Linux Kernel Vulnerability copy.fail - CVE-2026-31431

IR Number FG-IR-26-139
Published Date May 13, 2026

Component CLI
Severity High
Discovered Third-Party Library
Attack Type Authenticated
Known Exploited No
CVSSv3 Score 7.8

Impact Escalation of privilege
CVE ID CVE-2026-31431

https://fortiguard.fortinet.com/psirt/FG-IR-26-139

VMSA-2026-0003: VMware Fusion updates address privilege escalation vulnerability (CVE-2026-41702)

Advisory ID:  VMSA-2026-0003
Advisory Severity: Important
CVSSv3 Range: 7.8
Synopsis: VMware Fusion updates address privilege escalation vulnerability (CVE-2026-41702)
Issue date: 2025-05-14
CVE(s) CVE-2026-41702
 
Impacted Products
VMware Fusion

Introduction
A local privilege escalation vulnerability in VMware Fusion was privately reported to Broadcom. Updates are available to remediate this vulnerability in affected Broadcom products. 

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37454

Microsoft Exchange Server Spoofing Vulnerability

CVE-2026-42897
Released: May 14, 2026
Impact Spoofing
Max Severity Critical
Weakness CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: 7.5

Executive Summary
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Exploitability
The following table provides an exploitability assessment for this vulnerability at the time of original publication.
Publicly disclosed No
Exploited Yes
Exploitability assessment Exploitation Detected

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897

New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption

Details have emerged about a new variant of the recent Dirty Frag Linux local privilege escalation (LPE) vulnerability that allows local attackers to gain root access, making it the third such bug to be identified in the kernel within a span of two weeks.

Codenamed Fragnesia, the security vulnerability is tracked as CVE-2026-46300 (CVSS score: 7.8) and is rooted in the Linux kernel's XFRM ESP-in-TCP subsystem. It was discovered by researcher William Bowling of Zellic and the V12 security team.

"The vulnerability allows unprivileged local attackers to modify read-only file contents in the kernel page cache and achieve root privileges through a deterministic page-cache corruption primitive," Google-owned Wiz said.

https://thehackernews.com/2026/05/new-fragnesia-linux-kernel-lpe-grants.html

K000161019: NGINX ngx_http_rewrite_module vulnerability CVE-2026-42945

Date: May 13, 2026

Not vulnerable: 1.31.0+, 1.30.1+
Vulnerable: 0.6.27-1.30.0

Security Advisory Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR ) disabled, code execution is possible. (CVE-2026-42945)

https://my.f5.com/manage/s/article/K000161019

K000161131: NGINX ngx_http_proxy_v2_module vulnerability CVE-2026-42926

Security Advisory Description
When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer. (CVE-2026-42926)

Not vulnerable: 1.31.0+, 1.30.1+
Vulnerable: 1.29.4-1.30.0

https://my.f5.com/manage/s/article/K000161131

K000161027: NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability CVE-2026-42946

Not vulnerable: 1.31.0+, 1.30.1+
Vulnerable: 0.8.42-1.30.0

Security Advisory Description
A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it. (CVE-2026-42946)

Impact
This vulnerability may allow remote attackers to restart or disclose the memory of the NGINX worker process. There is no control plane exposure; this is a data plane issue only.

https://my.f5.com/manage/s/article/K000161027

Upcoming highly critical release on May 20, 2026 - PSA-2026-05-18

Date: 2026-May-18
Security risk: Highly critical

Description:
There will be a Drupal core security release for all supported branches on May 20, 2026, between 17:00 and 21:00 UTC. (To see this in your local timezone, refer to the Drupal Core Calendar.) The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days.

Supported core versions
Security releases will be provided for all the currently supported branches of Drupal core, which are:
11.3.x
11.2.x
10.6.x
10.5.x
Sites on one of these supported versions should update to the latest patch release for the given branch now in preparation for the security window.

https://www.drupal.org/psa-2026-05-18

GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension

https://thehackernews.com/2026/05/github-internal-repositories-breached.html

Cisco Secure Workload Unauthorized API Access Vulnerability

Advisory ID: cisco-sa-csw-pnbsa-g8WEnuy
First Published: 2026 May 20 16:00 GMT
Version 1.0: Final
Workarounds: No workarounds available
Cisco Bug IDs: CSCwt99942
CVSS Score: Base 10.0

Summary
A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin role.

This vulnerability is due to insufficient validation and authentication when accessing REST API endpoints. An attacker could exploit this vulnerability if they are able to send a crafted API request to an affected endpoint. A successful exploit could allow the attacker to read sensitive information and make configuration changes across tenant boundaries with the privileges of the Site Admin user.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-pnbsa-g8WEnuy

Validación de entrada incorrecta en el servidor de UniFI OS

Fecha 22/05/2026
Importancia 5 - Crítica

https://www.incibe.es/incibe-cert/alerta-temprana/avisos/validacion-de-entrada-incorrecta-en-el-servidor-de-unifi-os