CVE-2026-72958 is a high-severity vulnerability in Microsoft Windows 11 Version 24H2 involving a double free flaw in Windows Credential Guard. This vulnerability allows an authorized local attacker to elevate privileges. The issue affects multiple builds of Windows 11 Version 24H2 prior to specific patched versions. An official fix is available from Microsoft.
Red Hat OpenShift AI (RHOAI) version 2.25.11 was released with updates addressing multiple security issues. The advisory references a large set of CVEs, including CVE-2025-61729, but does not specify individual vulnerability details or fixed versions. The update is classified as important and is intended to be applied to OpenShift AI clusters following vendor instructions.
The Kimsuky threat group continues Operation GitPower campaigns utilizing malicious LNK files disguised as financial and business documents. Thirteen LNK variants collected between August 11-19, 2026, employ GitHub Personal Access Tokens (PAT) for command-and-control communications, delivering obfuscated PowerShell loaders through custom decoders. Notable evolution includes anti-analysis routines detecting virtualization tools, Pastebin as alternative C2 infrastructure, and diversified decoy formats (PDF, XLSX, PNG). Metadata analysis reveals AI-generated content using the 'opencode' AI coding agent and HeadlessChrome PDF conversion, with placeholder text remaining unreviewed. The group maintains persistence through hidden scheduled tasks masquerading as legitimate software (BitLocker, MATLAB), while hardcoded GitHub PATs enable raw content retrieval. Despite increased sophistication in evasion techniques and decoy production automation, endpoint behaviors remain detectable through behavioral correlation a...
A Cross-Site Request Forgery (CSRF) vulnerability exists in the OrderConfirmController at the GET /order/confirm/{order_number} endpoint in Roskus Prospero Flow CRM versions before 5.15.11. This flaw allows an unauthenticated attacker to confirm orders on behalf of authenticated users by tricking them into visiting a crafted link. The vulnerability arises because Laravel's CSRF protection middleware does not enforce tokens on GET requests, and the order confirmation action is exposed via a GET route. Since session cookies with SameSite=Lax are sent automatically on top-level cross-site navigations, a single click can confirm an order without user consent. Additionally, sequential order numbers enable attackers to enumerate and confirm multiple orders automatically.
CVE-2026-83557 is a deserialization vulnerability in FasterXML jackson-databind affecting versions from 2.11.0 up to but excluding 2.18.10, 2.19.0 up to 2.21.6, 2.22.0 up to 2.22.2, 3.0.0 up to 3.1.6, and 3.2.0 up to 3.2.2. The issue arises because the DefaultBaseTypeLimitingValidator does not include java.lang.Comparable in its unsafe base types list, allowing polymorphic deserialization of any class implementing Comparable when @JsonTypeInfo is used without a custom validator. This can lead to attacker-controlled object instantiation, such as creating a java.io.File with an attacker-chosen path. No direct code execution via deserialization alone has been identified. Global default typing with explicit validators is not affected. Users should upgrade to fixed versions 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 to remediate.
CVE-2026-82670 is a medium severity vulnerability in IObit Uninstaller version 15.5.0.11. It involves improper privilege management in the IRP_MJ_DEVICE_CONTROL function within the IUForceDelete.sys driver component. The flaw requires local access to exploit and does not involve user interaction. The vendor has not responded to the disclosure, and no patch or official remediation is currently available.
AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters.
IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit GRUB's fail-open signature verification behavior to drop into an interactive GRUB prompt, then boot the device's own kernel with additional command-line arguments to obtain a root shell with the disk unlocked while leaving TPM PCR values unaltered.
IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject malicious kernel command line parameters that execute with boot environment privileges without triggering TPM PCR measurement failures, as the attack does not modify the measured boot code.
