What you need to know today.
Strapi file upload flaw, multiple ImageMagick vulnerabilities, and Mosquitto DoS lead today's security brief.
A critical vulnerability in Strapi, CVE-2022-321114, allows for unrestricted file uploads through its asset management function. This flaw can be exploited by attackers to execute cross-site scripting (XSS) attacks by uploading a specially crafted PDF file. While the CVSS score is high, the exploitability is rated low due to the need for user interaction and specific file types. The vulnerability is present in Strapi version 4.1.12. Further details on patching or mitigation are not provided in the current information.
Multiple vulnerabilities have been identified in ImageMagick, a widely used image processing software. CVE-2026-53466 and CVE-2026-55628 present moderate risks, with the former allowing for denial of service via integer overflow in the XCF decoder and the latter enabling unauthorized file access due to missing policy checks in the concatenate operation. CVE-2026-53467, also a moderate risk, is an information disclosure vulnerability within the MNG decoder. Additionally, several low-risk CVEs (CVE-2026-55597, CVE-2026-55595, CVE-2026-55510, CVE-2026-55594, CVE-2026-55577) detail various issues including heap buffer overflows, stack overflows, use-after-free vulnerabilities, and infinite loops, stemming from improper handling of arguments and specific image formats. These issues are addressed in versions 6.9.13-51 and 7.1.2-26.
A denial-of-service vulnerability exists in Eclipse Mosquitto versions 2.0.7 and earlier (CVE-2021-34432). The server will crash if a client attempts to send a PUBLISH packet with a topic length of zero. This could be exploited by a malicious client to disrupt the MQTT broker's availability. The risk associated with this vulnerability is medium, and it is recommended to update to a patched version to mitigate this issue.
HashiCorp Vault Enterprise is affected by CVE-2026-5051, a moderate-risk vulnerability that allows for an audit device validation bypass via a legacy file audit path option. This could potentially lead to unauthorized access or manipulation of audit logs, compromising the integrity of security records. Users are advised to review their configurations and apply necessary patches or updates.
Two vulnerabilities impacting Debian systems, CVE-2026-57963 and CVE-2026-57962, have been disclosed. CVE-2026-57963 allows for arbitrary styled content injection, phishing links, and CSS manipulation in chat messages via Matrix or XMPP, affecting Thunderbird. CVE-2026-57962 involves a malicious LDAP server potentially causing memory exhaustion and crashes in Thunderbird due to large amounts of attacker-supplied data. These issues have been addressed in specific Thunderbird versions.