CVE-2026-66339: Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels
CVE-2026-66339 is a vulnerability in Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels, rated Moderate by Microsoft, with a CVSS 3.1 base score of 6.5 (Medium). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.25% probability of exploitation activity in the next 30 days, higher than 16% of all scored vulnerabilities. Microsoft released the fix on 6 August 2026, outside Patch Tuesday. It affects 3 products in 1 product family (Open Source Software).
CVE-2026-57968: Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability (High, CVSS 7.8)
CVE-2026-57973: Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability (Medium, CVSS 6.3)
CVE-2026-44210: Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations (Critical, CVSS 9.9)
CVE-2026-15043: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text (Critical, CVSS 9.8)
CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout (Critical, CVSS 9.8)
CVE-2026-38968: ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing. (Critical, CVSS 9.8)
CVE-2026-53374: drm/amdgpu: zero-initialize GART table on allocation (Critical, CVSS 9.8)