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the zero-length buffer trips a BUG_ON() when running with CONFIG_DEBUG_VIRTUAL=y due to trying to get the physical address of the ZERO_SIZE_PTR (returned by kzalloc() on the bogus allocation). kernel BUG at arch/x86/mm/physaddr.c:28 ! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 30 UID: 0 PID: 28580 Comm: syz.2.18 Kdump: loaded Tainted: G W 6.18.16-smp-DEV #1 NONE Tainted: [W]=WARN Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 RIP: 0010:__phys_addr+0x16a/0x180 arch/x86/mm/physaddr.c:28 RSP: 0018:ffffc9008329fc80 EFLAGS: 00010293 RAX: ffffffff8179110a RBX: 0000778000000010 RCX: ffff8884e6992600 RDX: 0000000000000000 RSI: 0000000080000010 RDI: 0000778000000010 RBP: ffffc9008329fdf0 R08: 0000000000000dc0 R09: 00000000ffffffff R10: dffffc0000000000 R11: fffffbfff126d297 R12: dffffc0000000000 R13: 1ffff92010653fc8 R14: 0000000080000010 R15: dffffc0000000000 FS: 0000555556bec9c0(0000) GS:ffff88aa4ce1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd3159e7000 CR3: 00000004fbc44000 CR4: 0000000000350ef0 Call Trace: <TASK> [<ffffffff853d3869>] sev_ioctl_do_pdh_export+0x559/0x7a0 drivers/crypto/ccp/sev-dev.c:2308 [<ffffffff853d1fdd>] sev_ioctl+0x2cd/0x480 drivers/crypto/ccp/sev-dev.c:2556 [<ffffffff82549ebc>] vfs_ioctl fs/ioctl.c:52 [inline] [<ffffffff82549ebc>] __do_sys_ioctl fs/ioctl.c:598 [inline] [<ffffffff82549ebc>] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584 [<ffffffff8630115f>] do_syscall_x64 arch/x86/entry/syscall_64.c:64 [inline] [<ffffffff8630115f>] do_syscall_64+0x9f/0xf40 arch/x86/entry/syscall_64.c:98 [<ffffffff81000136>] entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fd3158eac39 </TASK> Thankfully, the bug is benign outside of CONFIG_DEBUG_VIRTUAL=y as getting the physical address is just arithmetic, and the PSP errors out before trying to write to the garbage address (which it must, otherwise querying the blob lengths would clobber memory at pfn=0).
A vulnerability in the Quiz and Survey Master (QSM) WordPress plugin before version 11.2.4 allows users with Contributor role or higher to access question bank entries via a REST API route without proper authorization checks. This exposure includes quiz questions, hints, and correct answer keys belonging to other users.
Frappe versions 15.11.0 through 16.32.0 contain a stored cross-site scripting (XSS) vulnerability in the workspace card description field. This field is marked to bypass XSS filtering, allowing a user with the Workspace Manager role to inject arbitrary HTML markup. When other users view and hover over the affected workspace card description, the injected code executes in their session context. This can lead to session token theft and unauthorized actions performed with the victim's privileges. The vulnerability is confirmed with a CVSS score of 5.4 (medium severity). No released versions currently contain a fix.
CVE-2026-66155 is a high severity cross-site scripting (XSS) vulnerability in Siemens Element maps-ng versions prior to V47.12.3, V48.11.3, and V49.16.1. The vulnerability arises from improper neutralization of user-controllable input in the si-map component's points property, which is used to render tooltip labels on map pins. An attacker can craft a malicious URL that executes arbitrary script code in the victim's browser when the map pin tooltip is hovered over.
Red Hat Advanced Cluster Management for Kubernetes version 2.13.11 includes an important security update addressing multiple vulnerabilities. This update provides new features, enhancements, bug fixes, and updated container images to improve security and stability for administrators managing Kubernetes clusters across cloud environments. The security impact is rated as Important by Red Hat Product Security. Users are advised to apply this update after ensuring all previous relevant errata are installed.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal core that allows improper neutralization of input during web page generation. This vulnerability affects multiple versions of Drupal core, including versions from 0.0.0 up to 11.2.*, 11.3.0 through 11.3.14, and 11.4.0 through 11.4.4. The vulnerability has a medium severity rating with a CVSS score of 4.7. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.
An improper input validation vulnerability exists in Apache Tomcat due to an incomplete fix for CVE-2026-32990. This vulnerability affects HTTP/2 no-authority handling, allowing bypass of strict Server Name Indication (SNI) validation. It impacts Apache Tomcat versions 9.0.115 through 9.0.120, 10.1.53 through 10.1.57, and 11.0.20 through 11.0.24. The issue is resolved in versions 9.0.121, 10.1.58, and 11.0.25.
An integer overflow vulnerability exists in AcademySoftwareFoundation's OpenEXR library versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13. The overflow occurs during decoding of crafted deep tiled EXR files, leading to a crash due to an invalid memory read. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
CVE-2026-15916 is a missing authorization vulnerability in Drupal core that allows forceful browsing. It affects multiple Drupal core versions up to 10.6.13 and certain 11.x versions. The vulnerability has a medium severity with a CVSS score of 4.2. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.