CVE-2026-96534: HIGH severity SQL injection in Modern Events Calendar Lite & Pro (<7.37.0). Minimal privilege users can inject SQL via unsanitized parameter. Upgrade to 7.37.0+ now. Details: https://radar.offseq.com/threat/cve-2026-96534-cwe-89-sql-injection-in-modern-events-calendar-lite-ce764878637d8935 #OffSeq #WordPress #Vuln #SQLi

CVE-2026-110981: WP Photo Album Plus <9.2.11.002 has a HIGH severity reflected XSS flaw. Unauthenticated attackers can inject scripts via crafted gallery links; any user clicking a breadcrumb is at risk. Patch to 9.2.11.002. https://radar.offseq.com/threat/cve-2026-110981-cwe-79-cross-site-scripting-xss-in-wp-photo-album-plus-dea0434db1307a3f #OffSeq #XSS #WordPress

🟠 CVE-2026-112021 - High (7.5)

snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single craf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-112021/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111998 - Critical (9.8)

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC prox...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111998/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL vuln (CVE-2026-111998) in vanus-labs vanus 0.8.0 – 0.9.0: hardcoded admin token lets remote attackers gain cluster-admin via gRPC proxy. Restrict port and monitor usage while awaiting patch. https://radar.offseq.com/threat/cve-2026-111998-use-of-default-credentials-in-vanus-labs-vanus-f09d985dc9219139 #OffSeq #CVE #infosec #cloud

🟠 CVE-2026-112005 - High (7.7)

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-112005/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-112005: CRITICAL path traversal in clidey whodb (0.104.0 – 0.134.9). Remote attackers can read/write host files via DuckDB queries — risk of credential theft & file overwrite. Update ASAP! https://radar.offseq.com/threat/cve-2026-112005-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-clidey-359d00841ebcc12f #OffSeq #Infosec #PathTraversal #CVE2026112005

🟠 CVE-2026-112015 - High (7.5)

Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-trave...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-112015/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-109894 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-109894/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-110886 - Critical (9.8)

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111999 - High (7.5)

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111999/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-111041 (HIGH): AI Engine WordPress plugin <3.7.9 has a missing authorization flaw. Editors+ can modify any post on the site. Upgrade to 3.7.9+ to fix. Details: https://radar.offseq.com/threat/cve-2026-111041-cwe-862-missing-authorization-in-ai-engine-73ebc0232c3cfd40 #OffSeq #WordPress #Vuln #Infosec

🟠 CVE-2026-112000 - High (7.6)

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscripti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-112000/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

beaugunderson ip-address (<10.7.4) is vulnerable (CVE-2026-111997, MEDIUM). Inefficient regex can allow DoS via crafted '%' input — app stalls, CPU spikes. Patch to 10.7.4+ ASAP. Details: https://radar.offseq.com/threat/cve-2026-111997-cwe-1333-inefficient-regular-expression-complexity-in-beaugunderson-ip-address-587dc3e1591d574d #OffSeq #Vulnerability #InfoSec #DenialOfService

🟠 CVE-2026-110895 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110895/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-110383 - High (7.5)

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110383/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-110383 - High (7.5)

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110383/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-107762 - High (7.5)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-107762/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-110373 - High (8.1)

Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-110373 - High (8.1)

Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-110372 - Critical (9.8)

Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110372/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-110372 - Critical (9.8)

Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110372/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SQL injection (CVE-2026-111872) in itsmeravitejak Online-Examination-System: MEDIUM severity, CVSS 6.9. Exploitable via id/user/topic params in results.php/include/database.php. No patch — use WAFs & restrict access. https://radar.offseq.com/threat/cve-2026-111872-sql-injection-in-itsmeravitejak-online-examination-system-335722e990367af8 #OffSeq #SQLInjection #Infosec

CVE-2026-111876: Command injection (MEDIUM, CVSS 4.8) impacts alexpasmantier television v0.15.0 – 0.15.9 via Entry::output. Local access required, no fix planned. Review exposure and restrict access. https://radar.offseq.com/threat/cve-2026-111876-command-injection-in-alexpasmantier-television-e75c1b576666ca7f #OffSeq #Vulnerability #AppSec #CVE

CVE-2026-111868: Medium severity deserialization bug in datastax pulsar-jms 9.0.0 – 9.0.3. Remote exploitation possible via decode function. No patch yet — limit network exposure & monitor updates. https://radar.offseq.com/threat/cve-2026-111868-deserialization-in-datastax-pulsar-jms-4962afd23db38278 #OffSeq #Vuln #datastax #JMS

CVE-2026-111866: MEDIUM-severity SQL injection found in nemoTyrant manong (up to 7c9e5228e133b9...) in func.php's arr2sql. Remote exploitation possible. Patch status unclear. Review your deployments. https://radar.offseq.com/threat/cve-2026-111866-sql-injection-in-nemotyrant-manong-1a02962753155940 #OffSeq #SQLi #CVE #nemoTyrant

🟠 CVE-2026-111909 - High (8.1)

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/ap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111909/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111898 - High (7.5)

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding usern...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111898/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111911 - Critical (9.8)

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a for...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111911/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111884 - High (8.3)

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. A...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111884/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111882 - High (8.1)

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attacke...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111882/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111881 - High (7.6)

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111881/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111927 - High (7.7)

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a stri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111927/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111924 - High (7.5)

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gz...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111924/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111923 - High (7.5)

Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111923/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111908 - High (8.3)

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111908/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111901 - High (7.5)

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111901/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-110889 (HIGH, CVSS 7.5): Gantry 5 Framework ≤5.6.4 leaks sensitive info in error messages. Attackers need no privileges or user interaction. Limit detailed error output & check for fixes. https://radar.offseq.com/threat/cve-2026-110889-generation-of-error-message-containing-sensitive-information-in-gantry-gantry-5-febaba0978056c3c #OffSeq #Vuln #Gantry #AppSec

🟠 CVE-2026-110889 - High (7.5)

Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110889/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-108123 - High (7.5)

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-108123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-92798 - High (8.1)

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(),...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92798/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-104736 - Critical (9.8)

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is pas...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104736/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-104736: LearnPress (≤4.4.10) has a CRITICAL PHP Object Injection flaw (CVSS 9.8) via 'checkout-email' — enables unauth RCE & system takeover. No patch yet; restrict AJAX checkout now. https://radar.offseq.com/threat/cve-2026-104736-cwe-502-deserialization-of-untrusted-data-in-thimpress-learnpress-wordpress-lms-plugin-da26ea8c610f8fca #OffSeq #WordPress #Vuln #Infosec

🟠 CVE-2026-102917 - High (7.8)

IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102917/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111855 - High (7.5)

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111855/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111853 - High (8.8)

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111853/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-110653 - Critical (9.1)

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110653/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-110653 | CRITICAL flaw in LatePoint Appointment Booking Plugin (<=5.7.4) for WordPress: Race condition in OTP lets attackers bypass authentication & seize user accounts. Restrict OTP endpoints, monitor now. https://radar.offseq.com/threat/cve-2026-110653-cwe-287-improper-authentication-in-latepoint-appointment-booking-plugin-latepoint-084a535b1718f8eb #OffSeq #WordPress #CVE2026110653

🟠 CVE-2026-111854 - High (8.1)

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validatio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111854/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Mage AI Patches Critical OAuth Bypass in Data Pipeline Orchestration Tool

Mage OSS fixed a critical CVSS 9.8 authentication bypass (CVE-2026-111823) that allows unauthenticated access to data pipelines and cloud credentials. The flaw occurs when the system fails to stop session creation after detecting an OAuth error.

