<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>NCSC-FI vulnerabilities summary 2026-03-24</title><link>https://ncsc.fi</link><description>NCSC-FI vuln stream</description><atom:link href="https://www.kyberturvallisuuskeskus.fi/sites/default/files/rss/vulns.xml" rel="self"></atom:link><language>en-us</language><lastBuildDate>Wed, 25 Mar 2026 05:00:19 +0200</lastBuildDate><item><title>Chrome Stable Channel Update for Desktop</title><link>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html</link><description><![CDATA[ Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: CVE-2026-4673, CVE-2026-4674, CVE-2026-4675, CVE-2026-4676, CVE-2026-4677, CVE-2026-4678, CVE-2026-4679, CVE-2026-4680, Summary: The Stable channel has been updated to 146.0.7680.164/165 for Windows/Mac  and 146.0.7680.164 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log  ]]></description><pubDate>Wed, 25 Mar 2026 05:00:06 +0200</pubDate><guid>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html</guid></item><item><title>IDrive for Windows contains local privilege escalation vulnerability</title><link>https://kb.cert.org/vuls/id/330121</link><description><![CDATA[ Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-1995, Summary: The IDrive Cloud Backup Client for Windows, versions 7.0.0.63 and earlier, contains a privilege escalation vulnerability that allows any authenticated user to run arbitrary executables with NT AUTHORITY\SYSTEM permissions.  ]]></description><pubDate>Wed, 25 Mar 2026 05:00:07 +0200</pubDate><guid>https://kb.cert.org/vuls/id/330121</guid></item><item><title>Vulnerabilities in Langflow</title><link>https://github.com/langflow-ai/langflow/security/advisories/GHSA-ph9w-r52h-28p7</link><description><![CDATA[ Classification: Severe, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 9.9, CVEs: CVE-2026-33497, CVE-2026-33484, CVE-2026-33475, CVE-2026-33309, Summary: CVE-2026-33497 (CVSS: 8.7): Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across directories. Version 1.7.1 contains a patch.

CVE-2026-33484 (CVSS: 7.5): In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flow_id and file_name returns the image with HTTP 200. In a multi-tenant deployment, any attacker who can discover or guess a `flow_id` (UUIDs can be leaked through other API responses) can download any user's uploaded images without credentials. Version 1.9.0 contains a patch.

CVE-2026-33475 (CVSS: 9.1): An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of GitHub context variables (e.g., `${{ github.head_ref }}`) in `run:` steps allows attackers to inject and execute arbitrary shell commands via a malicious branch name or pull request title. This can lead to secret exfiltration (e.g., `GITHUB_TOKEN`), infrastructure manipulation, or supply chain compromise during CI/CD execution.

CVE-2026-33309 (CVSS: 9.9): Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (External Control of File Name), leading to the root architectural issue within `LocalStorageService` remaining unresolved. Because the underlying storage layer lacks boundary containment checks, the system relies entirely on the HTTP-layer `ValidatedFileName` dependency. This defense-in-depth failure leaves the `POST /api/v2/files/` endpoint vulnerable to Arbitrary File Write. The multipart upload filename bypasses the path-parameter guard, allowing authenticated attackers to write files anywhere on the host system, leading to Remote Code Execution (RCE). Version 1.9.0 contains an updated fix. See also: https://github.com/langflow-ai/langflow/security/advisories/GHSA-7grx-3xcx-2xv5, See also: https://github.com/langflow-ai/langflow/security/advisories/GHSA-87cc-65ph-2j4w, See also: https://github.com/langflow-ai/langflow/security/advisories/GHSA-g2j9-7rj2-gm6c ]]></description><pubDate>Wed, 25 Mar 2026 05:00:08 +0200</pubDate><guid>https://github.com/langflow-ai/langflow/security/advisories/GHSA-ph9w-r52h-28p7</guid></item><item><title>Vulnerabilities in NGINX Open Source and NGINX Plus</title><link>https://my.f5.com/manage/s/article/K000160366</link><description><![CDATA[ Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 8.7, CVEs: CVE-2026-32647, Summary: CVE-2026-32647 (CVSS: 8.5): NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-28755 (CVSS: 5.3): NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-28753 (CVSS: 6.3): NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-27784 (CVSS: 8.5): The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-27654 (CVSS: 8.2): NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-27651 (CVSS: 8.7): When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. See also: https://my.f5.com/manage/s/article/K000160368, See also: https://my.f5.com/manage/s/article/K000160367, See also: https://my.f5.com/manage/s/article/K000160364, See also: https://my.f5.com/manage/s/article/K000160382, See also: https://my.f5.com/manage/s/article/K000160383 ]]></description><pubDate>Wed, 25 Mar 2026 05:00:09 +0200</pubDate><guid>https://my.f5.com/manage/s/article/K000160366</guid></item><item><title>Vulnerabilities in Apache Artemis</title><link>https://www.knime.com/security/advisories#CVE-2026-4649</link><description><![CDATA[ Classification: Low, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 5.3, CVEs: CVE-2026-32642, CVE-2026-4649, Summary: CVE-2026-32642 (CVSS: 2.3): Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue" permission but does not have the "createAddress" permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address. When the OpenWire connection is closed the address is removed. This issue affects Apache Artemis: from 2.50.0 through 2.52.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0. Users are recommended to upgrade to version 2.53.0, which fixes the issue.

CVE-2026-4649 (CVSS: 5.3): Apache Artemis before version 2.52.0 is affected by an authentication bypass flaw which allows reading all messages exchanged via the broker and injection of new message ( CVE-2026-27446 https://www.cve.org/CVERecord ). Since KNIME Business Hub uses Apache Artemis it is also affected by the issue. However, since Apache Artemis is not exposed to the outside it requires at least normal user privileges and the ability to execute workflows in an executor. Such a user can install and register a federated mirror without authentication to the original Apache Artemis instance and thereby read all internal messages and inject new messages. The issue affects all versions of KNIME Business Hub. A fixed version of Apache Artemis is shipped with versions 1.18.0, 1.17.4, and 1.16.3. We recommend updating to a fixed version as soon as possible since no workaround is known. See also: http://www.openwall.com/lists/oss-security/2026/03/20/2 ]]></description><pubDate>Wed, 25 Mar 2026 05:00:10 +0200</pubDate><guid>https://www.knime.com/security/advisories#CVE-2026-4649</guid></item><item><title>Vulnerability in Spring Cloud</title><link>https://spring.io/security/cve-2026-22739</link><description><![CDATA[ Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 8.6, CVEs: CVE-2026-22739, Summary: Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.  ]]></description><pubDate>Wed, 25 Mar 2026 05:00:11 +0200</pubDate><guid>https://spring.io/security/cve-2026-22739</guid></item><item><title>Vulnerability in libtiff library</title><link>https://access.redhat.com/security/cve/CVE-2026-4775</link><description><![CDATA[ Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.8, CVEs: CVE-2026-4775, Summary: A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.  ]]></description><pubDate>Wed, 25 Mar 2026 05:00:12 +0200</pubDate><guid>https://access.redhat.com/security/cve/CVE-2026-4775</guid></item><item><title>Mozilla Foundation Security Advisory 2026-20</title><link>https://www.mozilla.org/en-US/security/advisories/mfsa2026-20/</link><description><![CDATA[ Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-4684, CVE-2026-4685, CVE-2026-4686, CVE-2026-4687, CVE-2026-4688, CVE-2026-4689, CVE-2026-4690, CVE-2026-4691, CVE-2026-4692, CVE-2026-4693, CVE-2026-4694, CVE-2026-4695, CVE-2026-4696, CVE-2026-4697, CVE-2026-4698, CVE-2026-4699, CVE-2026-4700, CVE-2026-4701, CVE-2026-4722, CVE-2026-4702 (+26 other associated CVEs), Summary: Security Vulnerabilities fixed in Firefox 149  ]]></description><pubDate>Wed, 25 Mar 2026 05:00:13 +0200</pubDate><guid>https://www.mozilla.org/en-US/security/advisories/mfsa2026-20/</guid></item><item><title>Vulnerability in Undertow</title><link>https://access.redhat.com/security/cve/CVE-2026-3260</link><description><![CDATA[ Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 5.3, CVEs: CVE-2026-3260, Summary: A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like `getParameterMap()`, the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).  ]]></description><pubDate>Wed, 25 Mar 2026 05:00:14 +0200</pubDate><guid>https://access.redhat.com/security/cve/CVE-2026-3260</guid></item><item><title>Critical vulnerability in Zimbra Collaboration Suite (ZCS) PostJournal service</title><link>https://www.vulncheck.com/advisories/zimbra-collaboration-suite-postjournal-unauthenticated-remote-code-execution-via-smtp-injection</link><description><![CDATA[ Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.3, CVEs: CVE-2025-71275, Summary: Zimbra Collaboration Suite (ZCS) PostJournal service version 8.8.15 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by exploiting improper sanitization of the RCPT TO parameter via SMTP injection. Attackers can inject shell expansion syntax through the RCPT TO parameter to achieve remote code execution under the Zimbra service context.  ]]></description><pubDate>Wed, 25 Mar 2026 05:00:15 +0200</pubDate><guid>https://www.vulncheck.com/advisories/zimbra-collaboration-suite-postjournal-unauthenticated-remote-code-execution-via-smtp-injection</guid></item><item><title>Vulnerability in Grassroots DICOM (GDCM)</title><link>https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-083-01</link><description><![CDATA[ Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5, CVEs: CVE-2026-3650, Summary: Successful exploitation of this vulnerability could allow an attacker to send a specially crafted file, and when parsed, could result in a denial-of-service condition.  ]]></description><pubDate>Wed, 25 Mar 2026 05:00:16 +0200</pubDate><guid>https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-083-01</guid></item><item><title>Vulnerability in Pharos Controls Mosaic Show Controller</title><link>https://www.cisa.gov/news-events/ics-advisories/icsa-26-083-01</link><description><![CDATA[ Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-2417, Summary: Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary commands with root privileges.  ]]></description><pubDate>Wed, 25 Mar 2026 05:00:17 +0200</pubDate><guid>https://www.cisa.gov/news-events/ics-advisories/icsa-26-083-01</guid></item><item><title>Vulnerability in Schneider Electric EcoStruxure Foxboro DCS</title><link>https://www.cisa.gov/news-events/ics-advisories/icsa-26-083-02</link><description><![CDATA[ Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 6.5, CVEs: CVE-2026-1286, Summary: Schneider Electric is aware of a vulnerability in its EcoStruxure Foxboro DCS Control Software on Foxboro DCS workstations and servers. Control Core Services and all runtime software, like FCPs, FDCs, and FBMs, are not affected. The EcoStruxure Foxboro DCS ([https://www.se.com/ww/en/product-range/63680-ecostruxure-foxboro-dcs/](https://www.se.com/ww/en/product-range/63680-ecostruxure-foxboro-dcs/)) product is an innovative family of fault-tolerant, highly available control components, which consolidates critical information and elevates staff capabilities to ensure flawless, continuous plant operation. Failure to apply the remediation provided below may risk deserialization of untrusted data, which could result in loss of confidentiality, integrity and potential remote code execution on the compromised workstation.  ]]></description><pubDate>Wed, 25 Mar 2026 05:00:18 +0200</pubDate><guid>https://www.cisa.gov/news-events/ics-advisories/icsa-26-083-02</guid></item><item><title>Vulnerabilities in Schneider Electric Plant iT/Brewmaxx</title><link>https://www.cisa.gov/news-events/ics-advisories/icsa-26-083-03</link><description><![CDATA[ Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.9, CVEs: CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, CVE-2025-46819, Summary: Successful exploitation of these vulnerabilities could risk privilege escalation, which could result in remote code execution.  ]]></description><pubDate>Wed, 25 Mar 2026 05:00:19 +0200</pubDate><guid>https://www.cisa.gov/news-events/ics-advisories/icsa-26-083-03</guid></item></channel></rss>