A vulnerability in Opera Neon on macOS and Windows allows a malicious browser extension to take control of the browser by exploiting improper verification of the source of a communication channel. This affects the Opera Neon MCP Hub extension version 0.0.1. The flaw enables commands to be sent through MCP Hub to the built-in Browser Operator extension without proper source validation.
CVE-2026-19809 is an information leak vulnerability in the Zephyr project affecting the user-mode system call verifier function z_vrfy_charger_get_prop(). It improperly copies uninitialized kernel stack memory to user space, disclosing up to 12 or 16 bytes of kernel stack residue. This leak can reveal kernel object addresses and saved return addresses, aiding attackers in bypassing address layout randomization. The flaw affects Zephyr versions >=3.5.0 <4.3.2 and >=4.4.0 <4.5.0 and is fixed in versions 4.3.2 and 4.5.0. The vulnerability has low severity and no integrity or availability impact.
CVE-2026-91007 is a memory-safety vulnerability in the Zephyr project's charger driver API affecting versions 3.7.0 through 4.3.1 and 4.4.0 through 4.4.9. The flaw arises because user-mode syscall verifiers did not properly validate a union containing function pointers before copying it across the user/kernel boundary. This allows an unprivileged user-mode thread with access to a charger device object to supply arbitrary function pointers that the kernel later executes with supervisor privileges, resulting in control-flow hijacking. The vulnerability also leaks kernel code addresses to user mode and allows suppression of charger notifications. The issue is fixed in Zephyr versions 4.3.2 and 4.5.0 by rejecting these notifier properties in user mode and adding compile-time checks to prevent similar future issues.
A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using `vm.runInThisContext()`. A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted.
The diezyxhao-baileys package on npm contains malicious code that fully compromises any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, removing the package alone may not eliminate all malicious software. Secrets and keys should be rotated from a separate, uncompromised computer to mitigate risk.
The diezy-libsignal-node npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
Between August and September 2026, Chinese-speaking attackers used the open-source AI penetration testing framework Cairn, combined with Chinese AI models Zhipu GLM and DeepSeek, to autonomously conduct 25 operations against at least 19 organizations in semiconductor manufacturing, U.S. defense policy, and civil society sectors. These attacks resulted in unauthorized access or data retrieval at 10 organizations, including credential theft, exposure of over one million personal records, retrieval of military and government identities, creation of persistent admin accounts, and modification of industry documents. The attackers used Cairn to autonomously plan and execute multi-stage attack operations with minimal human intervention. This activity is assessed with moderate confidence as China-nexus intelligence collection tracked as CL-STA-1238.
ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST `/easyuse/save/{name}`. The handler checks the source directory before appending a user-supplied filename and allows the request to select the `custom_nodes` directory as a copy destination. An unauthenticated attacker who can reach the ComfyUI server can overwrite an installed custom node’s Python entry point with an uploaded file. When ComfyUI restarts and loads the modified node, the attacker’s code runs with the privileges of the ComfyUI process.
CVE-2026-126998 is a server-side request forgery (SSRF) vulnerability in JeecgBoot versions 3.9.0 through 3.9.5. It affects the OpenApiController.call function in the /openapi/call endpoint of the Authentication Filter component. The vulnerability allows remote attackers to manipulate requests to cause SSRF. Public exploit code is available, but no vendor response or patch has been provided.
Two moderate security vulnerabilities have been identified in the RPM Package Manager (RPM) used in Red Hat Enterprise Linux 9. These include a command injection vulnerability in the rpmbuild tool via an unescaped tarball path (CVE-2026-84837) and a macro injection vulnerability through crafted tar member names in rpmbuild's getTarSpec function (CVE-2026-78367). These issues could allow an attacker to execute arbitrary commands during package building. Red Hat has released security updates addressing these flaws.
Two vulnerabilities affecting the Core and Agent components of Ivanti Endpoint Manager have been addressed by Ivanti. These vulnerabilities relate to security weaknesses identified by CWE-89 (SQL Injection) and CWE-319 (Cleartext Transmission of Sensitive Information). No specific affected versions or CVSS scores are provided.
CVE-2026-126997 is a server-side request forgery (SSRF) vulnerability in JeecgBoot versions 3.9.0 through 3.9.6. It affects the RestTemplate.exchange function in the flow-run endpoint component, allowing remote attackers to manipulate requests and potentially cause the server to make unauthorized requests. Public exploit code is available, but no vendor response or patch has been provided.
A buffer overflow vulnerability exists in the libgd library when processing specially crafted GIF files. This vulnerability is identified as CVE-2026-9672 and affects the GD open source library used for dynamic image creation. Red Hat has issued a security advisory with an update for Red Hat Enterprise Linux 7 Extended Lifecycle Support to address this issue.
A security vulnerability (CVE-2026-47766) affecting crun, an OCI runtime, allows arbitrary file creation or overwriting via symlink following. Red Hat has issued an important security update addressing this issue in Red Hat Enterprise Linux 9.8 Extended Update Support and related variants. The vulnerability is rated as having a high severity impact. Users of affected Red Hat Enterprise Linux 9.8 versions should apply the provided update to mitigate this risk.
Multiple vulnerabilities have been fixed in Node.js versions 22.x, 24.x, and 26.x. These include issues in the HTTP/2 implementation, HTTPS server module, TLS handling, and proxy error handling. The vulnerabilities cover a range of weaknesses such as use-after-free, improper handling of errors, and security misconfigurations.
CVE-2026-6467 is a vulnerability in PostgreSQL affecting versions before 18.7, 17.12, 16.16, 15.20, and 14.25. It involves an uncontrolled search path element in the CREATE EXTENSION feature, allowing an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. The flaw also affects ALTER EXTENSION and ALTER SCHEMA ... RENAME commands. The issue arises because a trusted-extension script locates the wrong object and executes arbitrary SQL chosen by the attacker.
CVE-2026-6460 is a type confusion vulnerability in PostgreSQL that allows an object creator to execute arbitrary code with the privileges of the database operating system user. The flaw arises from inadequate tracking of typed values, leading to stale values appearing in various system components. This vulnerability affects multiple PostgreSQL versions prior to 14.25, 15.20, 16.16, 17.12, and 18.7 and can be exploited primarily via ALTER ... SET DATA TYPE commands and other DDL operations.
CVE-2026-18447 is a type confusion vulnerability in PostgreSQL SQL-language functions that allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This occurs via an output parameter of type "any". The vulnerability affects multiple PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.