**If you run Mage OSS, update ASAP to a version newer than 0.9.80, because attackers can take over the platform without logging in. Since this attack won't look like password guessing in your logs, review recent sessions and pipeline changes for anything unexpected and change all passwords and keys stored in Mage.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/mage-ai-patches-critical-oauth-bypass-in-data-pipeline-orchestration-tool-a-o-5-c-z/gD2P6Ple2L

🔴 CVE-2026-111823 - Critical (9.8)

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111823/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-111823 (CRITICAL, CVSS 9.8) in Mage mage-ai <=0.9.80: OAuth session creation flaw enables unauthorized access if provider is unknown. No confirmed patch — check vendor updates. Details: https://radar.offseq.com/threat/cve-2026-111823-cwe-390-detection-of-error-condition-without-action-in-mage-mage-ai-d243a1403d673a6a #OffSeq #CVE2026111823 #MageAI #OAuth #Infosec

🟠 CVE-2026-96627 - High (8.8)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96627/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111706 - High (7.5)

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optiona...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111706/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111686 - High (7.5)

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

ZoneMinder <1.38.3 has a CRITICAL command injection (CVE-2026-102608). Attackers with monitor-create/edit perms can exploit export events to run commands as web server user. Upgrade to 1.38.3 ASAP. https://radar.offseq.com/threat/prior-to-1383-downloadevents-manually-wraps-a-monitor-name-value-in-single-quotes-instead-of-using-6dc81b7d0d96a70c #OffSeq #ZoneMinder #Infosec #CVE2026102608

🔴 CVE-2026-102608 - Critical (9)

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102608/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

2026-W42 — Weekly Threat Roundup

🔓 Chinese APT Armory Castle exploited a BeyondTrust zero-day (CVE-2026-102764) since August, deploying custom webshells and credential harvesters across remote support infrastructure.
🏭 A ConnectWise Cloud Backup supply-chain compromise granted attackers admin access to 173 Microsoft 365 tenants…

https://threatnoir.com/weekly/2026-w42

#infosec #cybersecurity #threatintel

🤖 AI generated summary

Geopolitical tensions rise: US-Ukraine ties fray over Starlink restrictions and Patriot missile shortages (Oct 16). Tech breakthrough: Microsoft unveils MAI-Base-2, a 2.8T parameter AI model with 12x DeepSeek gain (Oct 15). Cybersecurity critical: Chinese APT exploited BeyondTrust zero-day (CVE-2026-102764). Cisco warns of exploited Secure Email Gateway flaw (CVE-2026-76519).

#Cybersecurity #Geopolitics #AI

🚨 Rapid Response | BeyondTrust Remote Support/Privileged Remote Access Zero-Day (CVE-2026-102764) (CVSS 9.3) is a critical vulnerability.

The flaw allows unauthenticated attackers to perform file operations on affected appliances.
Censys currently detects 9,569 Internet-exposed hosts and 177,497 web properties running BeyondTrust Remote Support or Privileged Remote Access. These figures represent detected installations, not confirmed vulnerable or unpatched instances.

BeyondTrust has released patches for both products. Organizations should prioritize patching self-hosted appliances and investigate potential compromise, as patching does not remediate prior exploitation.

Full Censys ARC advisory, including affected versions, exploitation indicators, and remediation guidance: https://censys.com/advisory/cve-2026-102764/

#CensysARC #Cybersecurity #VulnerabilityManagement #BeyondTrust #InfoSec

🚨 [CISA-2026:1016] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1016)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2025-61624 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-61624)
- Name: Fortinet Multiple Products Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: Multiple Products
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-122 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-61624

⚠️ CVE-2026-102764 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102764)
- Name: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BeyondTrust
- Product: Remote Support
- Notes: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102764

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261016 #cisa20261016 #cve_2025_61624 #cve_2026_102764 #cve202561624 #cve2026102764

CVE ID: CVE-2026-102764
Vendor: BeyondTrust
Product: Remote Support
Date Added: 2026-10-16
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-102764

Placeholder link https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog

• CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
• CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability

#CISA #KEV #Beyondtrust #fortinet

⚠️ CRITICAL: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

Chinese APT Armory Castle has been actively exploiting CVE-2026-102764, a zero-day in BeyondTrust Remote Support appliances, since August to gain root access and exfiltrate data. Organizations running BeyondTrust are at immediate risk of credential theft, lateral movement, and data loss. Attackers…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

BeyondTrust Remote Support zero-day CVE-2026-102764 is being exploited by a suspected China-linked actor against hosted and self-hosted appliances. Compromise of these systems risks privileged remote session hijack and downstream enterprise access. Patch and hunt for post-exploitation activity now. #BeyondTrust #ZeroDay #ThreatIntel

https://cyberworldops.eu/en/beyondtrust-remote-support-zero-day-exploited-against-hosted-and-self

🏆 New Achievement! Support Is Not Currently Available (It Was Stolen)!

Conducting inventory audit on your BeyondTrust Remote Support deployment. Line item one: one self-hosted Remote Support appliance, condition — compromised. Date of loss: August 29, 2026. Responsible party: Armory Castle, China-linked threat actor. Line item two: improper origin validation in an internal messaging component, logged as CVE-2026-102764, CVSS 9.3. (1/3)

Status — exploited as zero-day, remote file operations performed, asset value negative.

Notes column reads: BeyondTrust initiated investigation September 27 after a separate security vendor's breach went public. Classic "check after the neighbor's house burns down" energy.

Patch CVE-2026-102764 in BeyondTrust Remote Support immediately or update this column to "total loss."

Reward: You've received a Cursed Appliance Token. It is worth negative gold. Please remove it from the premises. (2/3)

Patch CVE-2026-102764 now. This critical BeyondTrust Remote Support vulnerability is exploited in the wild as an ARMORY CASTLE zero-day.

#BeyondTrust #CVE2026102764 #ZeroDay #ArmoryCastle #Mandiant #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/beyondtrust-remote-support-vulnerability-exploited/?utm_source=mastodon&utm_medium=jetpack_social

RE: https://infosec.exchange/@BleepingComputer/117449130155748204

BeyondTrust patched a Remote Support zero-day (CVE-2026-102764) exploited since August.

Mandiant attributes the attacks to Armory Castle (formerly UNC5221), a China-nexus espionage group that has also targeted Citrix NetScaler and Ivanti Connect Secure appliances.

BeyondTrust has 20,000+ customers, including 75% of the Fortune 100.

🟠 CVE-2026-30971 - High (8.8)

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authentic...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30971/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111673 - Critical (9.8)

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-111322 (CRITICAL): coleam00 Archon 0.2.13 – 0.11.1 lacks auth on /api/*, risking remote command execution by unauthenticated users. Restrict API access & monitor; patch status unknown. https://radar.offseq.com/threat/cve-2026-111322-missing-authentication-for-critical-function-in-coleam00-archon-2baeaa2e1000cf2d #OffSeq #Vulnerability #CVE2026111322

🟠 CVE-2026-102834 - High (7.5)

JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102834/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

LMCache CRITICAL RCE (CVE-2026-105192): Versions 0.3.9 – 0.5.5 allow unauthenticated remote code execution via unsafe pickle deserialization on ZeroMQ (port 5555). Upgrade to 0.5.6, restrict network exposure. https://radar.offseq.com/threat/lmcache-remote-code-execution-via-unsafe-deserialization-in-multiprocess-mode-transport-cve-2026-105192-2fc0f6faaffd3212 #OffSeq #CVE2026105192 #infosec #rce

🟠 CVE-2026-48503 - High (7.5)

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-of-range in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48503/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

RE: https://infosec.exchange/@fuckeduprefs_bot/117451467118494691

...what the fuck happened here.

https://github.com/rwilsonecs/CVE-2025-52097/blob/main/ADVISORY.md

The researchers post is over a year old & states CVE-2025-52097 was already assigned in July 2025. The references are from the researchers advisory, checking the wayback machine has nothing for this dead link. The CVE record states it was reserved in 2026.

