Briefs

Multiple vulnerabilities in Microsoft Edge and Microsoft Edge for Android can allow an attacker to perform privilege escalation, cause a data breach, and bypass security policies.

Multiple vulnerabilities in Centreon products allow for remote code execution, SQL injection, and cross-site scripting.

Multiple vulnerabilities in Schneider Electric products can allow an attacker to perform privilege escalation, data confidentiality breaches, and data integrity breaches.

Multiple vulnerabilities in Apple products could allow an attacker to execute arbitrary code, escalate privileges, and compromise data confidentiality.

Multiple vulnerabilities in Axis products allow remote arbitrary code execution and privilege escalation in Axis OS versions 12.10.x prior to 12.10.37 and 12.9.x prior to 12.9.33 for Active Track.

A vulnerability in CPython, tracked as CVE-2026-7210, allows an attacker to bypass the security policy, requiring the latest security patch for mitigation.

Multiple reflected cross-site scripting (XSS) vulnerabilities exist in LibreNMS versions 25.12.0 to before 26.3.0, allowing an attacker to inject malicious code into a user's browser session.

A security policy bypass vulnerability exists in Traefik versions prior to v2.11.46, v3.6.x before v3.6.17, and v3.7.x before v3.7.1, allowing attackers to potentially circumvent intended access controls.

A remote, authenticated attacker can exploit multiple vulnerabilities in OPNsense to execute arbitrary code with administrator privileges.

A remote, authenticated attacker can exploit multiple vulnerabilities in Siemens SIMATIC S7 PLCs Web Server to perform cross-site scripting attacks, potentially leading to information disclosure or further unauthorized actions.

A remote, anonymous attacker can exploit a vulnerability in Siemens SIPROTEC 5 devices to disclose sensitive information.

The Shai-Hulud malware was used in a large-scale software supply-chain attack compromising hundreds of packages across open-source software ecosystems by compromising developer secrets and CI/CD pipelines.

CVE-2026-33893 describes a vulnerability in Siemens Teamcenter where hardcoded keys used for obfuscation are stored directly within the application, potentially allowing an attacker to obtain these keys and gain unauthorized access.

ROS# versions prior to V2.2.2 are vulnerable to path traversal (CVE-2026-41551) due to insufficient sanitization of user input, potentially enabling remote attackers to read arbitrary files.

Multiple vulnerabilities in dnsmasq could allow an attacker to cause a denial of service, execute arbitrary code with root privileges, disclose sensitive information, manipulate data, and redirect users to malicious domains.

CVE-2026-6001 is an authorization bypass vulnerability in ABIS Technology Ltd. Co. BAPSİS before version 202604152042, allowing exploitation of trusted identifiers through a user-controlled key.

A stack-based overflow vulnerability in Solid Edge SE2026 (versions prior to V226.0 Update 5) allows for arbitrary code execution via specially crafted PAR files.

Solid Edge SE2026 is vulnerable to uninitialized pointer access while parsing specially crafted PAR files, potentially leading to arbitrary code execution in the context of the current process (CVE-2026-44411).

CVE-2026-25789 describes a vulnerability where affected devices do not properly validate and sanitize filenames on the Firmware Update page, potentially allowing a remote attacker to execute malicious JavaScript in the context of the user's session through social engineering, leading to session hijacking or credential theft.

Siemens SIMATIC CN 4100 versions before V5.0 are vulnerable to resource exhaustion due to processing a high volume of TCP SYN packets, leading to a denial-of-service condition.

CVE-2025-40947 describes a vulnerability in Siemens RUGGEDCOM ROX devices that allows authenticated remote attackers to inject arbitrary commands via a maliciously crafted feature key, resulting in remote code execution with root privileges.

CVE-2025-40946 describes a vulnerability in KACO new energy blueplanet products where a weak CRC16-based algorithm for generating Technical Service credentials could allow an attacker to derive the credentials from the device's serial number and misuse them to gain unauthorized access.

A null pointer dereference vulnerability exists in affected devices while processing specially crafted IPv4 requests, potentially allowing a remote attacker to cause a denial of service, requiring a manual restart to recover the system.

Siemens SIMATIC CN 4100 versions before V5.0 are vulnerable to resource exhaustion due to improper restriction of unauthenticated connections, potentially leading to disruption of operations and unauthorized actions.

CVE-2025-6577 is a critical SQL injection vulnerability affecting Akilli Commerce E-Commerce Website versions before 4.5.001, potentially allowing unauthenticated attackers to execute arbitrary SQL commands.

An authenticated remote command injection vulnerability exists in the web UI scheduler functionality of multiple RUGGEDCOM ROX devices before V2.17.1, allowing arbitrary command execution with root privileges.

A remote, anonymous attacker can exploit a vulnerability in CODESYS Modbus to perform a denial of service attack.

Multiple vulnerabilities in pgAdmin could allow an attacker to escalate privileges, execute arbitrary code, bypass security measures, perform SQL injection and cross-site scripting attacks, manipulate data, or disclose sensitive information.

Multiple vulnerabilities exist in Apple macOS Sonoma, macOS Sequoia, and macOS Tahoe that could allow an attacker to elevate privileges, conduct a denial-of-service attack, disclose information, execute arbitrary code, and bypass security measures.

A local attacker can exploit multiple vulnerabilities in ImageMagick to perform a denial of service attack or affect confidentiality, availability, and integrity.