CVE Vulnerabilities - 7 October 2026

XnView Classic may let attackers take control

CVE-2026-107125

XnView Classic version 2.52.5 has a flaw in the part that reads FLI video files. A specially crafted file can cause the program to run out of memory and allow a remote attacker to execute their own co...

2.1

Gophish may let attackers run scripts via email error messages

CVE-2026-107272

The Gophish phishing‑simulation platform can be tricked into running malicious code when a wrong or intercepted email server sends back an error. If an attacker can control or watch the email server u...

2.3

Obot may restore removed group access for up to 10 minutes

CVE-2026-105140 GHSA-929v-v9hq-5xhr

The Obot platform can mistakenly keep a user in a group they were removed from, lasting about ten minutes. This happens when the system updates group information at the same time and processes the cha...

2.3

Async Http Client may keep WebSocket connection after failed check

CVE-2026-107284 DEBIAN-CVE-2026-107284 GHSA-rwhr-j9rv-85f8 UBUNTU-CVE-2026-107284

The async-http-client library used by Java programs can continue setting up a WebSocket connection even when the security check fails. This could let unverified data be processed, potentially causing ...

3.7

AsyncHttpClient may use predictable numbers for Digest login

CVE-2026-107283 DEBIAN-CVE-2026-107283 GHSA-mfj3-87qq-382v UBUNTU-CVE-2026-107283

The AsyncHttpClient library used by Java programs creates a random value called a “cnonce” with a generator that isn’t designed for security. This makes the value easier for an attacker to guess, weak...

3.7

OpenSSH before 10.6 may allow unsafe compression

CVE-2026-106582 UBUNTU-CVE-2026-106582 DEBIAN-CVE-2026-106582 BELL-CVE-2026-106582

Older versions of OpenSSH (including OpenSSH from OpenBSD, Canonical and Debian packages) let a compression feature run when it should be disabled. This can let attackers infer or tamper with data exc...

3.7

Grafana lets other users view and delete data

CVE-2026-21727 UBUNTU-CVE-2026-21727 GHSA-p5x9-j974-rpfp BIT-grafana-2026-21727

Older versions of Grafana contain a design flaw that can let one tenant see or remove information belonging to another tenant. This could expose confidential dashboards or allow unauthorized changes. ...

3.3

OpenSSH <10.6 may read a file instead of disabling feature

CVE-2026-106587 UBUNTU-CVE-2026-106587 DEBIAN-CVE-2026-106587 BELL-CVE-2026-106587

Versions of OpenSSH prior to 10.6 treat the word "none" as if it were a filename, even though it should turn a setting off. This can cause the server to try to open or read an unintended file, potenti...

3.3

OpenSSH certificates can show wrong expiration dates

CVE-2026-106584 UBUNTU-CVE-2026-106584 DEBIAN-CVE-2026-106584 BELL-CVE-2026-106584

Versions of OpenSSH released before 10.6 may calculate certificate expiration times incorrectly because of daylight‑saving time handling. This can cause certificates to appear expired too early or rem...

3.3

CGA-8g82-jmrf-8mg8

CGA-8g82-jmrf-8mg8

3.2

CGA-6xv2-4qxq-887v

CGA-6xv2-4qxq-887v

3.2

CGA-rgjh-xpm2-4f9q

CGA-rgjh-xpm2-4f9q

3.1

Red Hat Enterprise Linux input method crash causes service outage

CVE-2026-107170 DEBIAN-CVE-2026-107170 UBUNTU-CVE-2026-107170

The m17n-lib component used in Red Hat Enterprise Linux versions 6 through 10 can crash when the system runs out of resources or the database is damaged. This crash stops applications that rely on inp...

2.9

CP Media Player lets contributors change site media settings

CVE-2026-104678

The CP Media Player plugin for WordPress, versions before 1.3.4, allows users with only contributor rights to alter the global media player setup. This could let unintended users modify how media play...

2.7

Apache YuniKorn crashes when LDAP group names are not capitalized

CVE-2026-78243

If YuniKorn is set up to read group information from an LDAP directory and the directory returns a group name that does not start with "CN=", the service stops working. This only happens in installati...

2.1

Apache YuniKorn allows queue bypass on workload update

CVE-2026-92393

In versions of Apache YuniKorn up to 1.9.0, a user can change a workload's settings without the system checking who they are or what labels are attached. This can let a user move a job into a queue th...

2.0