The Auth login plus module for Drupal allows enforcing a second authentication factor using time-based one-time passwords. A vulnerability exists where an attacker, under certain conditions, can bypass the password check or access the two-factor setup page of another user's account. This may enable account takeover of 2FA-enabled accounts without knowing the victim's password or second factor. Exploitation requires the attacker to have their own account, control the victim's email or know their password, and succeed in a timing-dependent race. The issue is fixed in version 1.0.3.
vulnerability-operator versions prior to 0.28.16 expose vulnerability scan reports without any authentication or authorization. The /report/ HTTP endpoint serves raw JSON reports containing CVE IDs, affected packages, and container image identifiers to any client able to access the operator's HTTP port. This information disclosure vulnerability has been fixed in version 0.28.16.
The Auth login plus module for Drupal allows requiring a second authentication factor (time-based one-time password) on user login. However, it fails to enforce the second factor correctly, allowing an attacker with only the first factor (such as a valid one-time login link) to trigger actions normally restricted to fully authenticated logins. These actions include updating the account's last login time and triggering other modules' login hooks. The impact depends on other modules reacting to login events. A fix is available in version 1.0.3.
Dell Ansible Storage for PowerStore versions prior to 3.9.0 contain a vulnerability where sensitive information can be inserted into log files by a low privileged local attacker. This vulnerability is identified as CWE-532 and allows information exposure without impacting integrity or availability. The issue is fixed in version 3.9.0 and later.
Red Hat issued a security advisory for oci-seccomp-bpf-hook addressing vulnerabilities in underlying Golang components. The update fixes a denial of service vulnerability via crafted HTTP Range headers (CVE-2026-78667) and a man-in-the-middle attack risk due to untrusted intermediate certificates in crypto/x509 (CVE-2026-111943). These issues affect Red Hat Enterprise Linux 9.8 Extended Update Support and related variants. The advisory rates the impact as Important and provides updated packages to remediate the issues.
The Auth login plus module for Drupal enables two-factor authentication using time-based one-time passwords. However, it does not fully enforce the second factor for authentication providers that authenticate each request independently. An attacker who knows a user's password and if certain authentication providers (e.g., HTTP Basic Authentication) and alternate methods (e.g., JSON:API or REST) are enabled can bypass the second factor and access the account's permissions. This vulnerability is fixed in version 1.0.3.
Falcon (also known as XG or Xiàng Gē) is a sophisticated browser-based command and control (C2) malware framework operating via malicious JavaScript. It compromises webmail portals and government web applications to sideload malicious Chrome and Firefox extensions that steal sensitive data such as passwords, emails, session cookies, and communications. Falcon delivers an implant called Antino, which uses Microsoft OneDrive as a covert C2 channel. Between March and May 2026, it targeted government entities in one Middle Eastern and four Southeast Asian countries, focusing on ministries of foreign affairs, defense, interior, and law enforcement. The framework exhibits advanced capabilities including browser proxying, download interception, network traffic hijacking, and credential harvesting, with overlaps to the PeckBirdy malware family.
A security vulnerability (CVE-2026-116591) affects the Grafana plugin for Performance Co-Pilot in Red Hat Enterprise Linux 8. The issue is a denial of service caused by crafted zstd compressed input in the klauspost/compress library. Red Hat has issued an important security update to address this vulnerability in grafana-pcp version 5.1.1-20.el8_10. The update is available for multiple architectures and extended life cycle versions of Red Hat Enterprise Linux 8.
The Texts module for Drupal has a vulnerability that allows a user with access to the translation overview to overwrite an existing translation and delete a duplicate translation via a crafted request. This can occur even if the user does not have permissions to edit or delete translations. Exploitation requires an attacker to first create a suitable duplicate translation and trick a user with the necessary access to open the malicious request. The issue is fixed in version 1.0.17.
