CVE-2026-78287 is a critical code injection vulnerability in Staggs STAGGS software versions prior to 3.4.0. It allows remote attackers to include and execute arbitrary code on affected systems without any privileges or user interaction. The vulnerability is fixed in version 3.4.0.
CVE-2026-124253 is a high-severity vulnerability in codepeople's Calculated Fields Form plugin that allows DOM-based Cross-site Scripting (XSS) attacks. The flaw exists in versions prior to 5.5.2.9 and involves improper neutralization of input during web page generation, enabling attackers to execute malicious scripts in the context of the victim's browser.
CVE-2026-123478 is a stored cross-site scripting (XSS) vulnerability in Meow Apps AI Engine (versions before 3.9.2). It involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability has a high severity with a CVSS score of 7.1 and affects versions from initial releases up to 3.9.1. A fix is available in version 3.9.2.
Red Hat has released an important security update for Red Hat Build of Apache Camel 4.22 for Quarkus 3.40 (RHBQ 3.40.1.GA) addressing multiple vulnerabilities. These include security constraint bypass, information disclosure through improper credential handling and property placeholder evaluation, unauthorized file access via path traversal, XML external entity injection, and manipulation of route behavior via injected MIME headers. The update improves security and stability by fixing these issues.
A critical security advisory from Red Hat addresses multiple vulnerabilities in the ANGLE component used by Chromium-based browsers within the webkitgtk4 package. These vulnerabilities include arbitrary code execution, information disclosure, use-after-free, buffer overflow, improper input validation, and uninitialized resource issues. The advisory provides updates for Red Hat Enterprise Linux 7 Extended Lifecycle Support to fix these issues. No CVSS scores are provided, but the impact is rated critical by Red Hat Product Security.
CVE-2026-118965 is a critical path traversal vulnerability in Checkmk discovered host label synchronization affecting versions before 2.5.0p19, 2.4.0p40, and the EOL version 2.3.0. It allows an attacker controlling a remote site in a distributed monitoring setup to write arbitrary files on the central site, leading to code execution as the central site user.
An uncontrolled recursion vulnerability exists in Apache XML Graphics Batik affecting versions up to 1.19. This flaw can lead to potential issues such as application crashes or denial of service. The Apache Software Foundation has addressed this vulnerability in version 1.20, which users are advised to upgrade to.
CVE-2026-120495 is a critical path traversal vulnerability in the Synthetic Monitoring "Robotmk" test service of Checkmk versions prior to 2.5.0p19 and 2.4.0p40, and in version 2.3.0 (EOL). An attacker who can control the agent output of a monitored host can inject crafted robot output to manipulate the generated HTML log's content and location, resulting in code execution as the site user.
CVE-2026-121374 is a critical argument injection vulnerability in the Kubernetes special agent component of Checkmk versions 2.3.0, and versions prior to 2.5.0p19 and 2.4.0p40. It allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user by exploiting crafted node roles in the 'Exclude nodes based on their role' rule option. This can lead to code execution with the privileges of the site user.
CVE-2026-124741 is a vulnerability in the BusyBox udhcpc6 DHCPv6 client used in Red Hat Hardened Images. The client does not properly validate the size of network options from a DHCPv6 server, leading to a stack-based buffer overflow. This flaw can be exploited by a malicious DHCPv6 server on the local network to cause a denial of service or achieve arbitrary code execution with root privileges. The vulnerability primarily affects specialized or embedded environments where BusyBox's udhcpc6 is explicitly used, as standard Red Hat Enterprise Linux installations use NetworkManager instead. No mitigation or patch currently meets Red Hat's criteria for ease of use and deployment.
CVE-2026-124739 is a stack-based buffer overflow vulnerability in BusyBox's httpd web server when processing subdirectory configuration files with overly long index page names. An attacker with write permissions to these configuration files could exploit this flaw to execute arbitrary code with elevated privileges or cause a denial of service by crashing the server process. The vulnerability requires BusyBox httpd to be actively running and serving content from directories writable by untrusted users. Red Hat notes that BusyBox is not deployed as a standard web server by default in Red Hat Enterprise Linux 6, limiting exposure in typical installations.
Siemens and other industrial technology vendors have disclosed multiple high-severity vulnerabilities affecting various ICS/OT products, including Siemens' ROS#, Simcenter Femap, Mendix Studio Pro MCP Server, Simatic SCADA and PCS 7, Meta-iot2050, and Simatic WinCC Graphics Designer. Some advisories also address the impact of the Node2Shell vulnerability. Exploitation attempts of Node2Shell have been observed, though not specifically targeting Siemens products. Additional vulnerabilities affect products from Schneider Electric, Beckhoff, Johnson Controls, Hitachi Energy, and others, with issues ranging from arbitrary code execution to privilege escalation. Siemens notes that patches are not yet available for several affected products, and some versions will not receive fixes, recommending customers apply mitigations. The flaws can lead to code injection, unauthorized data access, and system compromise.
A security update for nginx version 1.24 addresses two vulnerabilities in the ngx_http_core_module, including a heap-based buffer overflow triggered via alias with rewrite referencing $request_filename (CVE-2026-15176) and another unspecified vulnerability (CVE-2026-97205). These issues affect Red Hat Enterprise Linux 8 distributions and have been rated as important by Red Hat Product Security. The update mitigates potential security risks associated with these flaws.
An XML External Entity (XXE) vulnerability exists in Apache XML Graphics Batik versions up to 1.19. This vulnerability is classified as CWE-611, indicating improper restriction of XML external entity references. The issue is resolved in version 1.20, which users are advised to upgrade to.
Multiple security vulnerabilities have been identified and fixed in the xorg-x11-server component of Red Hat Enterprise Linux 9.6 Extended Update Support. These include several arbitrary code execution flaws, privilege escalation, use-after-free, double-free, out-of-bounds write, and buffer overflow issues affecting various parts of the X.Org server and Xwayland. The update addresses these critical issues to prevent potential exploitation.
Siemens has addressed multiple vulnerabilities in various products including SIMATIC and COMOS. The specific vulnerabilities are not detailed, and no CVSS score or exploit information is provided. No affected versions or patch details are explicitly stated.
Multiple security vulnerabilities have been identified in the gcc compiler packages provided by Red Hat, affecting various language compilers and related support libraries. The issues include integer wrap, out-of-bounds read/write, stack overflow, and out-of-bounds read in different parts of the libstdc++ library and standard components. These vulnerabilities have been assigned CVE identifiers CVE-2026-114690, CVE-2026-114691, CVE-2026-115455, and CVE-2026-115456. Red Hat has released an update for Red Hat Enterprise Linux 10 to address these moderate severity issues.
CVE-2026-124256 is a stored cross-site scripting (XSS) vulnerability in the CodeRockz Delivery & Pickup Date Time for WooCommerce plugin. It affects versions from initial releases up to 1.3.90. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 1.3.91.