Upwind Security MDR

🚨 CRITICAL - Unauthenticated RCE in React Server Components (GHSA-xqc2-xf4c-x3h3) A critical vulnerability in React Server Components packages (react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel) allows unauthenticated remote attackers to execute arbitrary code via crafted RSC Flight payload responses transporting multiple typed arrays and attacker-controlled values. 👉 Affected: Versions 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0 | Upgrade immediately to 19.0.9, 19.1.10, 19.2.9, or 19.3.1 (or Next.js 16.4.1 / 15.5.28) github.com/react/react/secur…

🚨Critical - MongoDB Server Replication Use-After-Free on Primary Catch-Up (CVE-2026-118383) MongoDB Server replication can hit a use-after-free when a newly elected replica set primary completes catch-up; unauthenticated network requests can trigger the UAF and crash mongod, and in some cases achieve RCE in the server process context. Standalone mongod instances are not impacted. 👉Affected: MongoDB Server (replica set members incl. shard/config server replica sets in sharded clusters)

🚨High - Fortinet FortiAnalyzer/FortiManager SQLi via JSON-RPC (CVE-2026-126175) FortiAnalyzer/FortiManager (incl. Cloud) are vulnerable to SQL injection in the JSON-RPC API, where an authenticated attacker can send crafted JSON-RPC requests to inject SQL and pivot to unauthorized code/command execution. Only authenticated sessions are impacted. 👉Affected: FortiAnalyzer/FortiAnalyzer Cloud, FortiManager/FortiManager Cloud (multiple 7.2/7.4/7.6 releases)

🚨Critical - Intel TDX MigTD SPDM Rebind Auth Bypass (CVE-2026-61887) Intel(R) TDX Migration Trust Domain (MigTD) Ring 0 has a missing authentication step in the SPDM rebind implementation, letting a malicious hypervisor bypass rebind validation and escalate privileges + leak secrets. Adjacent attackers with low complexity can chain this to RCE without user interaction. 👉Affected: Intel(R) TDX MigTD (SPDM rebind) (versions N/A)

🚨Critical - Red Hat Quay Registry Token Audience Confusion Key Rotation Takeover (CVE-2026-123710) Red Hat Quay’s anonymous registry token flow issues tokens with a caller-controlled aud claim, which can be replayed against the service key rotation endpoint to install an approved signing key with no expiration. Quay then accepts registry tokens signed by that key for any repo, enabling private image read/write and tag replacement. 👉Affected: Red Hat Quay (quay/quay-rhel8, quay/quay-rhel9)

🚨Critical - Arista EOS S-BFD PDU Kernel Crash DoS (CVE-2026-121295) On Arista EOS configured as an S-BFD peer, an unauthenticated attacker can send a crafted S-BFD PDU to an initiator device. Malformed S-BFD processing in the kernel triggers a crash and unexpected reboot, causing remote denial of service. 👉Affected: Arista EOS (S-BFD enabled)

🚨Active campaign - 4,837 hijacked GitHub accounts used PRs to pull secrets out of CI The pull request looks like docs housekeeping - "docs: dependency audit notes" - but the diff adds a long block to an existing workflow. On the next build the runner's Actions secrets, tokens and cloud keys get collected, and where OIDC is configured that trust becomes real cloud sessions. 👉Did a docs PR touch your workflows this week? Look for branches wfx-docs / ci-check-NNNN, commits "ci: refresh build cache" or "chore: add ci helper", and runner egress to :8080/exfil

🚨High - Node.js HTTPS heap memory disclosure via TLSWrap re-entrancy (CVE-2026-123864) In Node.js node:https, a zero-byte write in TLSWrap::DoWrite() triggers ClearOut() during the HTTP parser on_body callback, re-entering llhttp_execute() and causing UAF/OOB reads. An unauthenticated client can leak heap data into HTTP responses, potentially exposing TLS private keys and other connections' request data. Cleartext node:http is not affected. 👉Affected: Node.js 22.x < 22.23.5, 24.x < 24.22.3, 26.x < 26.13.1 | Upgrade to 22.23.5 / 24.22.3 / 26.13.1

🚨High - Cockpit cockpit-ws WebSocket Fragment Memory Exhaustion DoS (CVE-2026-91150) Cockpit's cockpit-ws caps each WebSocket fragment at 128 KiB but not the total size of a reassembled message, so fragments pile up in memory without bound. A remote attacker can stream crafted fragments to exhaust memory and take the web console down. Red Hat rates it unauthenticated; upstream says login is required. 👉Affected: Cockpit < 372 | Upgrade to 372, or restrict port 9090 to trusted networks, to mitigate.

🚨High - xfsprogs xfs_admin OS Command Injection Privilege Escalation (CVE-2026-108472) The xfs_admin utility in xfsprogs does not properly validate user-supplied parameters, allowing OS command injection. A local attacker who can pass crafted arguments to xfs_admin (e.g. via sudo delegation or provisioning tools) can run arbitrary commands as the executing user, typically root. 👉Affected: xfsprogs (versions TBD) | No patched release available yet, until then keep untrusted input away from xfs_admin.

