A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
CVE-2026-119610 is a vulnerability in GStreamer's gst-plugins-good H.264 RTP depayloader element affecting multi-time aggregation RTP packets (MTAP16/MTAP24). A signed/unsigned integer conversion error can cause an out-of-bounds heap read of up to 64 KiB when processing truncated packets. This can lead to denial of service by crashing the GStreamer pipeline and potentially leaking adjacent heap memory in relay or transcoding scenarios where output is attacker-accessible. The flaw is present in upstream gst-plugins-good starting from version 1.28.0. Red Hat Enterprise Linux 10 currently ships versions below 1.28.0 and is expected not to include the vulnerable code path until a future rebase. Fedora 44 is affected pending confirmation. Mitigations include blocking untrusted H.264 RTP streams at the network perimeter or avoiding the vulnerable element for untrusted sources.
CVE-2026-124623 is a medium severity vulnerability in PipraPay version 3.0.0. It affects the system-settings-import function in the ZIP Archive Handler component, allowing an attacker to perform unrestricted file uploads remotely. The vulnerability has a CVSS 4.0 base score of 5.1. Public exploit code is available, but no official patch or vendor response has been reported yet.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8.
WidzialniCMS versions prior to 2.5 are vulnerable to a brute force protection bypass in the login functionality. The vulnerability arises because the cookie-based lockout mechanism can be circumvented by omitting the login_count and login_timeout cookies, allowing unlimited login attempts by unauthenticated attackers. This issue has been fixed in version 2.5.
WidzialniCMS versions prior to 2.5 are vulnerable to a reflected Cross-site Scripting (XSS) flaw in the /index.php endpoint. This vulnerability allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim's browser, potentially leading to session cookie theft. The issue has been fixed in version 2.5.
WidzialniCMS versions prior to 2.5 are affected by an unrestricted file upload vulnerability in the /panel/upload.php endpoint. This flaw allows unauthenticated attackers to upload arbitrary files to any server location due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter. Successful exploitation can lead to remote code execution. The vulnerability has been fixed in version 2.5.
Multiple security vulnerabilities have been identified in the Ruby programming language as packaged for Red Hat Enterprise Linux 10. These include a double free issue in the regular expression parser and several integer overflow issues in various regular expression compilers. Red Hat has released an update rebased to Ruby 3.3 that addresses these issues. The update is rated as having a moderate security impact.
WidzialniCMS versions prior to 2.5 contain an unrestricted file upload vulnerability in the /panel/controllers/save_photo.php endpoint. This flaw allows unauthenticated attackers to upload arbitrary files to any server location due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter. Successful exploitation can lead to remote code execution. The vulnerability has been fixed in version 2.5.
CVE-2026-124622 is a time-of-check to time-of-use (TOCTOU) vulnerability in olivier-ls PHP-FTS versions 1.1.0 through 1.1.3. It affects the TrigramIndex::open function in Storage.php and requires local attack conditions where an attacker has write access to the index directory but is a different user than the application process. The vulnerability is considered a hardening issue rather than a remotely exploitable flaw. Upgrading to version 1.1.4 resolves the issue.
Red Hat issued a security advisory for the nodejs:24 module addressing multiple vulnerabilities in Node.js and its dependencies, including undici, brace-expansion, minimatch, and sqlite. The vulnerabilities include denial of service via unrequested WebSocket subprotocol, uncontrolled recursion, stack exhaustion, unhandled stream errors, TLS renegotiation issues, certificate validation bypass, heap-based buffer overflow, and arbitrary code execution. The update is rated as Important by Red Hat Product Security and affects Red Hat Enterprise Linux 9 and related variants. The advisory provides fixes for these issues and directs users to apply the update to remediate the vulnerabilities.
A sophisticated phishing campaign targets hospitality customers by impersonating Booking.com and other hotel services with fake reservation pages. The campaign uses personalized reservation details to increase credibility and employs advanced features such as real-time card validation, interactive verification workflows, and multi-language support. It focuses particularly on Japanese hotels but is designed for global deployment. The phishing kit uses multiple backend endpoints to track victim progression and can prompt additional verification after initial card submission.
A malicious Ruby gem named strutil-core version 1.0.1 was published and quickly removed after it was found to execute a large credential-stealing worm during installation. This worm, a descendant of the Shai-Hulud toolkit, steals credentials from various cloud services, CI systems, package registries, SSH, AI coding tools, and cryptocurrency wallets. It propagates through multiple package managers and platforms including RubyGems, npm, PyPI, JFrog Artifactory, GitHub, GitLab, and SSH. The malware installs a Python backdoor controlled via signed GitHub commits, poisons AI tool configurations to maintain persistence, and contains a conditional wiper that deletes the user's home directory if a stolen GitHub token is revoked. It targets Linux and macOS systems on x86-64 and ARM64 architectures, excluding Russian-speaking locales.
The Iris Plaza online shopping platform suffered a data breach due to compromise of an external cloud service. Personal information of approximately 7.7 million individuals was potentially exposed, including names, addresses, phone numbers, email addresses, dates of birth, gender, and encrypted passwords for platform members. Non-members who made purchases without registration also had some personal data exposed. No credit card information or physical stores were affected. The company has blocked attacker access, notified authorities, and suspended the platform while investigating and remediating the incident.
CVE-2026-112171 is a medium-severity SQL Injection vulnerability in GALENO SISTEMI's MAGISTRA product version 3.12. It allows an attacker with low privileges and local access to inject malicious SQL statements via user-controlled input, potentially leading to unauthorized access, modification, or disclosure of database data.
Multiple security vulnerabilities have been identified and fixed in the dnsmasq packages used in Red Hat Enterprise Linux 8.8. These include heap buffer overflows, infinite loops, out-of-bounds reads, and source validation bypasses affecting DNS and DHCP functionalities. An update is available that addresses these issues along with a new DNSSEC trust anchor key for 2024.
GALENO SISTEMI MAGISTRA version 3.12 has a vulnerability where the software downloads upgrade files without performing integrity checks. This flaw allows the installation of tampered updates, potentially compromising the system.
MAGISTRA software version 3.12 by GALENO SISTEMI contains an undocumented backdoor that enables authentication bypass. This flaw allows attackers to create privileged user accounts without credential verification, posing a significant security risk. The vulnerability is classified under CWE-288 (Authentication Bypass) and CWE-912 (Hidden Functionality).
CVE-2026-112168 affects GALENO SISTEMI's MAGISTRA software version 3.12. The vulnerability involves the use of weak custom encryption, reliance on an outdated compression algorithm for database protection, and the presence of embedded secrets, leading to cleartext storage of sensitive information.
A use-after-free vulnerability exists in Samsung Open Source Escargot before commit 8bc35b7b88f0f96c66a42aa965a1a710308b61d5. This flaw allows pointer manipulation, potentially leading to a denial of service. The vulnerability has a medium severity rating with a CVSS score of 5.1.
