🗑️ Network-AI Backup Prune Arbitrary File Deletion
Anyone running Network-AI backup management should upgrade to 5.12.2 promptly. The flaw can cause destructive data loss if an attacker can tamper with backup manifests.
CVE-2026-58484 affects Network-AI prior to version 5.12.2 and carries a CVSS score of 7.1. The backup pruning logic trusted a manifest path value, allowing a crafted backup manifest to trigger recursive deletion of arbitrary filesystem paths accessible to the process. The issue is fixed in version 5.12.2 by recomputing the deletion path and enforcing directory containment checks.
🔗 Read more 🔗
Source: NVD
⚠️ xrdp DoS Bug Enables CPU Exhaustion
Organizations exposing xrdp should prioritize upgrading to 0.10.6.1. Internet-facing deployments are especially exposed to remote denial-of-service attacks.
CVE-2026-54538 affects xrdp versions 0.10.6 and earlier and has a CVSS score of 7.5. Improper validation of the RDP control header totalLength field allows an unauthenticated remote attacker to force the service into an infinite CPU-bound loop, causing denial of service and potential resource exhaustion. The vulnerability is fixed in version 0.10.6.1.
🔗 Read more 🔗
Source: NVD
🚨 Network-AI Sandbox Bypass Leads to Command Execution
This is a critical upgrade for all Network-AI deployments using the sandbox. Update immediately and review overly broad command allowlist entries such as ‘git *’ or ‘node *’.
CVE-2026-54051 affects Network-AI prior to version 5.9.1 and is rated CVSS 9.9. The sandbox command allowlist could be bypassed because permitted command strings were executed through ‘/bin/sh -c’, enabling shell metacharacter injection and arbitrary command execution. Version 5.9.1 removes shell invocation and strengthens command validation.
🔗 Read more 🔗
Source: NVD
🔓 Network-AI MCP Server Authentication Bypass
Users running the MCP SSE server should upgrade quickly, especially if developers access untrusted websites. Default configurations are the most at risk.
CVE-2026-46701 affects Network-AI prior to version 5.4.5 and has a CVSS score of 7.6. A default empty secret combined with permissive CORS allowed unauthenticated cross-origin requests to invoke exposed MCP tools against default localhost deployments. The issue is resolved in version 5.4.5.
🔗 Read more 🔗
Source: NVD
📱 WhatsApp MCP Server Exposes Files and Messaging
Anyone using WhatsApp MCP Server should upgrade immediately. If patching is delayed, restrict access to the bridge and avoid running it alongside untrusted local software.
CVE-2026-46555 affects WhatsApp MCP Server prior to version 0.2.1 and carries a CVSS score of 7.7. Missing authentication, absent Host header validation, and unrestricted media_path handling could allow unauthorized message sending, arbitrary file exfiltration, and DNS rebinding attacks. Version 0.2.1 introduces authentication, Host validation, and path restrictions.
🔗 Read more 🔗
Source: NVD
💥 xrdp Heap Overflow Risks Remote Code Execution
Administrators running xrdp should patch without delay, particularly on systems accessible by remote users. Successful exploitation could lead to code execution under the xrdp service account.
CVE-2026-44178 affects xrdp versions 0.10.6 and earlier with a CVSS score of 8.8. A heap-based buffer overflow in virtual channel forwarding allows an authenticated remote attacker to corrupt memory, potentially causing denial of service or arbitrary code execution. The issue is fixed in version 0.10.6.1.
🔗 Read more 🔗
Source: NVD
🖥️ xrdp Integer Overflow Leaks Heap Memory
Patch xrdp if you use the vnc-any connection mode. The update closes a remotely triggerable memory handling issue.
CVE-2026-41521 affects xrdp versions 0.10.6 and earlier and has a CVSS score of 8.2. An integer overflow while processing VNC screen updates can result in an undersized allocation followed by out-of-bounds reads, enabling information disclosure or denial of service. Version 0.10.6.1 fixes the flaw.
🔗 Read more 🔗
Source: NVD
⚡ eGroupWare Template Upload Enables OS Command Execution
Organizations using egroupware should remediate quickly, especially where administrator accounts are widely delegated. Treat this as a high-impact privilege escalation issue.
CVE-2026-40187 affects egroupware version 26.0 and earlier with a CVSS score of 8.6. An authenticated administrator can upload a malicious eTemplate file that reaches a PHP eval call where unescaped backticks enable execution of operating system commands. The vulnerability allows escalation from application administration to server-level code execution.
🔗 Read more 🔗
Source: NVD
🛢️ syslog-ng SQL Injection in Optional SQL Driver
Patch if you use the SQL driver with untrusted log sources. Installations that never enabled the SQL module have significantly lower exposure.
CVE-2026-39879 affects syslog-ng before 4.12 and has a CVSS score of 7.1. Missing sanitization in the SQL driver can allow SQL injection when processing untrusted input, although the vulnerable component is not enabled by default. Fixes are available in syslog-ng 4.12, Premium Edition 8.2, and Store Box 7.8.
🔗 Read more 🔗
Source: NVD
🎓 Frappe LMS Payment Validation Bypass
Education platforms using Frappe LMS should update to 2.52.0. The flaw directly impacts paid course enrollment controls.
CVE-2026-39385 affects Frappe LMS version 2.51.0 and earlier with a CVSS score of 7.1. Users could bypass course payment validation by enrolling through an unrelated batch. The issue is fixed in version 2.52.0 by validating that the batch belongs to the selected course.
🔗 Read more 🔗
Source: NVD
🖼️ libvips TIFF Parsing Buffer Overflow
Applications processing untrusted TIFF images with libvips should update to 8.18.2. Image processing services are the highest priority for patching.
CVE-2026-35591 affects libvips versions before and including 8.18.1 and has a CVSS score of 7.0. Incorrect channel counting for JPEG or JPEG2000 tiles embedded in TIFF images can result in a buffer overflow during image processing. The vulnerability is patched in version 8.18.2.
🔗 Read more 🔗
Source: NVD
🔥 Piwigo Installer Critical PHP Code Injection
Patch immediately if any Piwigo installer is reachable. This is a critical unauthenticated code execution vulnerability with severe server compromise potential.
CVE-2026-35048 affects Piwigo versions 16.3.0 and earlier and is rated CVSS 9.8. The installer writes unsanitized database configuration values into a PHP configuration file, allowing an unauthenticated attacker to inject arbitrary PHP code that executes on every page load. The issue is particularly exposed on PHP 8+ due to obsolete protection logic.
🔗 Read more 🔗
Source: NVD