Dell Ansible Storage for PowerStore versions prior to 3.9.0 contain an improper certificate validation vulnerability in the API client component. This flaw could allow an unauthenticated remote attacker to cause information exposure and unauthorized access. The vulnerability is addressed in version 3.9.0 and later.
The Texts module for Drupal allows key-based strings and translations, including Twig filters for rendering translated text. A vulnerability exists due to insufficient validation of translation HTML, enabling users with specific permissions to inject JavaScript into pages that display these translations. This requires the attacker to have either the "Create string translation" or "Edit string translation" permission and for the site to use the module's Twig filters to render the affected text. The issue is fixed in version 1.0.17.
Red Hat has issued a security advisory for Grafana in Red Hat Enterprise Linux 8, addressing an information disclosure vulnerability in the Unified Alerting component (CVE-2026-17183). Additionally, a denial of service vulnerability in the klauspost/compress zstd library (CVE-2026-116591) is fixed. The update is rated as important by Red Hat Product Security. The advisory provides updated packages for multiple architectures and references detailed remediation instructions.
The Paragraphs Edit module for Drupal versions prior to 3.0.2 has an access control vulnerability. It adds contextual edit, clone, and delete links to individual paragraphs but does not sufficiently verify access permissions on the edit and delete routes. Exploitation requires the attacker to have an account on the site and knowledge or guessing of the paragraph ID. No special permissions are needed to attempt these actions. A fix is available in version 3.0.2.
The Drupal GraphQL Core Schema module has a vulnerability that allows users who can view other users' accounts to change those users' passwords via the GraphQL API, potentially leading to full account takeover. This issue affects versions prior to 1.0.29. The vulnerability is mitigated if the User Login schema extension is not enabled on the GraphQL server.
Dell Ansible Storage for PowerFlex versions prior to 3.2.0 contain an improper certificate validation vulnerability in the API client component. This flaw allows an unauthenticated remote attacker to potentially cause information exposure and gain unauthorized access. The vulnerability is addressed in version 3.2.0 and later.
This Red Hat Security Advisory addresses multiple security vulnerabilities in Mozilla Firefox and related components, including denial of service, mitigation bypasses, spoofing, privilege escalation, use-after-free, information disclosure, sandbox escapes, race conditions, integer overflows, and incorrect boundary conditions. The advisory covers a broad range of issues affecting various Firefox components such as the JavaScript engine, DOM, networking, graphics, storage, and more. The update is rated as important by Red Hat and includes fixes for these vulnerabilities in Red Hat Enterprise Linux 8.8 variants.
CVE-2026-106152 is a vulnerability in Progress Software's Telerik Report Server versions prior to 12.3.26.1110. It allows an unauthenticated remote attacker to externally control a system configuration setting related to the server address used when generating links and notifications. Exploitation requires user interaction and can lead to sensitive information disclosure and account takeover.
CVE-2026-61619 is a high-severity vulnerability in the OWASP Core Rule Set (CRS) affecting versions prior to 3.3.10, 4.25.1, and 4.28.0. It involves inefficient regular expression complexity leading to a regular-expression denial of service (ReDoS) condition. An unauthenticated attacker can send a crafted request that triggers excessive backtracking in PCRE2, causing the regex engine to exceed its backtracking limit. This results in an error from the regex operator, which bypasses detection and causes CPU denial of service. The issue has been fixed in the specified versions.
CVE-2026-106133 is an incorrect authorization vulnerability in Progress Software's Telerik Report Server versions prior to 12.3.26.1110. It affects the Web Report Designer component, allowing authenticated users with low privileges to perform unauthorized operations on shared report resources. This can impact the integrity and availability of those resources. The vulnerability has a medium severity with a CVSS score of 6.3. A fix is available in version 12.3.26.1110.
A security vulnerability in the libtiff library used for manipulating TIFF files allows arbitrary code execution via the process_command_opts() function. This issue affects Red Hat Enterprise Linux 7 Extended Lifecycle Support versions. Red Hat has issued a security advisory and released updated packages to address this vulnerability.