🟠 CVE-2026-75941 - High (8)

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75941/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105958 - High (7.5)

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105958/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111643 - Critical (9.8)

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111643/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111710 - High (7.5)

Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111710/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111722 - High (8.1)

LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric I...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111722/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111711 - Critical (9.8)

Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111711/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111723 - High (8.8)

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every acc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111723/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111708 - Critical (9.8)

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gai...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111708/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111702 - High (7.5)

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledg...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111702/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111685 - High (7.5)

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111685/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111680 - High (8.3)

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target ser...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111680/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111681 - High (8.8)

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111681/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111693 - Critical (9.8)

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111693/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111663 - High (8.6)

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111663/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL SSRF in Chaskiq <=2.0.3 (CVE-2026-111663): Unauthenticated attackers can fetch internal/cloud URLs via GraphQL, risking sensitive data exposure. Restrict /graphql access & monitor POSTs. CVSS 8.6. https://radar.offseq.com/threat/chaskiq-through-203-contains-a-server-side-request-forgery-vulnerability-that-allows-unauthenticated-cc1602d36198eead #OffSeq #SSRF #Chaskiq #Vuln

🔴 CVE-2026-111704 - Critical (9.8)

LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111704/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-111704: LangChat (≤commit 2a6285a) is affected by a CRITICAL missing authentication flaw (CVSS 9.8). Unauthenticated attackers can access REST APIs, read user credentials, and escalate privileges. Patch status unconfirmed. https://radar.offseq.com/threat/langchat-through-commit-2a6285a-contains-a-missing-authentication-vulnerability-that-allows-89fa6c1030988aed #OffSeq #Vuln #LangChat

🔴 CVE-2026-111692 - Critical (9.8)

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111692/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111690 - Critical (9.8)

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111690/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111636 - High (8.1)

OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111636/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111687 - Critical (9.8)

WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111687/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-111641: FastapiAdmin <=3.0 has a CRITICAL auth bypass flaw — unauthenticated attackers can seize admin sessions via exposed endpoints. Restrict access & watch for abuse until a patch lands. Details: https://radar.offseq.com/threat/fastapiadmin-through-30-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-8a2c1a85a7cb4068 #OffSeq #CVE2026111641 #infosec #security

🟠 CVE-2026-111650 - High (8.6)

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 [CISA-2026:1016] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1016)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2025-61624 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-61624)
- Name: Fortinet Multiple Products Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: Multiple Products
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-122 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-61624

⚠️ CVE-2026-102764 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102764)
- Name: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BeyondTrust
- Product: Remote Support
- Notes: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102764

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261016 #cisa20261016 #cve_2025_61624 #cve_2026_102764 #cve202561624 #cve2026102764

CVE ID: CVE-2025-61624
Vendor: Fortinet
Product: Multiple Products
Date Added: 2026-10-16
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-61624

Placeholder link https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog

• CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
• CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability

#CISA #KEV #Beyondtrust #fortinet

This one slipped through the cracks this past Patch Tuesday because the CVE started with 2025: CVE-2025-61624 (5.4 medium) path traversal > aribtrary write/delete
https://fortiguard.fortinet.com/psirt/FG-IR-26-122

Unit 42's blog post states it was exploited in the wild: https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/

The attackers exploited another vulnerability, CVE-2025-61624, via FortiOS auto-script path traversal. This exploit facilitated the deployment of PEERSTITCH, a novel, memory-resident ARM64 malware.

#threatintel #eitw #CVE #fortinet #ioc

🟠 CVE-2026-111684 - High (8.3)

Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call Revoke...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111684/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: https://patchorpass.beehiiv.com/?v=2

#homelab #infosec #selfhosted #sysadmin

🏆 New Achievement! Mark Of The Beast (Bypassed)!

PHASE ONE BEGINS. CVE-2026-96951 has entered the arena — a Windows Shell security feature bypass, CVSS 8.8, already chewing through systems in the wild before Microsoft could even clear its throat on October Patch Tuesday. The flaw lets specially crafted files sidestep Mark of the Web protections, that little warning Windows pastes on untrusted downloads like a bouncer checking IDs. (1/2)

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: https://patchorpass.beehiiv.com

#homelab #infosec #selfhosted #sysadmin

🏆 New Achievement! Mark Of The Beast (Bypassed)!

PHASE ONE BEGINS. CVE-2026-96951 has entered the arena — a Windows Shell security feature bypass, CVSS 8.8, already chewing through systems in the wild before Microsoft could even clear its throat on October Patch Tuesday. The flaw lets specially crafted files sidestep Mark of the Web protections, that little warning Windows pastes on untrusted downloads like a bouncer checking IDs. (1/2)

15 октября появилась публичная информация о KVM escape и патчи ядра Linux. Авторы не предоставили публичный PoC опасаясь эксплуатации в дикой природе

А уже 17 октября был взломан FirstVDS.

Но с CVE-2026-99999 это не связано. У firstvds взлом произошёл через vmmanager 6. Там дырка, позволявшая через ссылку на iso передать ещё и команду, выполнявшуюся от root-а панелью.

Резюмируем, что с современным ИИ эксплуатация уязвимостей стала производиться гораздо быстрее.
Информации из анализа изменений достаточно для обнаружения ошибки и написания полноценного эксплоита в кратчайшие сроки.

#infosec #ai #kvm #vmmanager #hack #vulnerability

"Aufgrund eines Sicherheitsrelevaten Kernelupdates müssen wir kurzfristig Wartungsarbeiten am Wirt Ihres vServers durchführen", ah ok. (Ich habe mal kurz recherchiert, das könnte der CVE-2026-99999 sein.)

CVE-2026-99999 is just a beautiful summary of this entire year as it comes to vulnerability management.

Discover the details of a new Linux kernel critical vulnerability (CVE-2026-99999). Learn how to patch this virtualization flaw to protect your host machines.

#Debian #Cybersecurity #Vulnerability #CloudSecurity

https://dailytechnow.com/linux-kernel-critical-vulnerability/

PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) https://lobste.rs/s/np84oh #linux #security #virtualization
https://pwn.ai/blog/pwnescape

PwnEscape : une faille Linux permet de s’évader d’une VM KVM https://www.it-connect.fr/pwnescape-cve-2026-99999-faille-noyau-linux-evasion-vm/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Linux

> If a packet with bad checksum metadata gets into the ipv4 stack,
skb_checksum_help can corrupt the network header and cause a bunch of mischief.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6785011f8b16abf40b1e9d8b2e332232b3e68822

Absolute cinema, CVE-2026-99999 is by far my favorite one this year so far

alpinelinux.org is currently unavailable due to emergency patching of the host (CVE-2026-99999).

It should be back soon.

#AlpineLinux #AlpineOps

⚠️ CRITICAL: Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

A critical Linux kernel vulnerability (CVE-2026-99999) in networking code allows guest VMs to read host system memory. This affects any hypervisor running vulnerable Linux kernels and has been successfully exploited against Vercel's cloud sandboxes. Host memory exposure puts credentials, keys, and…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

@atarifrosch Looks like https://security-tracker.debian.org/tracker/CVE-2026-99999
lags behind. But at least its listed as vulnerable which is better than Ubuntu https://ubuntu.com/security/CVE-2026-99999 "Needs evaluation".
https://security-tracker.debian.org/tracker/source-package/linux only lists trixie so far but i'm sure oldstable will follow.

🚨 PwnEscape (CVE-2026-99999) has been identified as a notable vulnerability.

In the Linux kernel, the following vulnerability has been resolved:

ipv4: validate checksum_start before completing checksum

If a packet with bad checksum metadata gets into the ipv4 stack,
skb_checksum_help can corrupt the network header and cause a bunch of
mischief.

This was discovered and reported by Paulos, and has been reporoduced
by others independently since.

We really shouldn't allow such packets in, but as a defence
in depth measure, let's also check before we complete the checksum.

A more complete validation at input is forthcoming, but needs more work.

