A follow-up vulnerability CVE-2026-108976 indicates the previous remediation for the Emacs editor was insufficient, requiring further attention from IT teams managing these systems.
A high-severity flaw in SUSE Rancher allows users to escalate privileges by creating duplicate project names across clusters. Affected versions are listed.
QNAP has released Video Station 5.8.8 to address CVE-2026-34015, a high-severity vulnerability that allows authenticated attackers to access sensitive system data.
QNAP released QuMagie 2.9.1 to address CVE-2026-41545, a high-severity path traversal issue allowing authenticated attackers to read sensitive system files.
QNAP releases Video Station 5.8.8 to fix CVE-2026-44084, an authorization bypass allowing remote attackers to access sensitive data on affected NAS devices.
Users of QNAP Notes Station 3 must upgrade to version 3.9.11 to address a high-severity flaw allowing local attackers with admin rights to compromise system security.
A high-severity vulnerability in Eclipse Jetty allows attackers to bypass host whitelists using case variations, requiring immediate attention for affected versions.
A high-severity memory corruption flaw in HPE NonStop HTTP Webserver versions T1144L24^AAL and earlier can cause system halts, requiring inventory checks.
A high-severity vulnerability in Fluent CRM allows privilege escalation. MSPs must assess exposure across all installations running versions up to 3.2.5 immediately.
A high-severity parsing flaw in Symfony allows attackers to crash PHP processes via deep nesting. Patches are available for all affected major version lines.
A high-severity flaw in WildFly and JBoss EAP lets attackers with deployer roles traverse paths and escalate to SuperUser.
A critical vulnerability in Nutanix Prism Element allows attackers to bypass authentication and gain full administrative control over clusters without credentials.
Version 1.6.1 addresses CVE-2026-12530, which allowed crafted package names to bypass validation and expose sandbox files.
A critical vulnerability in the Frontend Admin plugin allows privilege escalation, affecting all versions up to 3.29.13.
A critical flaw in Fluent CRM versions up to 3.2.5 allows privilege escalation. MSPs must assess exposure immediately as the source material does not confirm a fix.
A critical vulnerability in Eclipse EthereumAuthenticator allows attackers to bypass authentication checks if request paths match specific patterns.
A startup error in the AWS API MCP Server bypasses security policies until the process restarts, requiring an immediate upgrade to version 1.3.47.
An unauthenticated denial-of-service vulnerability in AWS Smithy-RS affects versions through 0.66.4, with a fix available in version 0.66.5.
A critical vulnerability in Omnispace Agora Project allows attackers to predict default passwords, enabling account takeover before legitimate users can log in.
A critical vulnerability in Omnispace Agora allows unauthenticated attackers to hijack accounts using predictable password-reset tokens in versions before 26.10.0.
A critical vulnerability in Report One MyReport Updater through version 2.1.1 allows unauthenticated remote code execution. No patch is confirmed yet.
An update for Stirling-PDF version 2.13.2 addresses a critical vulnerability that lets authenticated admins execute arbitrary commands via database imports.
Microsoft SQL Server versions through 2022 face a high-severity flaw that allows authorized attackers to execute code over the network.
Microsoft confirms a high-severity stack-based buffer overflow in SQL Server that allows authorized users to elevate privileges over a network connection.