ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 have a vulnerability that allows authenticated users to execute remote code via the Log Forward option. This vulnerability has a high severity score of 8.7 and requires high privileges to exploit, with no user interaction needed.
Two critical PHP vulnerabilities affect older deployments of Festo Didactic MES4 products using XAMPP with PHP versions up to 7.3, which are out-of-support and unpatched. Mitigations recommended by the PHP foundation include setting memory_limit=-1 and disabling session upload progress in php.ini, with an optional Apache configuration change that impacts performance. Additional firewall restrictions on the Windows host are suggested to limit communication to trusted sources.
This security update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.72 addresses multiple security vulnerabilities affecting various kernel components such as virtiofs, netfs, xfrm, sctp, ipvs, SUNRPC, nfsd, and ipv4. The fixes resolve issues including use-after-free, buffer overruns, stale pointers, overflow conditions, and error path bugs. These vulnerabilities were identified by their CVE identifiers and have been remediated in this update.
@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Length is complete, the client does not abort, and no file size limit is exceeded. The plugin destroys the in-progress file stream without an error, so a handler that iterates the request parts and performs asynchronous work before consuming the file attaches to a stream that never emits an error or end event, and the request never responds while the connection stays open. An unauthenticated remote client can repeat these malformed uploads against such a route to accumulate pending connections and exhaust server resources, so the impact is availability only and exploitation depends on the application using a delayed file consumer. The issue is fixed in @fastify/multipart 10.1.7, where the parser error is propagated to the file stream so a delayed consumer settles with an error instead of hanging, and users should upgrade to 10.1.7 or later. There is no workaround other than upgrading.
@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature check reports the value as invalid, still passes the original cookie value to the session decoder, so a session whose signature did not validate is decrypted anyway. The practical effect appears when an application supplies the cookie signing secret independently of the session encryption key and rotates only the signing secret to retire existing sessions while keeping the encryption key active, because a holder of an old session cookie can strip the now obsolete signature and keep using the session. The attacker must already possess an unexpired encrypted session cookie and needs neither secret, and cannot forge session data, extend expiry, or survive rotation of the encryption key. The issue is fixed in @fastify/secure-session 8.4.2, which no longer decodes the session when the signed cookie option is set and the signature check fails, and users should upgrade to 8.4.2 or later. As a workaround, rotate the session encryption key rather than relying on rotation of the cookie signing secret alone.
Multiple security vulnerabilities have been identified and fixed in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include remote code execution, denial of service, information disclosure, use-after-free, and heap buffer overflow issues. The vulnerabilities affect the xfreerdp client and related components, potentially impacting connections to RDP servers such as Microsoft Windows, xrdp, and VirtualBox. Red Hat has issued an important security update for FreeRDP on Red Hat Enterprise Linux 7 Extended Lifecycle Support to address these issues.
A denial-of-service (DoS) vulnerability exists in the DSoftBus module. Exploitation of this flaw can impact system availability but does not affect confidentiality or integrity. The vulnerability has a medium severity rating with a CVSS score of 5.7.
CVE-2026-101179 is a buffer overflow vulnerability in the file preview module. Exploitation may impact system availability. The vulnerability has a medium severity score of 4.7 and does not affect confidentiality or integrity. No affected versions or patch information are provided.
CVE-2026-101176 is a permission control vulnerability in the event notification management module. Exploitation may impact service confidentiality. The vulnerability has a CVSS v3.1 score of 7.1, indicating high severity. No affected versions or patch information are provided.
CVE-2026-101177 is a permission control vulnerability in the Optimizer module. Exploiting this flaw may impact the confidentiality of the service. The vulnerability has a low severity rating with a CVSS score of 3.7. No affected versions or patch information are currently provided.
A weakness in the Global Session Handler component of mathurvishal CloudClassroom-PHP-Project allows remote attackers to cause session expiration through manipulation. The attack requires high complexity and is difficult to exploit. No specific affected versions or patches are available due to the product's rolling release model. The vendor did not respond to disclosure attempts. The CVSS score is low (3.7) with limited impact to confidentiality only.
VStarcam O-KAM SuperIPCam version 1.3.3.32 contains a use-after-free vulnerability in the P2P Session Teardown component. This flaw affects the function FUN_005a2d44 in the SuperIPCam.exe file and can be exploited remotely without authentication. The vulnerability has a CVSS score of 7.3, indicating high severity. Public exploit code is available, but the vendor has not responded or issued a patch.
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-120347 is a SQL injection vulnerability in dayrui XunRuiCMS versions 4.7.0 through 4.7.4. The flaw exists in the View function of the Member Module component, specifically in the file dayrui/Fcms/Core/View.php. An attacker can remotely manipulate the 'catid' argument to execute SQL injection. Public exploit code has been disclosed. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9.
A path traversal vulnerability exists in Aklivity Zilla up to versions 1.3.4, 2.4.7, and 2.5.0-rc2 in the Path.resolve function of the FileSystemServerFactory component within the http-filesystem binding. This flaw allows remote attackers to manipulate path parameters to access unauthorized files. Public exploit code is available. Upgrading to version 2.5.0-rc3 addresses this issue.
A security flaw in samanhappy MCPHub up to versions 1.0.45 and 1.1.7 allows remote attackers to cause information disclosure via manipulation of the passthroughHeaders argument in src/utils/passthroughHeaders.ts. The issue has been addressed in version 1.1.8.