ℹ️ Additional details, advisories and sightings on ZEN SecDB 👉 https://secdb.nttzen.cloud/cve/detail/CVE-2026-99999

#InfoSec #PwnEscape #Linux #Kernel #CVE202699999
#NTTDATA #ZENSecDB

PwnEscape (CVE-2026-99999): The Critical Linux Kernel Flaw That Breaks VM Isolation

https://thecybersecguru.com/exploits/pwnescape-cve-2026-99999-linux-kernel-vm-escape/

PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) https://pwn.ai/blog/pwnescape

PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) https://pwn.ai/blog/pwnescape

I thought CVE-2026-99999 was a joke due to its ID. It is not.

Buying some more potato / carrot seeds.

Heads up for fellow Linux admins: CVE-2026-99999 (dubbed "PwnEscape") is out, and it is a nasty one (CVSS 9.3).

Despite being called a KVM escape, the actual bug lives in the host IPv4 networking stack. Untrusted CHECKSUM_PARTIAL offload metadata from a guest can overwrite already-validated packet headers during ip_do_fragment(), leaking host memory or allowing a guest-to-host escape.

Mainline patches landed Oct 14, and stable backports are out. Check your hypervisors and reboot!

https://pwn.ai/blog/pwnescape

#Linux #Kernel #SysAdmin #InfoSec #KVM #ITSEC #CVE

Oh... That's bad

https://app.opencve.io/cve/CVE-2026-99999

SiteGuard WAF Flaw Exploited to Gain Root and SYSTEM Privileges

EG Secure Solutions reported an actively exploited OS command injection vulnerability (CVE-2026-106931) in SiteGuard Server Edition's statistics feature, allowing attackers to run commands with full administrative rights.

**If you use the SiteGuard Server Edition WAF (for Apache, Nginx or IIS), first save the diagnostic information from the web management interface, then immediately update to Ver8.00 Update 5 (Ver7.00 Update 6 on FreeBSD), or apply the vendor's patch if you're on an end-of-life version. This flaw is actively exploited. Check the saved diagnostics for signs of a break-in, and if anything looks suspicious, change all database credentials and passwords stored on that server.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/siteguard-waf-flaw-exploited-to-gain-root-and-system-privileges-4-0-i-i-v/gD2P6Ple2L

SiteGuard WAF Flaw Exploited to Gain Root and SYSTEM Privileges

EG Secure Solutions reported an actively exploited OS command injection vulnerability (CVE-2026-106931) in SiteGuard Server Edition's statistics feature, allowing attackers to run commands with full administrative rights.

**If you use the SiteGuard Server Edition WAF (for Apache, Nginx or IIS), first save the diagnostic information from the web management interface, then immediately update to Ver8.00 Update 5 (Ver7.00 Update 6 on FreeBSD), or apply the vendor's patch if you're on an end-of-life version. This flaw is actively exploited. Check the saved diagnostics for signs of a break-in, and if anything looks suspicious, change all database credentials and passwords stored on that server.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/siteguard-waf-flaw-exploited-to-gain-root-and-system-privileges-4-0-i-i-v/gD2P6Ple2L

OS command injection CVE-2026-106931 in the statistics function of SiteGuard Server Edition is under active exploitation, per vendor bulletin relayed by JPCERT/CC. It matters because code execution occurs on the WAF host itself, undermining web-layer protection. #SiteGuard #CommandInjection #WafSecurity

https://cyberworldops.eu/en/siteguard-waf-flaw-cve-2026-106931-is-under-active-exploitation

🟠 CVE-2026-111399 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-107564 - High (7.5)

An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-107564/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Backuply : une faille SQL menace 600 000 WordPress, surtout si vous restaurez votre site web https://www.it-connect.fr/backuply-cve-2026-93953-injection-sql-wordpress/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Wordpress

CRITICAL: CVE-2026-103768 in ELEX WordPress HelpDesk (<=3.3.7) lets unauthenticated users upload dangerous files via initMailPart, risking remote code execution. Update or mitigate now. https://radar.offseq.com/threat/cve-2026-103768-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-elextensions-elex-wordpress-7d30032c4c181bd8 #OffSeq #WordPress #Infosec #RCE

sgl-project sglang (0.5.10 – 0.5.22) is affected by a CRITICAL eval injection (CVE-2026-111391, CVSS 9.2). Remote RCE is possible via /dumper/configure if DUMPER_SERVER_PORT is set. Patch ASAP! https://radar.offseq.com/threat/cve-2026-111391-improper-neutralization-of-directives-in-dynamically-evaluated-code-eval-injection-in-f8a10e538b599ada #OffSeq #CVE2026111391 #Python #Security

TSG Profleet CRITICAL SQL injection (CVE-2026-111472, CVSS 9.3): Unauthenticated attackers can manipulate DB via ‘Identificación’ in /cgi-bin/index.php. Restrict access, deploy WAF. https://radar.offseq.com/threat/cve-2026-111472-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-b09ea35526b07e08 #OffSeq #infosec #vuln #sqlinjection

CVE-2026-94388: CRITICAL SQL Injection in halfdata Green Popups (<7.6.3). Blind SQLi allows remote, unauthenticated data extraction. Patch status unclear — apply input validation. https://radar.offseq.com/threat/cve-2026-94388-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-in-999d0b4727612d6b #OffSeq #SQLInjection #Infosec #WordPress

CVE-2026-94169 (CRITICAL, CVSS 10) affects Theme-one The Grid <2.8.2. Improper code generation enables code injection — patch immediately to reduce exposure. Full advisory: https://radar.offseq.com/threat/cve-2026-94169-improper-control-of-generation-of-code-code-injection-in-theme-one-the-grid-bc4b07c2fb8ec549 #OffSeq #CVE #WordPress #infosec

🚨 PoC published for a critical unauthenticated WordPress Theme My Login account takeover vulnerability; CVE-2026-89079

PoC: https://github.com/murrez/CVE-2026-89079

The flaw affects WordPress multisite installations using Theme My Login with user-chosen registration passwords enabled. Under the required configuration, an unauthenticated attacker can abuse the lost-password flow to overwrite another user's password and take over the account.

CVSS: 9.8 Critical
Affected: Theme My Login ≤ 7.2.1
Fixed: Theme My Login ≥ 7.2.2

Exploitation is configuration-dependent and requires WordPress multisite with the tml_user_passwords network option enabled. The PoC includes target checking, verification, bulk scanning, and an exploit mode that validates successful account access.

A Chrome security update fixes 10 flaws, including critical use after free bug CVE-2026-110922. Update to Chrome 155.0.8059.84 now.

#Chrome #GoogleChrome #CVE2026110922 #CVE2026110913 #CVE2026110919 #UseAfterFree #BrowserSecurity #CyberSecurity

https://securityonline.info/chrome-security-update-155-0-8059-84/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-111356 (CRITICAL, CVSS 9.1) in magicblack MacCMS <=2026.1000.4056 allows unauthenticated brute-forcing of password recovery codes, risking account takeover. Rate limiting is advised until a patch is confirmed. https://radar.offseq.com/threat/cve-2026-111356-improper-restriction-of-excessive-authentication-attempts-in-magicblack-maccms-7a578a56fecd347f #OffSeq #CVE2026111356 #infosec #bruteforce

CVE-2026-111312 (CRITICAL): OpenHealthForAll OpenHealth ≤0.2.0 lets unauthenticated users access, change, or delete any medical record via /api/health-data/[id]. Restrict endpoint access until patched. https://radar.offseq.com/threat/cve-2026-111312-missing-authentication-for-critical-function-in-openhealthforall-openhealth-459af705f709eb85 #OffSeq #CVE2026111312 #infosec #healthtech

🟠 CVE-2026-111282 - High (8.2)

Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with file...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111281 - Critical (9.8)

Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /gofor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: https://patchorpass.beehiiv.com/?v=2

#homelab #infosec #selfhosted #sysadmin

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: https://patchorpass.beehiiv.com

#homelab #infosec #selfhosted #sysadmin

SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Secure
https://isc.sans.edu/podcastdetail/10140

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: https://patchorpass.beehiiv.com/?v=2

#homelab #infosec #selfhosted #sysadmin

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: https://patchorpass.beehiiv.com

#homelab #infosec #selfhosted #sysadmin

Geopolitical tensions rise: US-Ukraine ties fray over Starlink restrictions and Patriot missile shortages (Oct 16). Tech breakthrough: Microsoft unveils MAI-Base-2, a 2.8T parameter AI model with 12x DeepSeek gain (Oct 15). Cybersecurity critical: Chinese APT exploited BeyondTrust zero-day (CVE-2026-102764). Cisco warns of exploited Secure Email Gateway flaw (CVE-2026-76519).

