🧨 Brace Expansion Bypass Enables Memory Exhaustion
Teams using brace-expansion with untrusted input should upgrade promptly, especially in public-facing Node.js services where a denial-of-service condition could disrupt availability.
CVE-2026-69152 affects the brace-expansion library and allows attacker-controlled input to exhaust memory or block the event loop because maxLength is not enforced during construction of certain intermediate arrays and padded sequences. The flaw bypasses the fix for CVE-2026-14257 and is rated HIGH with CVSS 7.5. It is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
🔗 Read more 🔗
Source: NVD
🌐 Angular i18n Flaw Turns Translations into JavaScript
Angular teams that import translations from external vendors, community contributors, or other lower-trust sources should patch urgently and review translation-file controls.
CVE-2026-69151 affects the Angular compiler i18n pipeline, which permits i18n-onerror and other i18n-on event-handler attributes in lower-trust translation files. A malicious translation can replace a static handler with executable JavaScript. The vulnerability is rated HIGH with CVSS 7.6 and is fixed in Angular 20.3.27, 21.2.19, and 22.0.1.
🔗 Read more 🔗
Source: NVD
🕸️ Angular Server Rendering Exposes High-Severity XSS
Organizations running Angular server-side rendering should prioritize the update, particularly where attacker-controlled content can reach rendered HTML.
CVE-2026-69149 is a Cross-Site Scripting vulnerability in the domino DOM emulation dependency used by @angular/platform-server. The issue occurs when serializing fallback raw-content elements such as iframe, noembed, noframes, and noscript. It is rated HIGH with CVSS 8.6 and is fixed in Angular 20.3.27, 21.2.19, and 22.0.7.
🔗 Read more 🔗
Source: NVD
🔀 Angular Cache-Key Collision Can Return the Wrong Data
Patch Angular applications using server-side rendering or transfer caching quickly, especially when responses contain user-specific, authorization-sensitive, or confidential data.
CVE-2026-68945 affects Angular HttpTransferCache, which comma-joins repeated request parameters when generating transfer-cache keys. Semantically different HttpClient requests can therefore collide and reuse an incorrect backend response. The vulnerability is rated HIGH with CVSS 8.8 and is fixed in versions 20.3.27, 21.2.19, and 22.0.2.
🔗 Read more 🔗
Source: NVD
🔓 OpenEMR OAuth Flow Bypasses Multi-Factor Authentication
OpenEMR administrators should treat this as urgent because compromised or reused credentials may be enough to defeat enforced MFA and access sensitive healthcare APIs.
CVE-2026-67611 affects OpenEMR through 8.2.0 and allows attackers with valid credentials to bypass multi-factor authentication. An attacker can register an OAuth2 client through an unauthenticated endpoint and use the password grant to exchange credentials for an API access token outside the normal web authentication flow. The vulnerability is rated HIGH with CVSS 8.1.
🔗 Read more 🔗
Source: NVD
🏥 OpenEMR Client Registration Risks Broad FHIR Exposure
OpenEMR operators should patch promptly and scrutinize pending or recently approved OAuth2 clients, since administrator approval can turn this flaw into system-wide patient-data exposure.
CVE-2026-67610 affects OpenEMR through 8.2.0 and permits unauthenticated registration of a malicious OAuth2 client requesting system-level FHIR scopes. If an administrator approves the client, the attacker can use a self-generated RSA keypair and client_credentials grant to obtain tokens with read access to all FHIR resources across all patients. The vulnerability is rated HIGH with CVSS 8.1.
🔗 Read more 🔗
Source: NVD
💉 Krayin CRM Leads Grid Vulnerable to Blind SQL Injection
Krayin CRM administrators should upgrade immediately and review accounts with leads access, as even a relatively limited authenticated user may extract the full database.
CVE-2026-41453 affects Krayin CRM before 2.2.4 and allows authenticated users with leads access to inject arbitrary SQL through the rotten_lead[in] parameter. The value is concatenated into a HAVING clause without parameterized binding, enabling time-based or boolean-based extraction of database contents. The flaw is rated HIGH with CVSS 8.8 and can expose credential hashes, CRM records, and configuration data.
🔗 Read more 🔗
Source: NVD
🚨 Krayin CRM Flaw Lets Attackers Seize the Admin Account
Any exposed Krayin CRM 2.2.4 instance requires immediate remediation. Administrators should also inspect account changes, installer-related requests, and access logs for signs of takeover.
CVE-2026-41452 affects Krayin CRM 2.2.4 and allows unauthenticated remote attackers to overwrite the primary administrator account. A crafted request can bypass installer middleware and submit arbitrary administrator name, email, and password values to the admin-config-setup endpoint. The vulnerability is rated CRITICAL with CVSS 9.8 and can provide full access to all CRM data.
🔗 Read more 🔗
Source: NVD
⚠️ OpenEMR Category Tree Chain Enables Remote Code Execution
OpenEMR deployments should patch immediately and investigate for database schema changes, malicious category records, or unexpected web-server processes. Compromise of an administrator account can become full server compromise.
CVE-2026-39932 affects OpenEMR through 8.2.0 and enables remote code execution through the document category tree component. An authenticated administrator can alter database structures and insert a PHP payload that is later executed by an unsanitized eval() call when CategoryTree is instantiated. The vulnerability is rated CRITICAL with CVSS 9.1 and results in command execution as the web server user.
🔗 Read more 🔗
Source: NVD
🧩 Malicious Ghidra Projects Can Launch Arbitrary Binaries
Reverse engineers and malware analysts should patch Ghidra and avoid opening untrusted project files until remediated, since exploitation runs code with the analyst’s account privileges.
CVE-2026-18718 affects Ghidra’s Swift demangler analyzer and allows arbitrary code execution when a victim opens a malicious project. A crafted project can restore an attacker-controlled Swift tool directory, after which Ghidra executes the resolved binary without integrity verification or user confirmation. The vulnerability is rated HIGH with CVSS 7.0.
🔗 Read more 🔗
Source: NVD
📡 Public Wavlink Exploit Targets Router Upload Handler
Owners and operators of affected Wavlink devices should apply vendor firmware fixes immediately or remove the management interface from internet exposure. Public exploit availability substantially raises the urgency.
CVE-2026-18607 affects multiple Wavlink router and networking-device models through firmware dated 20260609. A remotely supplied HTTP_COOKIE value can trigger a stack-based buffer overflow in the lighttpd upload.cgi handler through an unsafe strcpy operation. The vulnerability is rated HIGH with CVSS 8.8, and exploit details have been publicly disclosed and may be used.
🔗 Read more 🔗
Source: NVD
🖥️ Razer Update Service Flaw Enables Local Privilege Abuse
Organizations with Razer software on shared, managed, or high-value Windows systems should update promptly. The flaw requires local access, but public exploit availability makes it relevant for privilege-escalation chains.
CVE-2026-18606 affects Razer RzUpdateService 1.10.14.0 and involves improper privilege management in the service’s named-pipe handler. A local attacker can manipulate lpThreadParameter to abuse the privileged update service. The vulnerability is rated HIGH with CVSS 7.8, and a public exploit is available.
🔗 Read more 🔗
Source: NVD