What you need to know today.

Rockwell Automation's 1715-AENTR EtherNet/IP Adapter is affected by a critical vulnerability (CVE-2026-10577) that exposes an unauthenticated, network-accessible debug port. This flaw allows remote attackers to gain intrusive command-line access, potentially leading to system compromise. The vulnerability carries a CVSS score of 10.0 and is rated as high risk. CISA has issued an ICS advisory detailing the issue and its implications for industrial control systems.

A decades-old vulnerability in Cisco IOS, CVE-2008-4128, has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. This critical cross-site request forgery (CSRF) flaw affects the HTTP Administration component on Cisco 871 Integrated Services Routers. Attackers can exploit it by tricking authenticated users into clicking malicious links, allowing them to execute arbitrary commands with the user's privileges. This vulnerability, despite its age, is reportedly being actively exploited, prompting warnings from CISA and international partners about Russian state-sponsored cyberattacks targeting network devices.

Multiple vulnerabilities have been disclosed in zlib, a widely used data compression library. CVE-2016-9841, CVE-2016-9840, and CVE-2016-9842, all rated as high severity, involve improper pointer arithmetic and issues with left shifts of negative integers, potentially leading to unspecified impacts. Node.js versions prior to 4.8.5, 6.11.5, and 8.8.0 are affected by CVE-2017-14919, a denial-of-service vulnerability stemming from changes in the zlib module's windowBits parameter handling. These flaws highlight the importance of keeping software dependencies updated, as vulnerabilities in core libraries can have far-reaching consequences.

Several high-severity vulnerabilities have been identified in Kemp LoadMaster (CVE-2014-5287) and SMA Solar Technology devices (CVE-2019-13529). The Kemp LoadMaster flaw is a Bash script injection vulnerability due to insufficient input sanitization in its Web User Interface, while the SMA Sunny WebBox vulnerability allows authenticated attackers to perform actions with user privileges via malicious links. These issues underscore the need for diligent patching and secure configuration of network appliances and edge devices, which often serve as critical entry points for attackers.

A series of vulnerabilities have been found in gawk, the GNU awk utility, affecting various aspects of its functionality. CVE-2026-40467, CVE-2026-40468, and CVE-2026-40469 relate to use-after-free, integer overflows, and heap metadata corruption, potentially leading to crashes or information disclosure. Additionally, CVE-2026-40553 describes a buffer overflow in the ftype routine that could lead to code execution. These vulnerabilities, detailed in a Rapid7 advisory, emphasize the ongoing need to secure command-line utilities and scripting languages, as they are frequently targeted in supply chain attacks and system compromise scenarios.

U-Boot, a common bootloader, has several vulnerabilities including integer underflow (CVE-2026-29008), buffer overflow (CVE-2026-29009), and out-of-bounds read (CVE-2026-29007) issues. These flaws, affecting versions up to 2026.04-rc3, can be exploited by network-adjacent attackers or malicious NFS servers to crash the bootloader or potentially gain code execution. The vulnerabilities highlight the critical security posture of bootloaders, as compromising them can undermine the entire system's integrity.

Two SQL injection vulnerabilities (CVE-2026-39178 and CVE-2026-39179) have been discovered in SOGo versions prior to 5.12.7. These flaws allow authenticated users to execute arbitrary SQL statements through the search functionality or password change feature, potentially leading to data breaches or unauthorized modifications. This serves as a reminder for organizations to regularly update web applications and review access controls to prevent credential abuse and data exfiltration.