What you need to know today.

ModProxy Cluster's cluster-proxy component suffers from an impersonation header injection vulnerability in its service-proxy, granting cluster-admin privileges on all managed clusters. This flaw, tracked as CVE-2026-17107, allows a low-privileged attacker to escalate their access within the cluster environment, potentially leading to full compromise. Organizations utilizing ModProxy Cluster should prioritize patching or applying mitigations as soon as they become available to prevent unauthorized administrative control.

Oracle E-Business Suite's Oracle HRMS (France) component (versions 12.1.1-12.1.3) is affected by CVE-2021-2316, a vulnerability that allows a low-privileged attacker with network access to compromise the system. While the specific impact is not detailed, vulnerabilities in enterprise resource planning systems often carry significant risks due to the sensitive data they manage. Prompt patching is advised for all affected Oracle E-Business Suite installations.

The auth0/node-jws library, a JSON Web Signature implementation for Node.js, has a vulnerability in versions 3.2.2 and earlier, as well as version 4.0.0. Tracked as CVE-2025-65945, this improper signature verification flaw, particularly when using the HS256 algorithm under specific conditions, could allow attackers to bypass signature checks. Developers using this library should update to a patched version to ensure the integrity of their signed data.

A critical security flaw in TOTOLINK X2000R routers, up to version 2.0.0, allows for the use of default credentials due to a vulnerability in the /etc/shadow.sample file within the administrative interface. This is tracked as CVE-2025-9577. Such a vulnerability can lead to unauthorized access and control of the router, posing a significant risk to network security, especially for small businesses and home users. Administrators should change default credentials and update router firmware.

Several vulnerabilities have been identified across various Linux kernel subsystems, including issues in LoongArch CPU reporting (CVE-2026-64250), batman-adv network mesh (CVE-2026-64218), i2c device drivers (CVE-2026-64236), hwmon sensor monitoring (CVE-2026-64213), regulator drivers (CVE-2026-64230), mlx5e network drivers (CVE-2026-64210), and USB gadget drivers (CVE-2026-64233). Additionally, a use-after-free vulnerability exists in the pwrseq core (CVE-2026-64251), and a NULL pointer dereference could occur in the msm/a6xx graphics driver (CVE-2026-64215). While many of these have low risk scores, they collectively highlight the ongoing need for diligent kernel patching and security maintenance.

Debian systems are affected by multiple vulnerabilities. open62541, a client library, has a flaw in its responseReadNamespacesArray function (CVE-2026-15690) that could be triggered by manipulated arguments. The gdk-pixbuf component can suffer an out-of-bounds read when parsing specially crafted ICO files (CVE-2026-16768). GNU coreutils' uniq command is vulnerable to an out-of-bounds read when handling multibyte input with the -w option (CVE-2026-56391). These issues underscore the importance of timely security updates for Debian distributions.

Knot DNS versions before 3.4.10 and 3.5.x before 3.5.4 contain a vulnerability in mod-onlinesign (CVE-2026-39155) where incorrect computation of NSEC owner names can lead to overly broad authenticated denial intervals. This could impact DNSSEC validation. Users of Knot DNS should update to patched versions to maintain DNS security and integrity.

Ntpsec's gpsprof utility contains a code injection vulnerability (CVE-2026-60122) that allows attackers controlling GPS input data to execute arbitrary OS commands. This is a serious risk for systems relying on Ntpsec for time synchronization, as it could lead to system compromise. Prompt patching is essential.

The brace-expansion utility through version 5.0.7 is vulnerable to denial of service via memory exhaustion (CVE-2026-14257). While not leading to code execution, a successful DoS attack could render services unavailable. Developers should ensure they are using a version that addresses this memory exhaustion issue.

Quinnware's QUIC transport protocol implementation, quinn, versions 0.1.0 to 0.11.15, has a flaw in its Assembler component related to handling unordered stream fragments (CVE-2026-25800). The exact impact requires further investigation, but issues in transport layer implementations can have broad security implications. Users should update to a version that resolves this.