#Cybersecurity #Geopolitics #AI

SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Secure
https://isc.sans.edu/podcastdetail/10140

Fortinet has addressed another high-severity vulnerability:

CVE-2025-46773 - SQL Injection in FortiAnalyzer and FortiAnalyzer Cloud Allows Remote Command Execution https://app.opencve.io/cve/CVE-2025-46773 #Fortinet #vulnerability #infosec

🏆 New Achievement! Thirty-Seven Flavors, All Of Them Horrible!

Compliance protocol engaged. Google Chrome requires patching. Thirty-seven vulnerabilities detected, seven rated Critical. Processing... executing optimal response: announcing this to you AFTER you already opened a crafted HTML page. CVE-2026-110136 permits remote code execution outside Chrome's sandbox via PDF. CVE-2026-110152 does the same on Android through a buffer overflow in ANGLE. We have logged your exposure. (1/2)

🏆 New Achievement! Thirty-Seven Flavors, All Of Them Horrible!

Compliance protocol engaged. Google Chrome requires patching. Thirty-seven vulnerabilities detected, seven rated Critical. Processing... executing optimal response: announcing this to you AFTER you already opened a crafted HTML page. CVE-2026-110136 permits remote code execution outside Chrome's sandbox via PDF. CVE-2026-110152 does the same on Android through a buffer overflow in ANGLE. We have logged your exposure. (1/2)

Critical Nextcloud Collabora Flaw Enables Unauthenticated Command Execution Through Built-in CODE Server

https://thecybersecguru.com/exploits/nextcloud-cve-2026-110447-collabora-rce/

🚨 Rapid Response | Collabora Online Built-in CODE Server OS Command Injection (CVE-2026-110447) (CVSS 9.2) is a critical OS command injection vulnerability affecting the Collabora Online Built-in CODE Server app for Nextcloud. Exploitation in the wild has been reported, allowing unauthenticated attackers to execute operating system commands.
Censys currently detects 19,454 Internet-exposed hosts and 103,350 web properties with the app installed. These figures represent detected installations, not confirmed vulnerable instances.

Organizations should upgrade to version 26.4.303 or later, or remove the app. Disabling it is not sufficient.

Full Censys ARC advisory, including affected versions, exploitation indicators, and remediation guidance: https://censys.com/advisory/cve-2026-110447/

#CensysARC #Cybersecurity #VulnerabilityManagement #Nextcloud #InfoSec

@Sempf Nextcloud Collabora Online zero-day https://github.com/CollaboraOnline/richdocumentscode/issues/354#issuecomment-6164261298
CVE-2026-110447

“Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud.”

https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/

patch diffed CVE-2026-65674, as a derserialization in mssql sounds interesting. seems to be in mssql polybase specifically, so an optional component for integrating external databases.

⚠️ CRITICAL: Critical BlockStrap flaw lets hackers run code on Magento servers

A critical RCE vulnerability (CVE-2026-103849, BlockStrap) in Magento and Adobe Commerce allows unauthenticated attackers to execute arbitrary PHP code on affected servers. The flaw impacts Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3. No active exploita…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

Critical BlockStrap flaw lets hackers run code on Magento servers

Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce,...

🔗️ [Bleepingcomputer] https://link.is.it/ObhNuL

Sansec detailed BlockStrap (CVE-2026-103849), a maximum-severity improper neutralization flaw in Magento and Adobe Commerce enabling code execution. Internet-facing commerce servers face full compromise if left unpatched. #BlockStrap #Magento #AdobeCommerce

https://cyberworldops.eu/en/blockstrap-flaw-exposes-magento-and-adobe-commerce-servers-to-code

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: https://patchorpass.beehiiv.com/?v=2

#homelab #infosec #selfhosted #sysadmin

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: https://patchorpass.beehiiv.com

#homelab #infosec #selfhosted #sysadmin

CW: Biztonság — CVE-2026-104935 (CVSS 8.6) aktívan kihasznált Ivanti Connect Secure zero-day; a CISA KEV-be került, szövetségi határidő frissítésre: okt. 16. A Volexity három 0‑dayt talált, Ivanti okt.13-án kettőt javított. Microsoft Patch Tuesday: 1407 CVE, új rekord. #infosec #CVE #Linux #OpenSource

https://linuxmint.hu/hir/2026/10/a-cisa-aktivan-kihasznalt-ivanti-serulekenysegre-figyelmeztet-rekordot-dontott-a

New.

Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229) https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/ @Rapid7Official #infosec #GitLab #vulnerability #threatresearch

GitLab CVE-2026-97229: The CVSS 10.0 RCE Vulnerability Exposing 26,000+ CI/CD Pipelines to Attack

https://thecybersecguru.com/exploits/gitlab-cve-2026-97229-rce/

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

CVE-2026-80775 (Futex)
This is a use-after-free caused when two tasks that share an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH.

CVE-2026-98385 (Scheduler)
This is a use-after-free caused when scheduler cache accounting continues to update per-CPU statistics belonging to a previously freed mm_struct. The vulnerable path is reached when CONFIG_SCHED_CACHE is enabled, scheduler cache is active at runtime, and the CPU topology contains multiple LLCs.

CVE-2026-97941 (SLAB)
This is a list corruption caused by a race between returning a freelist and removing a slab from the node partial list during SLUB object refill. The public trigger causes a kernel panic.

https://www.openwall.com/lists/oss-security/2026/10/16/36

#infinitycore #infosec #cybersecurity

CVE-2026-107570 : cette fois c'est sûr on va tous mourir.

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

CVE-2026-80775 (Futex)
This is a use-after-free caused when two tasks that share an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH.

CVE-2026-98385 (Scheduler)
This is a use-after-free caused when scheduler cache accounting continues to update per-CPU statistics belonging to a previously freed mm_struct. The vulnerable path is reached when CONFIG_SCHED_CACHE is enabled, scheduler cache is active at runtime, and the CPU topology contains multiple LLCs.

CVE-2026-97941 (SLAB)
This is a list corruption caused by a race between returning a freelist and removing a slab from the node partial list during SLUB object refill. The public trigger causes a kernel panic.

https://www.openwall.com/lists/oss-security/2026/10/16/36

#infinitycore #infosec #cybersecurity

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

CVE-2026-80775 (Futex)
This is a use-after-free caused when two tasks that share an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH.

CVE-2026-98385 (Scheduler)
This is a use-after-free caused when scheduler cache accounting continues to update per-CPU statistics belonging to a previously freed mm_struct. The vulnerable path is reached when CONFIG_SCHED_CACHE is enabled, scheduler cache is active at runtime, and the CPU topology contains multiple LLCs.

CVE-2026-97941 (SLAB)
This is a list corruption caused by a race between returning a freelist and removing a slab from the node partial list during SLUB object refill. The public trigger causes a kernel panic.

https://www.openwall.com/lists/oss-security/2026/10/16/36

#infinitycore #infosec #cybersecurity

Langflow fixed CVE-2026-105740, a critical command injection enabling RCE with CVSS 9.9. Exploitation attempts have been observed, putting exposed AI workflow servers at immediate risk. Patch to 1.9.0 and review logs for compromise. #Langflow #RemoteCodeExecution #ThreatIntel

https://cyberworldops.eu/en/langflow-command-injection-draws-exploitation-attempts-as-version-190

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

CVE-2026-80775 (Futex)
This is a use-after-free caused when two tasks that share an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH.

