Application security news, updated daily (if there is any news to share).
A GitHub-reviewed advisory reports a High-severity path normalization mismatch in @fastify/middie that can bypass path-scoped auth middleware; upgrade to 9.2.0.
CVE-2026-28215 lets unauthenticated attackers overwrite self-hosted Hoppscotch infrastructure config via POST /v1/onboarding/config, exposing OAuth credentials and plaintext secrets; fixed in 2026.2.0.
An oss-security disclosure says terraform-provider-linode versions before v3.9.0 could log passwords, tokens, scripts, and NodeBalancer TLS private keys when debug logging is enabled.
CVE-2026-27577 discloses a critical n8n expression-evaluation sandbox escape enabling authenticated workflow editors to execute system commands; fixed in 1.123.22, 2.9.3, and 2.10.1.
ImageMagick disclosed a High-severity path-policy bypass where traversal in filenames can read restricted files despite policy-secure.xml; update to 7.1.2-15 or 6.9.13-40.
Apache disclosed CVE-2026-23982, a High-severity authorization bypass in Superset versions before 6.0.0 enabling low-privilege users to access restricted data via dataset SQL overwrite.
Broadcom issued VMSA-2026-0001 for VMware Aria Operations, fixing a High command-injection bug and additional XSS and privilege-escalation flaws affecting VCF deployments.
Anthropic is rolling out Claude Code Security in limited preview for Enterprise/Team plans, scanning codebases for vulnerabilities and suggesting patches with human approval.
Jenkins published a security advisory fixing a High-severity stored XSS in core that can be abused by users with node configuration/disconnect permissions; update is available.
Red Hat published RHSA-2026:2768, an Important security advisory updating RHEL 9.4 EUS nodejs:20 to address three Node.js vulnerabilities, including a DoS issue.
GitHub's Advisory Database published a malware advisory for the npm package ambar-src, warning that any affected machine should be treated as fully compromised.
OpenSSF Package Analysis identified the npm package compass-e2e-tests (version 99.0.0) as malicious due to communication with a domain associated with malicious activity.