What you need to know today.

ARC Informatique PcVue versions prior to 12.0.17 are affected by multiple vulnerabilities. CVE-2020-26867, a critical deserialization flaw, could allow remote code execution. CVE-2020-26869 exposes session data, enabling unauthorized access to user sessions. Additionally, CVE-2020-26868 presents a denial-of-service risk due to improper message validation. These issues, some stemming from third-party components, highlight significant risks for PcVue deployments. Updates to version 12.0.17 or later are recommended.

Several vulnerabilities have been disclosed in GNU patch and Vim. GNU patch is susceptible to NULL pointer dereferences and denial-of-service conditions when processing specially crafted patch files, as detailed in CVE-2026-56288 and CVE-2026-56289. For Vim, issues include improper handling of omni-completion scripts, potentially leading to code execution or information disclosure in CVE-2026-59856, CVE-2026-59858, and CVE-2026-59857. Users should update to the latest versions to mitigate these risks.

EMC RecoverPoint systems, including versions prior to 5.0 for the base product and virtual machine variants, are impacted by several security flaws. CVE-2016-6650 is an SSL stripping vulnerability that could lead to system compromise. Command injection vulnerabilities, detailed in CVE-2016-6649, allow privilege escalation for administrators. Furthermore, CVE-2016-6648 points to sensitive information disclosure due to incorrect file permissions. Patches and updates are advised for affected versions.

Older versions of ARC Informatique PcVue (6.0 through 10.0), FrontVue, and PlantVue are vulnerable due to unspecified ActiveX controls. CVE-2011-4044 and CVE-2011-4042 could allow remote attackers to modify files or execute arbitrary code, respectively. CVE-2011-4043 presents an integer overflow leading to potential code execution, while CVE-2011-4045 describes a buffer overflow causing denial of service. These ActiveX-related issues require careful review and mitigation strategies for legacy systems.

The Python programming language is affected by CVE-2026-15308, a CPU denial-of-service vulnerability within its HTML parser. This flaw can be triggered by repeated unterminated markup declarations, potentially impacting applications relying on this parsing functionality. Additionally, the guardrails-detectors library has a vulnerability (CVE-2026-15378) that allows for Server-Side Request Forgery (SSRF) and local file reads through user-supplied XML Schema. Users should ensure their Python environments and related libraries are up to date.