🚨HIGH - Node.js TLS Client Cert Auth Bypass via Renegotiation SNI Swap (CVE-2026-123872) Node.js TLS (TLS 1.2) allows changing servername (SNI) during renegotiation, letting a client reuse an existing mTLS-authenticated session across hostnames. Servers enforcing different client-cert policies per hostname can be bypassed to access unauthorized endpoints. TLS 1.3 is not affected. 👉Affected: Node.js 22.x < 22.23.5, 24.x < 24.22.3, 26.x < 26.13.1 | Upgrade to 22.23.5 / 24.22.3 / 26.13.1

🚨 CRITICAL - Origin Validation Flaw in FortiClient (CVE-2026-121529) Fortinet has published a critical security advisory addressing an origin validation error in the local API endpoints of FortiClient, which can allow unauthorized remote attackers to execute code via victim interaction. 👉 Affected / Remediation: Affects FortiClient Windows (7.2, 7.4), FortiClient Mac (7.4), and FortiClient Windows PAM (7.2, 7.4). Upgrade immediately to 7.4.8+ or 7.2.15+ (v8.0 releases are unaffected).

🚨 CRITICAL - Apache HTTP Server Patches mod_http2 Race Condition (CVE-2026-119618) Apache HTTP Server 2.4.71 addresses a critical race condition in mod_http2 (assign_headers()) that can corrupt heap memory and lead to Remote Code Execution, alongside fixes for CVE-2026-106023 and CVE-2026-109163. • Impact: Can cause server child process crashes, memory corruption, or lead to arbitrary code execution on servers with HTTP/2 enabled. 👉 Affected / Remediation: Affects Apache HTTP Server 2.4.55 through 2.4.70. Upgrade immediately to v2.4.71, or disable mod_http2 as a temporary mitigation.

🚨Critical - Azure Managed Grafana SSRF Privilege Escalation (CVE-2026-114160) Azure Managed Grafana is vulnerable to SSRF where crafted requests can coerce the service to fetch internal endpoints (e.g., cloud metadata/management APIs), enabling unauthorized privilege escalation over the network. High impact to confidentiality, integrity, and availability. 👉Affected: Azure Managed Grafana (service)

🚨 CRITICAL - Pre-Auth Bypass & Command Injection in Barracuda Products Barracuda has warned of two vulnerabilities in multiple products that, when chained together, can allow an attacker with administrative UI access to bypass authorization controls and achieve root access to the appliance. Active exploitation has been observed affecting a small number of organizations. • CVE-2026-116606: Pre-authentication authorization bypass affecting Email Security Gateway (ESG) administrative interfaces. • CVE-2026-111560: Post-auth command injection affecting ESG, ADC, Message Archiver, WAF, WCC, and Web Security Gateway. • Impact: Chaining both flaws against exposed admin interfaces can lead to complete root compromise of the device. 👉 Affected / Remediation: Apply vendor security patches immediately. Ensure admin interfaces are restricted from the public internet and isolated to trusted management networks.

🚨High - jsdiff parsePatch Infinite Loop + Memory Exhaustion DoS (CVE-2026-24001) In jsdiff (npm: diff), parsePatch mishandles patch filename headers containing \r/\u2028/\u2029, causing an infinite loop and unbounded memory growth until crash; applyPatch is also reachable when called with a string patch (it calls parsePatch). Crafted headers can also trigger regex-based DoS with cubic-time parsing. 👉Affected: diff (jsdiff) versions unknown

🚨High - Perl Pod::Text DoS via nested =over wrap() width=0 loop (CVE-2026-82560) Pod::Text (podlators) can be driven into an infinite loop by attacker-supplied POD with deeply nested =over directives, forcing wrap() available width to 0. The formatter then repeatedly matches an empty string while appending margin padding, causing unbounded CPU + output growth (memory exhaustion) and DoS. 👉Affected: podlators / perl (Pod::Text) versions unknown

🚨High - ASP.NET Core Algorithmic Complexity DoS (CVE-2026-109478) ASP.NET Core on .NET 8.0 is vulnerable to remote algorithmic complexity abuse, allowing unauthenticated attackers to send crafted requests that trigger excessive CPU/memory consumption and cause service-level denial of service across Linux/macOS/Windows. Visual Studio 2022 17.14 is also impacted. 👉Affected: ASP.NET Core / .NET 8.0 (Linux/macOS/Windows); Microsoft Visual Studio 2022 17.14

🚨High - Azure aznfs Privilege Escalation via Untrusted Search Path (CVE-2026-105494) Azure NFS mount helper aznfs uses unsafe search path resolution during mount operations, allowing a local authorized attacker to influence PATH/working dir to load a rogue executable/library. Exploitation can lead to privilege escalation to root. Remote attackers are not impacted. 👉Affected: aznfs (versions not specified)