CVE-2025-12523 is a vulnerability in Centreon affecting the Users Configuration Endpoint, where broken object level authorization allows an authenticated user to disclose information they should not access. The flaw impacts Centreon versions 24.10, 24.04, and versions from 25.10.0 up to but not including 25.11.0. The vulnerability has a CVSS score of 6.5 (medium severity) and is fixed in centreon-web versions 25.10.6, 24.10.21, and 24.04.25.
CVE-2026-62374 affects the @sd-jwt/core JavaScript library used for Selective Disclosure JWT (SD-JWT) implementations. Versions 0.19.0 and earlier of @sd-jwt/core and @sd-jwt/decode silently drop tampered or malformed Disclosures without error, returning a reduced claim set while still reporting verification success. This behavior violates RFC 9901 requirements to reject unreferenced or invalid Disclosures. An attacker can exploit this to alter authorization decisions if key binding is not enforced, potentially bypassing claim-based restrictions. The issue is fixed in version 0.20.0 of @sd-jwt/core. No patch is identified for the standalone @sd-jwt/decode package.
Two serious vulnerabilities were found in the Rust zip crate, a widely used library for handling ZIP files. The first (RUSTSEC-2026-0367) allows privilege escalation by preserving dangerous file permission bits (setuid, setgid, sticky bit) when extracting archives, potentially enabling attackers to plant setuid-root files. The second (CVE-2026-115905) is a critical remote code execution flaw caused by inconsistent handling of file names between the central directory and local headers in ZIP archives, allowing arbitrary file overwrite and execution. Both vulnerabilities are fixed in version 9.0.5 of the zip crate. The advisory emphasizes that patching alone is insufficient and advocates architectural security using deny-by-default sandboxes to contain untrusted code and limit the impact of such vulnerabilities.
CVE-2026-118758 is a path traversal vulnerability in Kubeflow Pipelines prior to version 2.18.0. The volume artifact handler for the GET /artifacts/get?source=volume endpoint did not properly restrict file paths to the selected volume, allowing an attacker who can access this route and identify a mounted volume to read files outside that volume. The vulnerability affects deployments with disabled authentication or where the attacker is authorized for the namespace. The issue is fixed in version 2.18.0.
The provided document does not contain substantive threat intelligence or detailed information about the 'From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign'. It appears to be a placeholder or verification page without actual content for analysis. Several CVE identifiers are mentioned but without descriptions or context. No active exploitation or specific malicious activities are detailed.
KeePassXC versions from 2.3.0 up to but not including 2.8.0 contain an out-of-bounds write vulnerability in the browser integration component. The issue arises because a fixed 1 MiB output buffer is used for encrypting authorized responses, but the encryption function writes more data than this buffer can hold under certain conditions. This flaw can be triggered by a browser-protocol client with valid database association and access to the per-user IPC endpoint when an unlocked database generates a large authorized response. The vulnerability is fixed in version 2.8.0.
CVE-2025-13050 is a medium severity vulnerability in Centreon that involves broken function level authorization. It allows an authenticated user with low privileges to execute poller post-restart commands, potentially impacting integrity and availability. The flaw affects Centreon versions 24.04, 24.10, and 25.10. Fixes are available in versions centreon-web-24.04.25, centreon-web-24.10.21, and centreon-web-25.10.9.
CVE-2026-119145 is a critical path traversal vulnerability in Frappe versions before 15.121.0 and 16.x before 16.34.0. The flaw arises because the file upload handling does not properly validate destination paths, allowing authenticated attackers to write files outside the intended directory. This can lead to remote code execution on the affected server.
CVE-2026-119144 is a server-side template injection vulnerability in the Frappe Framework affecting versions before 15.111.0 and 16.x before 16.21.0. It arises because user-controlled message fields are rendered as templates without proper neutralization, allowing an authenticated attacker with common operational privileges to inject and execute arbitrary template expressions on the server.
CVE-2026-119143 is a denial of service vulnerability in bytecodealliance's wasmtime affecting versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3. The flaw allows guest code to cause a host panic by performing out-of-bounds zero-length stream operations, leading to a crash in WASIp3 embedders.
CVE-2026-119142 is a denial of service vulnerability in wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3. Dropping the Future returned by TypedFunc::call_async when the guest task has not started causes cleanup code to unwrap an error, leading to a panic that crashes the host application.
CVE-2026-119141 is a denial of service vulnerability in Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3. The flaw arises because the may_leave flag is not cleared during realloc, allowing malicious WebAssembly modules to cause the host to panic by invoking non-reentrant code via nested calls. This can crash the host by triggering reentrant calls during memory reallocation operations.
CVE-2026-119140 is a denial of service vulnerability in bytecodealliance's wasmtime affecting versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3. It allows malicious components to cause the host to panic by exploiting thread.yield calls in start functions, leading to a crash due to undisposed fiber drops.
CVE-2026-119139 is a reachable assertion vulnerability in bytecodealliance's wasmtime affecting versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3. The flaw occurs in component::Func::call, where a leftover assertion rejects guest exports using the async ABI option. An attacker supplying a component with an async-lifted export can cause the host process to crash when that export is invoked.
CVE-2026-119138 is a denial of service vulnerability in bytecodealliance's wasmtime affecting versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3. The flaw allows pending calls to trigger an assertion failure after a trap poisons the Store, potentially crashing embedders that continue using the inconsistent Store.
CVE-2026-119137 is a stack overflow vulnerability in bytecodealliance's wasmtime affecting versions 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3. It allows guest code to crash the host by creating a long chain of recursive types that trigger unbounded recursive drops, exhausting the host stack.
CVE-2026-119136 affects Wasmtime versions 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3. The vulnerability arises from insufficient checks in the Store component when mixing asynchronous and synchronous WebAssembly calls. This can lead to runtime panics or unsafe cross-thread movement of non-Send host variables when embedders re-enter WebAssembly synchronously from asynchronously called host functions.
CVE-2026-119135 is a vulnerability in bytecodealliance's wasmtime affecting versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3. The issue causes a panic (crash) when the host reads a component model stream as a different Rust item type than it was originally created with. This occurs because the host-to-host read path asserts matching TypeIds instead of returning an error, allowing guest code to trigger a crash by returning a host-created StreamReader<U> that the embedder reads as StreamReader<T>.
CVE-2026-119134 is a vulnerability in bytecodealliance's wasmtime affecting versions before 36.0.18, between 37.0.0 and before 48.0.6, and between 49.0.0 and before 49.0.3. The issue involves resource handle tables being capped only per component instance without charging allocations to ResourceLimiter or StoreLimits. This allows a malicious guest to repeatedly allocate resources and instantiate sub-components, leading to unbounded host memory growth.
CVE-2026-119133 is a low-severity vulnerability in wasmtime versions 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3. It involves a memory misalignment flaw in the VMContext layout when WebAssembly modules contain an odd number of exception tags. This misalignment causes undefined behavior in embedders with exceptions enabled. No exploitation path is currently known.