Threat Intelligence Database

CVE-2026-42169 is a heap-buffer-overflow vulnerability in GIMP's APNG file loader and DDS plug-in affecting Red Hat Enterprise Linux 6. The flaw occurs when the fcTL width exceeds the IHDR width in APNG files, causing pixel data to overflow heap allocations. A similar heap overflow exists in the DDS plug-in due to a bits-per-pixel mismatch. Exploitation requires a user to open a specially crafted image file, potentially leading to code execution. No official fix or mitigation meeting Red Hat's criteria is currently available.

A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-18722 is an authorization bypass vulnerability in diaowen DWSurvey versions 6.0 through 6.14.0. It affects the devSurvey function in the DwDeisgnSurveyController component, allowing remote attackers to bypass authorization controls. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation has been announced by the vendor, who has not responded to disclosure attempts. Exploit details have been made public, but there are no confirmed reports of exploitation in the wild.

An open redirect vulnerability exists in kalcaddle kodbox 1.67 Build 02 within the SSO API Login component. The issue arises from improper handling of the callbackUrl parameter in the /user/sso/apiLogin endpoint, allowing attackers to redirect users to arbitrary external sites. This vulnerability can be exploited remotely and requires user interaction. The vendor has not responded to the disclosure, and no official fix or patch has been announced. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

CVE-2026-14818 is a path traversal vulnerability in Zyxel ATP series and related firmware versions that allows an authenticated administrator to execute crafted malicious configuration files via a CLI command. The affected firmware versions include Zyxel ATP series from V4.32 through V5.42 Patch 1, USG FLEX series from V4.50 through V5.42 Patch 1, USG FLEX 50(W) series from V4.16 through V5.42 Patch 1, and USG20(W)-VPN series from V4.16 through V5.42 Patch 1. This vulnerability can lead to high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.

The provided information references an ISC Stormcast podcast episode dated August 4th, 2026, from the SANS Internet Storm Center. No specific vulnerability details, technical descriptions, or affected software versions are provided in the source content. The entry does not describe any concrete security threat or exploit.

New York State has awarded over $9 million in grants to 153 drinking water and wastewater systems to enhance their cybersecurity defenses. This initiative follows a recent multistate cyber campaign targeting water infrastructure, which caused operational disruptions in several states but did not affect New York utilities publicly. The funding supports cybersecurity assessments, upgrades, and compliance with new state cybersecurity standards for utilities. The campaign involved attacks on operational technology systems, including programmable logic controllers, and is suspected to be linked to Iranian threat actors. Federal agencies recommend removing exposed OT devices from the internet and securing remote access. The grants aim to improve resilience and compliance with mandatory cybersecurity measures for critical water infrastructure.

CVE-2026-18719 is a medium severity SQL injection vulnerability in cemtan sar2html version 4.0.0. The issue exists in the sar2html.py file within the Search component, where manipulation of the Search argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. The vendor has not responded to the disclosure, and no official patch or remediation is currently available. Exploit code is publicly available, but no known widespread exploitation has been reported.

A vulnerability in Node.js allows a specially crafted TypedArray with a spoofed byteLength to trigger an assertion failure in synchronous node:zlib APIs, causing the process to crash. This affects all 11 synchronous zlib functions and can be exploited repeatedly to cause denial of service. The issue impacts specific versions of Node.js 22.x, 24.x, and 26.x.

A vulnerability in the Node.js HTTP client can cause HTTP request desynchronization in forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while reusing backend connections. This occurs because Node.js may omit headers beyond configured header count limits from user-accessible header collections but still use them internally for HTTP framing, potentially hiding headers like Content-Length. This affects Node.js versions 22.23.1, 24.18.0, and 26.5.0.