📂 AWX Archive Extraction Path Traversal
AWX operators should patch quickly and review the sources of project archives. Avoid processing untrusted archives until fixes are applied.
CVE-2026-71364 is a HIGH severity path traversal vulnerability in AWX project archive extraction. Malicious archives can write files outside the intended project directory, potentially leading to remote code execution. The CVSS score is 7.2.
🔗 Read more 🔗
Source: NVD
🧩 HCL Hive Third-Party Component Vulnerability
HCL Hive administrators should update affected components and review dependency versions. Prioritize deployments exposed to untrusted users or networks.
CVE-2026-21752 is a HIGH severity vulnerability in HCL Hive caused by vulnerable third-party components. Exploiting affected components could allow unauthorized access or compromise of the system. The CVSS score is 7.5.
🔗 Read more 🔗
Source: NVD
🖼️ GIMP PCX Plugin Memory Corruption Bug
Users running affected GIMP 32-bit builds should apply available fixes and be cautious with untrusted PCX files. Prioritize systems that regularly process external images.
CVE-2026-78465 is a HIGH severity vulnerability in the file-pcx plugin in GIMP affecting 32-bit builds only. A crafted PCX image can trigger an integer overflow that leads to a heap-based buffer overflow, potentially causing arbitrary code execution or denial of service. The CVSS score is 7.0.
🔗 Read more 🔗
Source: NVD
🚨 rConfig Authentication Bypass Creates Admin Accounts
rConfig administrators should patch immediately because unauthenticated administrative access is a severe exposure. Review privileged accounts after updating.
CVE-2026-77915 is a CRITICAL vulnerability in rConfig 8.0.0 before 8.2.13 that allows unauthenticated attackers to create accounts with Administrator privileges. The flaw can expose stored device credentials, user data, and API token issuance. The CVSS score is 9.8.
🔗 Read more 🔗
Source: NVD
🔐 NetworkManager WPA-Enterprise Validation Flaw
Linux systems using WPA-Enterprise should be patched quickly, especially managed endpoints. Prioritize devices connecting to wireless networks where rogue access points are a concern.
CVE-2026-19685 is a CRITICAL vulnerability in NetworkManager involving incomplete application of private_user restrictions for 802.1X CA path properties. An unprivileged local user can redirect certificate validation to an attacker-controlled directory, enabling credential theft through a rogue access point. The CVSS score is 9.8.
🔗 Read more 🔗
Source: NVD
⚡ Microchip SAMA5D4 Fault Injection Weakness
Teams using SAMA5D4 should review vendor guidance and apply available mitigations. Prioritize devices that rely on hardware protections for sensitive operations.
CVE-2026-18349 is a HIGH severity vulnerability in Microchip SAMA5D4 caused by improper protection against voltage and clock glitches. The issue allows hardware fault injection attacks against affected SAMA5D4 devices. The CVSS score is 7.3.
🔗 Read more 🔗
Source: NVD
🔑 Mesh Firmware Key Exposure Affects Deco Devices
Users of affected Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6 devices should apply available firmware updates. Treat local network access as a potential attack path until patched.
CVE-2026-15469 is a HIGH severity vulnerability affecting the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A hard-coded RSA-512 shared private key can allow an adjacent attacker with firmware access to impersonate a trusted mesh node. The CVSS score is 7.7.
🔗 Read more 🔗
Source: NVD
🌐 Netis NC63 Buffer Overflow Enables Root Access
Netis NC63 administrators should patch or otherwise reduce exposure as soon as possible. Internet-facing devices are at particular risk from unauthenticated remote attacks.
CVE-2026-76071 is a CRITICAL stack-based buffer overflow vulnerability in Netis NC63 firmware through V3.0.0.3327. Unauthenticated remote attackers can exploit the ipFilterList action to achieve remote code execution with root privileges. The CVSS score is 9.8.
🔗 Read more 🔗
Source: NVD
🔓 Netis Login Handler Overflow Allows Root Takeover
Affected Netis NC63 devices should be updated quickly and monitored for signs of compromise. Devices exposed to remote access should receive priority.
CVE-2026-76070 is a CRITICAL stack-based buffer overflow vulnerability in Netis NC63 firmware through V3.0.0.3327. An attacker can exploit an oversized Base64-encoded password to execute code with root privileges. The CVSS score is 9.8.
🔗 Read more 🔗
Source: NVD
🔁 AWX SSRF Exposes Internal Services and Credentials
AWX administrators should patch promptly and review notification templates for unexpected targets. Check notification configurations for exposed credentials after remediation.
CVE-2026-71366 is a HIGH severity SSRF vulnerability affecting multiple AWX notification backends including webhook, Mattermost, Rocket.Chat, and Grafana integrations. The flaw can allow notification administrators to send requests to internal services and expose notification credentials. The CVSS score is 7.7.
🔗 Read more 🔗
Source: NVD
🖥️ Zephyr Virtio Driver Control Flow Hijack Risk
Organizations using Zephyr with virtio PCI or MMIO transports should patch promptly. Prioritize environments with untrusted or externally controlled virtio backends.
CVE-2026-13212 is a HIGH severity vulnerability in the Zephyr virtio driver caused by missing validation of descriptor-chain head identifiers. A malicious virtio backend can trigger out-of-bounds reads and attacker-influenced function-pointer calls in the guest. The CVSS score is 8.8.
🔗 Read more 🔗
Source: NVD
🧵 OpenThread MLE Packet Handling Disruption
OpenThread deployments should apply available fixes quickly, especially in shared network environments. Review Thread network access controls while remediation is underway.
CVE-2025-36939 is a CRITICAL vulnerability in OpenThread handling of MLE packets. An authenticated attacker on the same Thread network can send crafted packets that trigger denial of service through assertion failures and a stack-based buffer overflow. The CVSS score is 10.0.
🔗 Read more 🔗
Source: NVD