestration instructions, potentially facilitating further prompt injection attacks.
OpsTree Solutions REMS versions up to 1.0.0 have an authorization bypass vulnerability that allows authenticated users to manipulate the reporter field of an incident. This flaw enables attackers to falsify incident attribution by sending crafted POST or PATCH requests, compromising the integrity of the accountability audit trail.
CVE-2026-76080 is an improper access control vulnerability in the getprobo probo platform prior to version 0.224.0. The public Trust Center GraphQL API allows unauthenticated users to query certain objects without proper tenant scope validation or visibility checks. This flaw affects six object types, enabling potential unauthorized read access. The issue has been fixed in version 0.224.0.
CVE-2026-123828 is a heap buffer overflow vulnerability in Node.js HTTP/2 Alt-Svc handling affecting versions 24.x and 26.x prior to 24.22.3 and 26.13.1 respectively. The flaw occurs when an attacker-controlled :authority header is passed to Http2Session.altsvc(), causing a one-byte out-of-bounds write past a buffer allocation. This leads to process abort and remote heap corruption. The vulnerability has a CVSS score of 5.9 and is rated medium severity.
A privilege management vulnerability in Probo before version 0.224.0 allows an organization ADMIN to mint an OWNER membership via the createUser function, bypassing the intended owner-only authorization check. This flaw has been fixed in version 0.224.0.
CVE-2026-76078 is an authorization bypass vulnerability in the Probo governance, risk, and compliance platform prior to version 0.224.0. The public Trust Center GraphQL API allows any authenticated user to call certain e-signature functions without verifying ownership of the signature. This enables attackers to complete NDAs on behalf of others and inject arbitrary audit-trail events, undermining non-repudiation and integrity of the e-signature system. The issue is fixed in version 0.224.0.
CVE-2026-91892 is a vulnerability in Dell Terraform Provider for PowerFlex versions prior to 1.9.0 that allows the use of deprecated cryptographic protocols during secure communications. This flaw could enable an unauthenticated remote attacker to cause information exposure. The issue is related to inadequate encryption strength (CWE-326). The vulnerability has a low CVSS score of 3.7 and has been fixed in version 1.9.0.
The Datafield module for Drupal provides a field type that supports structured data with multiple sub-fields and includes a Search - autocomplete widget. A vulnerability exists in the autocomplete endpoint where stored field values are not properly escaped before being returned as suggestion labels, leading to a potential cross-site scripting (XSS) issue. Exploitation requires the attacker to have permission to edit an entity containing a Datafield field and for the Search - autocomplete widget to be enabled on that field. Fixed versions 2.0.15 and 3.0.1 address this issue.
CVE-2026-63505 is an authorization bypass vulnerability in the Probo GRC platform prior to version 0.223.1. It allows an authenticated user in one organization to read risk data belonging to another organization by exploiting improper validation of cross-tenant references in the GraphQL API. This also causes a denial of service by preventing the other organization from deleting its own risk entries. The issue is fixed in version 0.223.1.
CVE-2026-64861 is a resource exhaustion vulnerability in the Probo GRC platform prior to version 0.222.0. The GraphQL endpoint does not limit alias count, query depth, or query complexity, allowing attackers to craft requests with thousands of aliased resolver calls. This can cause excessive server resource consumption and degrade service availability. The issue is fixed in version 0.222.0.
The File resup module for Drupal allows large, multiple, and resumable file uploads but does not sufficiently check access to resumable upload forms. This permits unauthenticated users to initiate uploads on forms they should not access and store partial upload data on the server. However, partial upload data is only linked to content via the normal entity form, which enforces access controls, and the stored data is not executable by the web server. The vulnerability is fixed in version 2.0.6.
The S3 File System CORS Upload module for Drupal allows users to upload files directly from the browser to Amazon S3 or compatible services via a file widget. A vulnerability exists where the module does not sufficiently restrict upload permissions, enabling users with upload access to overwrite existing files in the bucket, including those they normally could not replace. Exploitation requires access to a form using this upload widget. The issue is fixed in version 1.4.0.
Qilin is a Russia-based ransomware affiliate group active since September 2022, responsible for at least 365 victim organizations in three months. It operates a ransomware-as-a-service model with affiliates who deploy ransomware and practice double extortion by stealing data before encrypting systems. The group's administrator, known as 'Haise,' has been linked through operational security mistakes to a 36-year-old man in St. Petersburg, Russia, named Aleksey Mikhailovich Yakovtsev. Qilin collaborates with English-speaking affiliates and other ransomware groups. The administrator's past identities and activities have been traced through cybercrime forums and leaked data, revealing a progression from fraud to complex cybercrime operations.
The Drupal Realname module allows displaying user names based on configurable patterns using tokens. A vulnerability exists where user input used in these patterns is not properly sanitized, enabling an attacker to inject and have Twig syntax evaluated when their name is displayed. Exploitation requires the site to be configured with a real name pattern that includes user-supplied data and the attacker to have the ability to edit their own profile data. This issue is fixed in version 2.0.1 of the module.
CVE-2026-91891 is a vulnerability in Dell Terraform Provider for PowerStore versions prior to 1.3.1 where sensitive authentication data may be insufficiently redacted in diagnostic logs. This could allow an unauthenticated remote attacker to access sensitive information. The issue is fixed in version 1.3.1 and later.
The Layout Builder iframe modal module for Drupal renders forms inside an iframe within a modal dialog using the admin theme. It includes a custom Ajax command to open the iframe dialog that does not sanitize dialog options as strictly as Drupal core does, leading to a potential cross-site scripting (XSS) vulnerability. Exploitation requires the attacker to control the Ajax response or inject markup with specific attributes. A fix is available in version 1.3.9.
The Drupal Cookies module has a vulnerability in its Video submodule where it insufficiently validates the 'data-cookies-video-blazy-src' attribute before converting it back to a 'src' attribute for Blazy iframes. This flaw could allow an attacker with specific permissions to inject content that affects all users. The vulnerability is fixed in version 1.2.17.
Red Hat JBoss Enterprise Application Platform 7.4.26 includes multiple security fixes addressing vulnerabilities such as unauthorized queue creation, session hijacking, password leaks, unsafe deserialization leading to remote code execution, and incomplete fixes for prior issues. These vulnerabilities affect components like artemis-server, jgroups, jackson-databind, openjdk-orb, and Apache CXF. The update replaces version 7.4.25 and is rated as having an important security impact by Red Hat.