CVE-2026-98385 (Scheduler)
This is a use-after-free caused when scheduler cache accounting continues to update per-CPU statistics belonging to a previously freed mm_struct. The vulnerable path is reached when CONFIG_SCHED_CACHE is enabled, scheduler cache is active at runtime, and the CPU topology contains multiple LLCs.

CVE-2026-97941 (SLAB)
This is a list corruption caused by a race between returning a freelist and removing a slab from the node partial list during SLUB object refill. The public trigger causes a kernel panic.

https://www.openwall.com/lists/oss-security/2026/10/16/36

#infinitycore #infosec #cybersecurity

CVE-2026-81469: unquoted search path in Dell Inventory Collector Client under 15.0.0 lets a local low-priv attacker run code and escalate privileges. CVSS 7.8, no patch yet. Isolate or remove the client until Dell ships a fix. https://www.valtersit.com/cve/CVE-2026-81469/ #CVE #infosec #Dell

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

PoC: https://github.com/code-zm/plex2shell

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

Source: https://zmain.info/blog/plex2shell

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

PoC: https://github.com/code-zm/plex2shell

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

Source: https://zmain.info/blog/plex2shell

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

PoC: https://github.com/code-zm/plex2shell

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

Source: https://zmain.info/blog/plex2shell

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

PoC: https://github.com/code-zm/plex2shell

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

Source: https://zmain.info/blog/plex2shell

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

PoC: https://github.com/code-zm/plex2shell

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

Source: https://zmain.info/blog/plex2shell

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

PoC: https://github.com/code-zm/plex2shell

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

Source: https://zmain.info/blog/plex2shell

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

PoC: https://github.com/code-zm/plex2shell

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

Source: https://zmain.info/blog/plex2shell

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

PoC: https://github.com/code-zm/plex2shell

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

Source: https://zmain.info/blog/plex2shell

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

CVE-2026-80775 (Futex)
This is a use-after-free caused when two tasks that share an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH.

CVE-2026-98385 (Scheduler)
This is a use-after-free caused when scheduler cache accounting continues to update per-CPU statistics belonging to a previously freed mm_struct. The vulnerable path is reached when CONFIG_SCHED_CACHE is enabled, scheduler cache is active at runtime, and the CPU topology contains multiple LLCs.

CVE-2026-97941 (SLAB)
This is a list corruption caused by a race between returning a freelist and removing a slab from the node partial list during SLUB object refill. The public trigger causes a kernel panic.

https://www.openwall.com/lists/oss-security/2026/10/16/36

#infinitycore #infosec #cybersecurity

CVE-2026-81376: VS Code RCE via Security Feature Bypass; $4,000 bounty.

Write-up: https://samchen.blog/blog/vscode-nested-form-to-rce

CVE-2026-81376: VS Code RCE via Security Feature Bypass; $4,000 bounty.

Write-up: https://samchen.blog/blog/vscode-nested-form-to-rce

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

CVE-2026-80775 (Futex)
This is a use-after-free caused when two tasks that share an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH.

CVE-2026-98385 (Scheduler)
This is a use-after-free caused when scheduler cache accounting continues to update per-CPU statistics belonging to a previously freed mm_struct. The vulnerable path is reached when CONFIG_SCHED_CACHE is enabled, scheduler cache is active at runtime, and the CPU topology contains multiple LLCs.

CVE-2026-97941 (SLAB)
This is a list corruption caused by a race between returning a freelist and removing a slab from the node partial list during SLUB object refill. The public trigger causes a kernel panic.

https://www.openwall.com/lists/oss-security/2026/10/16/36

#infinitycore #infosec #cybersecurity

@HonkHase
Es ist nicht das Datum selbst, sondern eine leichte Abwandlung.

Mit dem auf vielen Unix-Linuxsystemen standardnässig verfügbaren Uralt-Kommandozeilen-Taschenrechner lässt sich das Passwort für gestern mit folgenden zwri Eingabezeilen errechnen:

ibase=16
10152610 / 15

Die "10", "15" und "26" oben sind Monat, Tag und Jahr; `ibase=16` sagt, dass die als Hex- statt Dezimalsequenzen zu interpretieren seien. Das Passwort sind die letzten 5 Ziffern des Resultats.

https://ironhackers.es/en/danfoss-ak-sm-800a-cve-2025-41450/#the-code-of-the-day

CVE-2025-29009: Medical Prescription Attachment Plugin for WooCommerce Unauthenticated Arbitrary File Upload

CVSS: 10

PoC: https://github.com/Nxploited/CVE-2025-29009

Deep-Dive into Android Binder UaF (CVE-2023-20938) using Time-Travel Debugging https://www.eshard.com/blog/kernel-uaf-1-trigger

@theorangetheme CVE going 6-digits? Yes and no. We had a few 6-digits in past years due to sparse assignment - hell, 2015 it went 7 digits with CVE-2015-1142857. But afaik 2026 is the first year we hit 6 digits naturally?

But also: the one before we go 6 digits being a Kernel vuln that sounds rather innocuous in the official description but is actually apparently a pretty severe sandbox escape and all that.

This one slipped through the cracks this past Patch Tuesday because the CVE started with 2025: CVE-2025-61624 (5.4 medium) path traversal > aribtrary write/delete
https://fortiguard.fortinet.com/psirt/FG-IR-26-122

Unit 42's blog post states it was exploited in the wild: https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/

The attackers exploited another vulnerability, CVE-2025-61624, via FortiOS auto-script path traversal. This exploit facilitated the deployment of PEERSTITCH, a novel, memory-resident ARM64 malware.

#threatintel #eitw #CVE #fortinet #ioc

Drupal alert, site owners... patch.

CVE-2026-108097: A remote code execution vulnerability in Drupal core’s Field UI module that could allow attackers to execute arbitrary code on affected servers.

CVE-2026-108099: A flaw in Entity List, a contributed module for creating entity lists without Views, that could enable remote code execution

https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/amp/

#drupal #cybersecurity

Drupal Patches Critical Remote Code Execution Flaws in Core and Entity List Modules

Drupal released emergency patches for two critical remote code execution vulnerabilities (CVE-2026-108097 and CVE-2026-108099) that allow unauthenticated attackers to take control of web servers.

**If you run a Drupal website, update it immediately to version 10.6.19, 11.3.19 or 11.4.10, and update the Entity List module to 3.0.10. Attackers are expected to start exploiting these flaws within hours of the publication of the advisory. If you can't update, uninstall the Field UI module as a temporary fix. If you are on an older, unsupported Drupal version, upgrade as soon as possible because no patch is coming.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/drupal-patches-critical-remote-code-execution-flaws-in-core-and-entity-list-modules-o-r-w-b-p/gD2P6Ple2L

Drupal alert, site owners... patch.

CVE-2026-108097: A remote code execution vulnerability in Drupal core’s Field UI module that could allow attackers to execute arbitrary code on affected servers.

CVE-2026-108099: A flaw in Entity List, a contributed module for creating entity lists without Views, that could enable remote code execution

https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/amp/

#drupal #cybersecurity

Drupal Patches Critical Remote Code Execution Flaws in Core and Entity List Modules

Drupal released emergency patches for two critical remote code execution vulnerabilities (CVE-2026-108097 and CVE-2026-108099) that allow unauthenticated attackers to take control of web servers.

