🖼️ Crafted Images Can Trigger GIMP Memory Corruption
Organizations using GIMP should update promptly, especially on systems where users open images from untrusted or external sources. Treat this as a high-priority desktop application patch because exploitation requires only a malicious file to be opened.
CVE-2026-42169 affects GIMP and covers heap-buffer-overflow conditions in its APNG file loader and DDS plug-in. A specially crafted image can write data beyond allocated heap memory and potentially enable code execution. The vulnerability is rated HIGH with a CVSS score of 7.3.
🔗 Read more 🔗
Source: NVD
🛡️ Zyxel Firewall Path Traversal Enables Malicious Config Execution
Zyxel firewall administrators should apply the vendor update promptly and review access to privileged management accounts. The flaw requires administrator authentication, but compromised or misused credentials could turn it into a direct device takeover path.
CVE-2026-14818 is a path traversal vulnerability in the configuration-file execution CLI command used by multiple Zyxel ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN firmware releases. An authenticated attacker with administrator privileges can execute a crafted malicious configuration file on an affected device. The vulnerability is rated HIGH with a CVSS score of 7.2.
🔗 Read more 🔗
Source: NVD
⌨️ Zyxel WAX650S Command Injection Exposes Device OS
Operators of WAX650S access points should patch promptly and restrict management access to trusted networks. Because exploitation grants OS command execution, any suspected administrator-account compromise should trigger immediate credential rotation and device review.
CVE-2026-6837 is a post-authentication command injection vulnerability in the export-cgi CGI program of Zyxel WAX650S firmware through 7.10(ABRM.4)C0. An authenticated attacker with administrator privileges can execute operating-system commands on the affected device. The vulnerability is rated HIGH with a CVSS score of 7.2.
🔗 Read more 🔗
Source: NVD
🟢 Node.js HTTP/2 Flaw Enables Remote Memory Exhaustion
Teams running internet-facing Node.js 22.x or 24.x HTTP/2 services should upgrade quickly. Prioritize high-traffic APIs and services without strong upstream connection or resource limits, as the likely impact is remote denial of service.
CVE-2026-56846 affects Node.js 24.x and 22.x HTTP/2 handling. Retained header blocks can evade the maxSessionMemory limit, allowing a remote attacker to exhaust server memory and disrupt availability. The vulnerability is rated HIGH with a CVSS score of 7.5.
🔗 Read more 🔗
Source: NVD
📂 CustomSounds Path Traversal Exposes Arbitrary Files
Administrators using FileSystem-backed CustomSounds storage should patch immediately and consider disabling or restricting the affected endpoint until remediation is complete. Because no authentication is required, publicly reachable deployments face the greatest risk.
CVE-2026-56845 is an unauthenticated path traversal and local file inclusion vulnerability in the /custom-sounds/ endpoint when CustomSounds storage is configured to FileSystem. An attacker can insert ../ sequences into a request path to read files outside the intended base directory. The vulnerability is rated HIGH with a CVSS score of 7.5.
🔗 Read more 🔗
Source: NVD
🎭 Microsoft Edge Origin Validation Flaw Enables Spoofing
Managed Edge environments should deploy the relevant browser update promptly, with priority given to shared workstations and users handling sensitive web applications. Browser restarts may be required to complete installation.
CVE-2026-66322 is an origin validation error in Microsoft Edge based on Chromium. An unauthorized remote attacker can exploit the flaw to perform spoofing over a network. The vulnerability is rated HIGH with a CVSS score of 7.1.
🔗 Read more 🔗
Source: NVD
💥 Microsoft Edge Type Confusion Enables Remote Code Execution
Patch Edge across user endpoints as soon as practical, prioritizing systems used for general web browsing or access to untrusted content. Remote code execution in a browser is a strong reason to accelerate deployment rather than wait for a routine update cycle.
CVE-2026-66321 is a type confusion vulnerability in Microsoft Edge based on Chromium. An unauthorized attacker can exploit incompatible resource-type handling to execute code over a network. The vulnerability is rated HIGH with a CVSS score of 7.4.
🔗 Read more 🔗
Source: NVD
🔍 Microsoft Edge Origin Validation Bug Leaks Information
Organizations should expedite Edge updates, particularly on endpoints that access confidential business applications or sensitive data. The high CVSS score and remote attack path make this more urgent than a typical information-disclosure issue.
CVE-2026-66318 is an origin validation error in Microsoft Edge based on Chromium. An unauthorized remote attacker can exploit the issue to disclose information over a network. The vulnerability is rated HIGH with a CVSS score of 8.1.
🔗 Read more 🔗
Source: NVD
🧨 Microsoft Edge Use-After-Free Enables Remote Code Execution
Security teams should push the Edge update quickly across all supported endpoints. Prioritize users exposed to untrusted websites, links, advertisements, or web-delivered documents because successful exploitation could lead to code execution.
CVE-2026-66315 is a use-after-free vulnerability in Microsoft Edge based on Chromium. An unauthorized attacker can exploit the memory-safety flaw to execute code over a network. The vulnerability is rated HIGH with a CVSS score of 7.5.
🔗 Read more 🔗
Source: NVD
📱 Microsoft Edge for Android Path Handling Leaks Local Data
Mobile-device administrators and Android Edge users should install the update promptly. Prioritize managed devices that store business data or are shared with other users, since exploitation could expose locally accessible information.
CVE-2026-66310 affects Microsoft Edge for Android and involves external control of a file name or path. An unauthorized attacker can exploit the flaw to disclose information locally on the device. The vulnerability is rated HIGH with a CVSS score of 7.7.
🔗 Read more 🔗
Source: NVD
🌐 Microsoft Edge for Android Flaw Enables Network Data Disclosure
Enterprises managing Android devices should accelerate the Edge update, especially for users who browse untrusted sites or handle sensitive information. Verify that mobile application update policies are enforcing the patched release.
CVE-2026-65802 affects Microsoft Edge for Android and stems from external control of a file name or path. An unauthorized attacker can exploit the issue to disclose information over a network. The vulnerability is rated HIGH with a CVSS score of 7.4.
🔗 Read more 🔗
Source: NVD
📊 Microsoft Excel Use-After-Free Enables Remote Code Execution
Organizations should treat this as an urgent Office patch, particularly for users who receive spreadsheets from email, collaboration platforms, or external parties. The 8.8 score and code-execution impact justify rapid deployment alongside reinforced controls for untrusted Excel files.
CVE-2026-62870 is a use-after-free vulnerability in Microsoft Office Excel. An unauthorized attacker can exploit the memory-safety issue to execute code over a network. The vulnerability is rated HIGH with a CVSS score of 8.8.
🔗 Read more 🔗
Source: NVD