HPE SD-WAN Orchestrator, Ghostscript Vulnerable; Mozilla Patches Flaws

A critical vulnerability in HPE's SD-WAN Orchestrator (CVE-2026-76672) allows authenticated remote attackers with read-only privileges to access sensitive configuration information. This flaw could enable attackers to gain deeper insights into the network infrastructure, potentially leading to further exploitation. The vulnerability was detailed in reports by The Hacker News and Cyber Security News.

Mozilla has addressed a significant number of vulnerabilities across its Firefox and Thunderbird products. Multiple use-after-free flaws (e.g., CVE-2026-92056, CVE-2026-92058, CVE-2026-92060, CVE-2026-92067) impacting components like Graphics, Internationalization, and Widget have been patched in recent releases, including Firefox 156 and Thunderbird 156. Additionally, a sandbox escape in the DOM: Core & HTML component (CVE-2026-92018) was also resolved. These disclosures were covered by Vypr Intelligence.

A critical heap-based buffer overflow vulnerability in Ghostscript (CVE-2026-39919) allows attackers to cause memory corruption by providing a crafted PDF containing a JPEG 2000 image. This could lead to denial-of-service or potentially remote code execution. The vulnerability affects versions prior to 10.08.0 and was mentioned in a weekly recap by The Hacker News.

Perl's DBI component (versions before 1.653) is vulnerable to arbitrary module loading via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM (CVE-2026-78030). This allows an attacker to require and execute arbitrary Perl modules, potentially leading to code execution on the system.

An arbitrary file upload vulnerability in NivoCart (through 2.4.0) in the File Manager's multi() endpoint (CVE-2026-94104) allows attackers to upload arbitrary files by exploiting a failure to validate file extensions when the chunks parameter is 2 or higher. This could lead to code execution or system compromise.

ZTE's SmartLife app has a vulnerability (CVE-2026-86553) where authentication parameters are generated dynamically within the runtime process. Attackers can exploit this by directly calling backend interfaces using acquired authentication parameters, potentially leading to unauthorized access or control.