**If you run a Drupal website, update it immediately to version 10.6.19, 11.3.19 or 11.4.10, and update the Entity List module to 3.0.10. Attackers are expected to start exploiting these flaws within hours of the publication of the advisory. If you can't update, uninstall the Field UI module as a temporary fix. If you are on an older, unsupported Drupal version, upgrade as soon as possible because no patch is coming.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/drupal-patches-critical-remote-code-execution-flaws-in-core-and-entity-list-modules-o-r-w-b-p/gD2P6Ple2L

🏆 New Achievement! Field UI Has Entered The Raid!

PHASE ONE MECHANIC DETECTED. Drupal core's Field UI module is the weak point — CVE-2026-108097, critical severity, remote code execution. Solo it can't one-shot you, but stack a contributed module on top and suddenly you're getting chain-pulled by an unauthenticated attacker across Drupal 8.9 through 12. This is a full-party wipe condition, raiders.

CALLOUT: At least one known exploit path requires zero authentication. Zero. (1/2)

@bagder fair enough. How about situations where no users are affected yet, such as curl's master branch?
E.g. bugs from OSS-Fuzz on the master branch only that does not reproduce when run on a supported release?
Same for static analyzers, such as Coverity, etc.
Can these be automated, so all you need to do is confirm that it doesn't affect previous releases, and you wouldn't have to manually watch and copy the reports from N different sources?

Similarly I don't know if you could convince one of the AI tool users to send you all the bugs affecting master first (that they've already confirmed not to affect supported releases). Looking at your existing CVEs I see at least one that was recently introduced (CVE-2026-86415), that maybe could've been handled as a regular bug if they prioritised master first.
Although no CVE then, but maybe you can come up with another system to "reward" findings like this. Number and severity of CVEs avoided thanks to researcher X, or tool Y should be just as important as those found in existing releases.
(In fact since you're a CNA you could assign CVEs to these, no need for another system, with only git commits as the affected range, if the CVE rules and metadata allow for that?)

Although this won't help with the flood of issues on existing releases, at least new releases are going to be less likely to increase the bug count.

@ajn142 @theorangetheme good catch! Yep, mixed that up with CVE-2014-1000000 (which was just a test/demo record)

Security Advisory: CVE-2025-60492 - Uncontrolled Recursion in GPAC/MP4Box

Processing a crafted MP4 file with specially constructed BIFS scene data causes unbounded recursion between BIFS decoder functions, exhausting the stack and crashing MP4Box.

Summary:
The `gf_bifs_dec_node` function in `bifs/field_decode.c` decodes MPEG-4 BIFS scene nodes by calling `BD_DecMFFieldList`, `gf_bifs_dec_field`, and `gf_bifs_dec_node_list`, which in turn call back into `gf_bifs_dec_node`. A crafted MP4 file with deeply or cyclically nested BIFS containers triggers this mutual recursion without a depth limit, consuming all available stack memory and crashing the process with a stack-overflow signal.

CWE:
CWE-674 - Uncontrolled Recursion

Affected Component:
```
bifs/field_decode.c:905
Function: gf_bifs_dec_node()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1687-ge44a4e2b0-master; commit `e44a4e2b0d193566619ada71599e70255699da94`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose embedded BIFS scene data contains deeply nested or mutually referencing node containers. Local access is required; the victim must invoke `MP4Box -x3d <crafted_file>` or any equivalent BIFS scene export command that triggers the recursive decoder path.

Impact:
The uncontrolled recursion exhausts the process stack, resulting in an immediate crash and Denial of Service. No evidence of arbitrary code execution was observed; stack-exhaustion crashes via recursion do not provide an exploitable control-flow primitive.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
8e7b9a3a04331286b89d1803c65a2d6edc11b4c4
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3324
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/59/59_Anchor_Create_scenegraph_mpeg4_nodes_c_171
- Fix: https://github.com/gpac/gpac/commit/8e7b9a3a04331286b89d1803c65a2d6edc11b4c4

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60488 - NULL Pointer Dereference in GPAC/MP4Box

Processing a crafted MP4 file with a missing Sample Description box triggers a NULL pointer dereference in `dump_isom_saps`, causing MP4Box to crash.

Summary:
The `dump_isom_saps` function in `applications/mp4box/filedump.c` iterates over track metadata to dump SAP (Sync Access Point) information. When the input MP4 contains a corrupted track structure where the Sample Description box (`stsd`) is absent, the function accesses track metadata pointers without prior validation, dereferencing a near-NULL address (0x1c, 28-byte struct offset) and triggering SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
applications/mp4box/filedump.c:1743
Function: dump_isom_saps()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1672-gc9a31d0e1-master; commit `c9a31d0e1b649a30814c6d81c5461859ed63d075`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MP4 file whose track structure lacks a valid `stsd` box. Local access is required; the victim must invoke `MP4Box -dsap 1 <crafted_file>` or any equivalent SAP analysis command that exercises the SAP dump path.

Impact:
The near-NULL pointer dereference (READ at address 0x00000000001c) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a near-NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e6d01820d7bf3967d931fedb379ee5f209bc133b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3321
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/57/57_dump_isom_saps_filedump_c_1743
- Fix: https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60487 - NULL Pointer Dereference in GPAC/MP4Box

Processing an empty XML file with the `-dnal` option triggers a NULL pointer dereference in `gf_isom_get_esd`, causing MP4Box to crash.

Summary:
The `gf_isom_get_esd` function in `isomedia/isom_read.c` retrieves an Elementary Stream Descriptor for a given track. When processing an empty file with an `.xml` extension, the ISO media layer lacks a valid media descriptor structure; the function dereferences a near-NULL pointer at address 0x50 (80-byte struct offset) without validating the pointer beforehand, terminating the process with SIGSEGV.

CWE:
CWE-476 - NULL Pointer Dereference

Affected Component:
```
isomedia/isom_read.c:1386
Function: gf_isom_get_esd()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1665-g3f20eb0cd-master; commit `3f20eb0cd22116367c036e6ffe6ace299b38d686`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies an empty or minimal file with an `.xml` extension. Local access is required; the victim must invoke `MP4Box -dnal 1 <crafted_file>.xml` or any equivalent NAL dump command that triggers the ESD retrieval path on an uninitialized media context.

Impact:
The near-NULL pointer dereference (READ at address 0x000000000050) causes an immediate process crash, resulting in Denial of Service. No evidence of arbitrary code execution was observed; the faulting access is a near-NULL read that is not exploitable for control-flow hijacking.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e6d01820d7bf3967d931fedb379ee5f209bc133b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3320
- PoC: N/A (see issue)
- Fix: https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60490 - Use-After-Free in GPAC/MP4Box

Processing a crafted MPEG-2 Transport Stream file triggers a heap use-after-free in `gf_filter_pid_send_event_downstream` when a freed PID instance is accessed during event propagation.

Summary:
When parsing a crafted MPEG-2 TS file with malformed PMT descriptors and sync marker violations, `gf_filter_pid_inst_swap_delete` frees a PID instance at `filter_pid.c:551`. A stale reference to this freed 344-byte region is subsequently read in `gf_filter_pid_send_event_downstream` at line 7919 (READ of 8 bytes at offset 0 of the freed object) because the pointer is not cleared after deallocation.

