VulnHub

PaperCut has released a new security maintenance update to address two significant vulnerabilities in its software that were being actively exploited. The updates are available for users of PaperCut NG/MF versions 26.0.5, 25.0.13, and 24.1.10. This move replaces earlier emergency patches that were initially issued to tackle these issues. It's crucial for users running these versions to apply the updates promptly to protect their systems from potential attacks. The vulnerabilities pose risks to the security of printing services and could allow unauthorized access or manipulation of sensitive information.

A serious vulnerability has been identified in the Orthanc DICOM Server, affecting versions prior to 1.13.0. This flaw allows an authenticated remote attacker to exploit an integer overflow when the server decodes specially crafted PNG or JPEG images, potentially leading to a crash of the Orthanc process and causing a denial-of-service condition. The issue has been assigned CVE-2026-87020 and has a high severity score of 8.1 according to the CVSS metrics. Users of Orthanc DICOM Server worldwide, particularly in healthcare sectors, are at risk and are strongly urged to update to version 1.13.0 to mitigate the threat. No active exploitation of this vulnerability has been reported so far, but organizations should remain vigilant and take appropriate defensive measures.

ST Engineering iDirect has reported multiple vulnerabilities affecting its iQ-Series terminals, specifically the Evolution, 3315, and 9-Series models running versions 4.5.2.1 or earlier. These weaknesses could allow unauthorized access to sensitive device information and lead to denial-of-service conditions. Attackers could exploit these flaws to impersonate terminals on satellite networks, launch cross-site request forgery attacks, or escalate privileges due to inadequate authentication measures. Users are strongly advised to update their systems to version 4.5.3.0 or newer to mitigate these risks, while also implementing security best practices such as restricting access to management interfaces and monitoring for unusual activity.

NextGen Healthcare's Mirth Connect software has several serious vulnerabilities that could be exploited by attackers to extract sensitive data or disrupt services. Specifically, versions 4.7.1 and earlier are affected by SQL injection and XML external entity (XXE) flaws. These vulnerabilities could allow unauthorized users to execute arbitrary SQL commands, leading to the potential exposure of stored credentials and denial-of-service conditions. NextGen Healthcare has advised users to upgrade to version 4.7.2 or later to mitigate these risks. Given that Mirth Connect is widely used in the healthcare sector, these security issues pose a significant threat to patient data integrity and system availability.

AVEVA Pipeline Integrity Monitor has several vulnerabilities that could be exploited by attackers to gain unauthorized access to sensitive information or execute arbitrary code. The affected versions include those up to 2025_SP1_P1_build_7.1.9580.8513. If exploited, these vulnerabilities could allow attackers to decrypt sensitive project files, reverse engineer user passwords, and perform unauthorized read operations. AVEVA recommends that users of the affected software apply the 2025 SP1 P2 Security Update and migrate project files to mitigate these risks. This situation is particularly concerning as it affects critical infrastructure sectors and could have significant security implications for organizations worldwide.

Google has released updates to address 230 security vulnerabilities in Chrome, including a medium-severity bug known as CVE-2026-87491. This vulnerability is an out-of-bounds issue in V8, the JavaScript and WebAssembly engine used by Chrome. Notably, it is currently being exploited in the wild, which raises concerns for users and organizations that rely on this browser. This kind of vulnerability could allow attackers to execute arbitrary code within the browser's sandbox environment, potentially leading to unauthorized access or data breaches. Users and administrators are strongly advised to update their Chrome installations to the latest version to mitigate this risk.

Adobe has issued urgent security patches for a serious vulnerability affecting Adobe Commerce and Magento Open Source, identified as CVE-2026-75650. This flaw has a maximum severity rating of 10.0 and has been actively exploited since September 4, 2026. Known as StyleSmuggler, the vulnerability allows attackers to deploy a Rust backdoor and a PHP web shell, posing significant risks to users of these platforms. Companies running affected versions need to apply the patches promptly to protect their systems from potential breaches. Failure to address this vulnerability could lead to unauthorized access and data compromise.

In September 2026, a significant cybersecurity update revealed two zero-day vulnerabilities that are currently being exploited, along with 113 other critical vulnerabilities among a total of 972 Common Vulnerabilities and Exposures (CVEs). The affected products span various platforms, and the presence of the zero-day exploits means that attackers are actively taking advantage of these security gaps. This situation poses serious risks for organizations and users, as unpatched systems may be susceptible to breaches and data theft. Companies are urged to prioritize updates and patch their systems promptly to mitigate potential attacks. The urgency is heightened by the fact that these vulnerabilities are already in the wild, making it crucial for users to stay informed and proactive about their cybersecurity measures.

N-able has released a hotfix for a serious vulnerability identified as CVE-2026-86218, which has been rated as maximum severity by the company. This vulnerability allows remote code execution, meaning that attackers could potentially gain control of affected systems without physical access. Users of N-able's software are urged to apply the hotfix immediately to protect their systems from exploitation. The urgency of this update stems from the risk of attackers leveraging this vulnerability to compromise sensitive data and disrupt operations. Timely patching is crucial for organizations relying on N-able's products to maintain their cybersecurity posture.

N-able has issued an emergency hotfix for a serious vulnerability in its N-central remote monitoring and management solution, identified as CVE-2026-86218. This flaw allows attackers to execute remote code on the server without prior authentication, making it a critical risk for managed service providers (MSPs) that use this software. The vulnerability was actively exploited in the wild, prompting N-able to act quickly. The hotfix, designated as Hotfix 4, updates N-central from version 2026.3 to 2026.3.1.14, and it is crucial for customers operating on-premises installations to apply this update immediately to protect their systems. Failure to address this vulnerability could lead to unauthorized access and control over affected servers, posing significant risks to data integrity and security.