Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 has an input validation vulnerability in its UPnP/DLNA AVTransport SOAP service. This flaw allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without proper validation of scheme, host, or media legitimacy. Exploitation requires a one-time DLNA pairing and can lead to the TV fetching and rendering attacker-controlled content, enabling phishing pages, fake firmware prompts, and fake emergency alerts to be displayed, with silent execution of subsequent commands.
A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker with a malicious USB device to cause a system crash by triggering unbounded recursion during device enumeration. This results in kernel stack exhaustion and a denial of service without requiring user authentication.
CVE-2026-100081 is a vulnerability in the Linux kernel's xen-netback component related to the improper timing of the xenvif_mcast_addr_list_free() function call. The fix involves deferring this function call to occur after all transmit and receive processing has stopped, ensuring proper synchronization and avoiding locking or RCU issues. This vulnerability is tracked as XSA-527.
FileGator versions prior to 7.15.0 contain a vulnerability in the batch download functionality that allows an authenticated user with read, download, and batchdownload permissions to access another user's temporary batch archive by using the archive's unique identifier. This occurs because the system does not verify that the requesting session created the archive. Exploitation is limited by the need to obtain a valid archive ID and the archive's limited lifetime. The issue is fixed in version 7.15.0.
The tailwind-animationfound package on npm contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package 'modelsdesk' version 0.4.2 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential exposure of all secrets and keys stored on the affected system. Immediate removal of the package is recommended, but due to the extent of control given to the attacker, complete remediation cannot be guaranteed by removal alone.
CVE-2026-119800 is an authorization bypass vulnerability in IgnisDa ryot versions prior to 10.5.6. The flaw exists in the collectionContents GraphQL query, which allows any authenticated user to access collection data they do not own or have permission to view. This includes the owner's identity, collection name and description, reviews, and the complete item list. The issue is fixed in version 10.5.6.
The npm package 'kampodine' version 0.8.0 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
CVE-2026-77442 is an authorization bypass vulnerability in the IgnisDa Ryot application prior to version 10.4.0. It allows a low-privileged authenticated user to update another user's integration by supplying their integration ID without proper ownership verification. This can lead to overwriting or disabling the victim's integration configuration. The vulnerability requires knowledge of the victim's integration ID, which is not easily guessable. The issue is fixed in version 10.4.0.
CVE-2026-104267 is an out-of-bounds write vulnerability in the Botan cryptography library's Scrypt implementation on 32-bit platforms. Versions from 2.7.0 up to but not including 3.13.0 are affected. The flaw arises from unchecked multiplication when computing required memory, allowing attacker-controlled parameters to cause buffer overflow. This can lead to process crashes and denial of service. While arbitrary code execution has not been demonstrated, it cannot be ruled out. The issue is fixed in Botan version 3.13.0.
CVE-2026-48057 is a low-severity vulnerability in the Botan C++ cryptography library prior to version 3.13.0. It involves improper certificate validation due to flawed handling of multi-value Relative Distinguished Names (RDNs) in X.509 Distinguished Name decoding. An attacker controlling a name-constrained intermediate CA can exploit this to bypass DN name constraints when certificates lack a subjectAlternativeName extension. This issue is fixed in Botan version 3.13.0.
A vulnerability in liboqs prior to version 0.16.0 allows an uninitialized function pointer dereference in the OQS_KEM_encaps_derand function for certain NTRU KEM schemes. This can cause a calling-process crash and denial of service if the affected function is invoked on one of the six specified NTRU KEMs. The issue is fixed in version 0.16.0.
A covert timing channel vulnerability (CWE-385) exists in the liboqs cryptographic library versions prior to 0.16.0. The issue arises in the ct_select function for FrodoKEM AES and SHAKE variants when compiled with Clang 17 or later at certain optimization levels, allowing secret-dependent cache behavior. This can enable a local attacker to perform cache-timing measurements to aid private key recovery. The vulnerability is fixed in version 0.16.0.
A medium-severity out-of-bounds read vulnerability exists in the open-quantum-safe liboqs library versions 0.11.0 through 0.16.0 when built with OQS_ENABLE_SIG_STFL_LMS=ON. The flaw allows reading up to 32 bytes beyond a caller-supplied signature buffer during verification of truncated LMS or HSS-LMS signatures, and up to 8 bytes in public key validation. The read data is only used internally for hashing and is not exposed externally. This can cause a verifier crash and denial of service but does not lead to memory disclosure or acceptance of invalid signatures. The issue is scheduled to be fixed in version 0.17.0.
CVE-2026-69128 is a path traversal vulnerability in Chartbrew versions 5.2.2 through before 5.2.3. It arises from the AI SQL blocklist failing to block certain PostgreSQL filesystem functions, especially when used with double-quoted identifiers. This allows users with Owner or Admin privileges and AI features enabled to bypass the blocklist and execute server-side file functions via PostgreSQL. The vulnerability is fixed in version 5.2.3.
Chartbrew versions 4.8.5 through 5.2.2 contain a server-side request forgery (SSRF) vulnerability. Authenticated users with permission to manage API connections can enable the internal allowPrivateHost field, bypassing restrictions on private and reserved network destinations. This allows requests to internal HTTP services accessible from the Chartbrew server, potentially exposing sensitive information or triggering unauthorized actions. The vulnerability is fixed in version 5.2.3.
CVE-2026-123788 is a medium severity vulnerability in chenyme grok2api versions 3.1.0 through 3.1.6. It involves an issue in the STT Billing component's backend/internal/transport/http/inference/voice_ws_handler.go file, where manipulation can lead to enforcement of behavioral workflow. The vulnerability can be exploited remotely without user interaction. Upgrading to version 3.1.7 resolves the issue.
In late 2026, cyberattacks targeted refrigeration systems in Europe, primarily affecting supermarkets and some medical facilities. Attackers gained unauthorized access to refrigeration controllers, setting them to defrost mode and raising temperatures up to 50°C, causing widespread food spoilage and some fires. The initial access vector remains unconfirmed but may involve vulnerable software versions or default credentials. Over 5,000 internet-exposed devices related to these systems were identified, with a notable decline in exposed devices in France following the attacks. Pro-Russian hacktivist groups claimed responsibility, though this is unverified. CISA issued warnings about potential exploitation methods including authentication bypass and arbitrary code injection. Palo Alto Networks recommends leveraging their security products and services to detect and mitigate risks associated with exposed refrigeration controllers.
Chartbrew versions prior to 5.2.3 have a vulnerability where public dashboard passwords are stored in plaintext and accepted via URL query parameters without effective throttling on authentication attempts. This allows unauthenticated attackers to perform unlimited brute force password guesses on public password-protected dashboards. Passwords can also be exposed in server or proxy logs due to cleartext storage and URL transport. Successful exploitation grants access to protected dashboards and their chart data. The issue is fixed in version 5.2.3.
Chartbrew versions prior to 5.2.3 expose the BullMQ administrative dashboard at /apps/queues without authentication. This allows remote unauthenticated attackers to access queue management functions if Redis and BullMQ are enabled and the route is reachable. Attackers can inspect job payloads and logs, and potentially retry, delete, or alter jobs, impacting confidentiality, integrity, and availability. The issue is fixed in version 5.2.3.