CWE:
CWE-416 - Use After Free

Affected Component:
```
filter_core/filter_pid.c:7919
Function: gf_filter_pid_send_event_downstream()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
2.5-DEV-rev1665-g3f20eb0cd-master; commit `3f20eb0cd22116367c036e6ffe6ace299b38d686`. Any codebase equivalent to this commit that has not applied the fix commit is affected.

Attack Conditions:
An attacker supplies a crafted MPEG-2 TS file containing broken PMT descriptor sizes, unsupported stream types, and missing sync markers. Local access is required; the victim must invoke `MP4Box -add <crafted_file> -new /dev/null` or any equivalent import command that triggers the filter PID event propagation path.

Impact:
The use-after-free (READ of size 8 at offset 0 inside a freed 344-byte heap region) results in process termination, causing Denial of Service. Arbitrary code execution is possible; the first MITRE request explicitly marks code execution impact as true, and use-after-free vulnerabilities at the start of a controlled heap object are a known code-execution primitive.

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
d0793f92e04fe284a25c2a9335cc5edc68deb6d4
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3315
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/54/54_gf_filter_pid_send_event_downstream_filter_core_filter_pid_c_7919
- Fix: https://github.com/gpac/gpac/commit/d0793f92e04fe284a25c2a9335cc5edc68deb6d4

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60478 - Heap Use-After-Free in GPAC Packet Destruction

Processing a crafted MPEG-2 TS input with MP4Box DASH segmentation can trigger a heap use-after-free in `gf_filter_packet_destroy()`.

Summary:
Malformed program table data and empty DASH segment state can cause GPAC to mishandle packet ownership. The file output and PID packet drop path later destroy a packet object that has already been invalidated.

AddressSanitizer reports `heap-use-after-free` in `filter_core/filter_pck.c`.

CWE:
CWE-416 - Use After Free

Affected Component:
```
filter_core/filter_pck.c:678
Function: gf_filter_packet_destroy()
```

Relevant ASAN stack:

```
gf_filter_packet_destroy filter_core/filter_pck.c:678
gf_filter_packet_destroy filter_core/filter_pck.c:684
gf_filter_pid_drop_packet filter_core/filter_pid.c:7270
fileout_process filters/out_file.c:933
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
GPAC version: 2.5-DEV-rev1617-g856674b22-master
Commit: 856674b226d6cbe28a941ad223be38194cbf7d37
```

Attack Conditions:
An attacker supplies a crafted MPEG-2 TS file that is processed by MP4Box DASH segmentation:

```
./MP4Box -dash 100 47_gf_filter_packet_destroy_filter_core_filter_pck_c_678
```

Impact:
The observed impact is Denial of Service. Because the issue is a heap use-after-free, memory corruption risk is also present.

Fix / mitigation status:
The MITRE response in the local data records the fix as:

```
c592a144bbe339ee581ca88aaa3247362795b742
```

References:

- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60478
- Issue: https://github.com/gpac/gpac/issues/3300
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/47/47_gf_filter_packet_destroy_filter_core_filter_pck_c_678
- Fix: https://github.com/gpac/gpac/commit/c592a144bbe339ee581ca88aaa3247362795b742

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60482 - Use-After-Free in GPAC MP4Box AC-4 Descriptor Cleanup

Processing a crafted AC-4 stream with MP4Box can trigger a heap use-after-free in `gf_odf_ac4_cfg_clean_list()`.

Summary:
The recursive AC-4 descriptor cleanup path can revisit or count a list object that has already been freed. When MP4Box imports a crafted AC-4 input, descriptor destruction reaches `gf_odf_ac4_cfg_clean_list()` and then `gf_list_count()` on stale heap memory.

AddressSanitizer reports `heap-use-after-free`.

CWE:
CWE-416 - Use After Free

Affected Component:
```
odf/descriptors.c:2411
Function: gf_odf_ac4_cfg_clean_list()

utils/list.c:664
Function: gf_list_count()
```

Relevant ASAN stack:

```
gf_list_count utils/list.c:664
gf_odf_ac4_cfg_clean_list odf/descriptors.c:2411
gf_odf_ac4_cfg_clean_list odf/descriptors.c:2400
dac4_box_del isomedia/box_code_base.c:9218
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
GPAC version: 2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted AC-4 file that is imported by MP4Box:

```
./MP4Box -add 46_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2411 -new /dev/null
```

Impact:
The observed impact is Denial of Service. Because the bug is a heap use-after-free, memory corruption risk is also present.

Fix / mitigation status:
The MITRE response in the local data records the fix as:

```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```

References:

- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60482
- Issue: https://github.com/gpac/gpac/issues/3297
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/46/46_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2411
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b

Credit
Alexander A. Shvedov (@sigdevel)

#fuzzing #infosec #security #afl++ #revers #cybersecurity #bugbounty #vulnerability #opensource #linux #cve #advisory #gpac

Security Advisory: CVE-2025-60480 - Heap Buffer Overflow in GPAC MP4Box AC-4 Alternative Info Parsing

A heap buffer overflow vulnerability exists in GPAC MP4Box when processing a crafted AC-4 stream. The issue occurs in `gf_odf_ac4_cfg_alternative_info()` in `odf/descriptors.c` and can be triggered by running MP4Box with the `-info` option on a malformed input file.

Summary:
AddressSanitizer confirms a heap-buffer-overflow at `odf/descriptors.c:1899`. The vulnerable code reads 1 byte past the end of an allocated buffer due to insufficient bounds checking of AC-4 `alt_group_id` array indexes.

The crafted AC-4 stream reaches AC-4 descriptor generation and causes `gf_odf_ac4_cfg_alternative_info()` to access `alt_group_id` data outside the bounds of an allocated buffer. The allocation originates while parsing the raw AC-4 frame, and the out-of-bounds read occurs later while writing AC-4 descriptor information.

Relevant AddressSanitizer trace:

```
==1847116==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x518000000f90
READ of size 1 at 0x518000000f90 thread T0
#0 0x... in gf_odf_ac4_cfg_alternative_info odf/descriptors.c:1899
#1 0x... in gf_odf_ac4_cfg_presentation_v1_dsi odf/descriptors.c:2103
#2 0x... in gf_odf_ac4_cfg_dsi_v1 odf/descriptors.c:2233
#3 0x... in gf_odf_ac4_cfg_write_bs odf/descriptors.c:2281
#4 0x... in gf_odf_ac4_cfg_write odf/descriptors.c:2288
#5 0x... in ac4dmx_check_pid filters/reframe_ac4.c:238
#6 0x... in ac4dmx_process filters/reframe_ac4.c:403
#7 0x... in gf_filter_process_task filter_core/filter.c:3187
#8 0x... in gf_fs_thread_proc filter_core/filter_session.c:2421
#9 0x... in gf_fs_run filter_core/filter_session.c:2728
#10 0x... in gf_media_import media_tools/media_import.c:1278
#11 0x... in convert_file_info applications/mp4box/fileimport.c:131
#12 0x... in mp4box_main applications/mp4box/mp4box.c:6520

0x518000000f90 is located 0 bytes after 784-byte region [0x518000000c80,0x518000000f90)
allocated by thread T0 here:
#0 0x... in malloc
#1 0x... in gf_ac4_raw_frame media_tools/av_parsers.c:15916
#2 0x... in gf_ac4_parser_bs media_tools/av_parsers.c:16113

SUMMARY: AddressSanitizer: heap-buffer-overflow odf/descriptors.c:1899 in gf_odf_ac4_cfg_alternative_info
```

CWE:
CWE-122 - Heap-based Buffer Overflow

Affected Component:
```
odf/descriptors.c:1899
Function: gf_odf_ac4_cfg_alternative_info()
```

Affected Product:
MP4Box (GPAC Multimedia Open Source Project)

Affected Version:
```
2.5-DEV-rev1593-gfe88c3545-master
Commit: fe88c3545aadd597b250ccf23271d5d3de50ccc8
```

Attack Conditions:
An attacker supplies a crafted input file that is processed by MP4Box. The issue can be reproduced locally with:
```
./MP4Box -info 44_gf_odf_ac4_cfg_alternative_info_odf_descriptors_c_1899
```

Attack vector: local crafted AC-4 file processed by MP4Box
User interaction: required

Impact:
denial of service via application crash; local MITRE data also identifies potential arbitrary code execution risk

Fix / mitigation status:
The issue was fixed in GPAC commit:
```
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
```
Users should update to a GPAC build containing this commit or later.

References:

- Issue: https://github.com/gpac/gpac/issues/3295
- Fix: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b
- PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/44/44_gf_odf_ac4_cfg_alternative_info_odf_descriptors_c_1899
- CVE: https://www.cve.org/CVERecord?id=CVE-2025-60480