What you need to know today.
Critical command injection flaws in Wavlink devices and Azure Arc privilege escalation lead today's security brief.
Multiple command injection vulnerabilities have been discovered in various Wavlink device models, including WL-WN530BE1-A, WL-WN579A3-A, WN553X1-B, WN701AE, WL-WN530HG4B, and WN579X3-D. These flaws, such as CVE-2026-120198, CVE-2026-120195, CVE-2026-120231, CVE-2026-120230, CVE-2026-120228, CVE-2026-120227, CVE-2026-120197, and CVE-2026-120196, stem from improper handling of user-supplied input in functions related to network configuration, file uploads, and service management, potentially allowing remote attackers to execute arbitrary commands on the affected devices.
A critical vulnerability in Apache MINA (CVE-2026-118636) allows for deserialization of untrusted data due to the absence of a class filter in ObjectInputStream.readObject(). This could lead to remote code execution if an application places this vulnerable component before an untrusted network peer. The issue affects the Java Native Message Decoder in the MINA 3.0 codec module.
A critical authentication bypass vulnerability exists in Jpom versions 2.10.0 through 2.11.12 (CVE-2026-120201). Attackers can exploit this by injecting query conditions into the JPOM-USER-TOKEN header, granting them super-administrator access without proper authentication.
WordPress plugin FunnelKit Automations is affected by a deserialization vulnerability (CVE-2026-39738) up to version 3.8.6.1, allowing for object injection and potential remote code execution.
Microsoft has disclosed several vulnerabilities in Azure and AI services, including a critical privilege escalation flaw in Azure Arc (CVE-2026-69399). This vulnerability allows an authorized attacker to elevate privileges over a network by exploiting an unintended proxy or intermediary.
A critical vulnerability in Picketlink Federation SAML (CVE-2026-10579) allows unauthenticated attackers to forge SAML assertions and authenticate as any principal, bypassing verification and validation mechanisms.
Oray Pugongying X5 Pro devices up to version 7.6.1 are affected by two critical vulnerabilities. CVE-2026-120224 involves improper authorization due to manipulation of API parameters, while CVE-2026-120225 allows for relative path traversal in the config_restore_ex function, potentially leading to unauthorized access or modification of system files.
A use-after-free vulnerability in libsoup (CVE-2025-32911) affects the soup_message_headers_get_content_disposition() function. This flaw can lead to memory corruption in libsoup servers when a malicious HTTP client interacts with it.
PrefectUI