Overview of incoming advisories.
2018 results found
CVE-2026-11613 is a Local File Inclusion (LFI) vulnerability affecting the Divi Ajax Filter plugin for WordPress in all versions up to and including 5.1.2. The vulnerability exists in the 'custom_loop_template' parameter and allows unauthenticated attackers to include and execute arbitrary PHP files on the server. Exploitation requires the 'loop_templates' parameter to be set to 'custom-template'. Successful exploitation can lead to bypass of access controls, sensitive data disclosure, and remote code execution if PHP files can be uploaded to the server. The vulnerability is exploitable without authentication, significantly raising its risk level. WordPress site administrators using this plugin are advised to update immediately to a patched version.
View original advisory →A SQL injection vulnerability has been identified in code-projects Hospital Information System version 1.0. The flaw resides in the getSinglePresp function within the file includes/presp/PrespController.php. An attacker can manipulate the 'ID' argument to perform SQL injection attacks. The vulnerability is remotely exploitable, requiring no physical access to the target system. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a hospital management web application, making it potentially sensitive due to the nature of healthcare data it may handle. No authentication bypass details are specified, but the public availability of the exploit significantly raises the threat level.
View original advisory →CVE-2021-44320 affects Parrot AR.Drone versions 1 and 2, which lack adequate protection against denial-of-service (DoS) attacks. An attacker can exploit this weakness by performing IPv4 flood attacks, specifically SYN flooding and UDP flooding, to disrupt device availability. The impact includes loss of video streaming and control functionality. The vulnerability is inherent to the device's networking stack and its inability to mitigate flood-based attacks. No authentication or proximity bypass is required beyond network access. The CVE was published on NVD and supported by research publications and a proof-of-concept repository on GitHub. This affects consumer drones used for recreational and light commercial purposes, placing it in the IoT and network security domain.
View original advisory →IBM Operational Decision Manager (ODM) across multiple versions (9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1) is affected by a critical SQL injection vulnerability. An unauthenticated attacker can exploit this flaw to execute arbitrary SQL statements against the underlying database. The vulnerability can be further leveraged to write a web shell to the application web root, enabling full remote code execution. No authentication is required to exploit this vulnerability, significantly increasing its risk. The impact is critical as it allows complete server compromise. IBM has published an advisory with remediation guidance. Organizations using affected versions should prioritize patching immediately.
View original advisory →Snipe-IT versions prior to 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality. Restricted users can exploit this flaw to soft-delete user accounts outside their authorized scope. Attackers craft bulk delete requests that include unauthorized user IDs, bypassing instance-level access restrictions. This allows malicious restricted users to modify or disable accounts they should not have access to. The vulnerability poses a significant risk to organizations using Snipe-IT for IT asset management, as it can lead to unauthorized account manipulation. A fix has been released in version 8.6.3, and users are advised to upgrade immediately.
View original advisory →A privilege escalation vulnerability exists in DirectIo64.sys, a kernel driver used by PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016). The driver exposes IOCTLs with no validation on device selection, register offset, or value, allowing local users to gain elevated privileges. Attackers can obtain a device handle and issue arbitrary PCI configuration space read/write operations. Exploitation can enable Bus Master DMA on any PCI device, halt storage controller I/O by clearing command registers, or remap Base Address Registers to redirect DMA to attacker-controlled physical memory. The vulnerability is rooted in insufficient input validation within the exposed kernel-level IOCTL interface. Patches are available in the respective updated builds of each affected product.
View original advisory →A missing authorization vulnerability has been identified in the SonicWall Network Security Manager (NSM) On-Prem Management interface. The flaw allows a lower-privileged Admin user to escalate their privileges to SuperAdmin level. This represents a significant security risk as it can lead to unauthorized control over network security management functions. The vulnerability is tracked as CVE-2026-78328 and has been assigned a high criticality rating. SonicWall has published an advisory via their PSIRT portal under identifier SNWLID-2026-0015. Organizations running SonicWall NSM On-Prem deployments are advised to review the advisory and apply mitigations promptly. Privilege escalation vulnerabilities of this type can allow attackers with limited access to gain full administrative control over critical network security infrastructure.
View original advisory →Attackers compromised Coder's Cloudflare infrastructure to inject unauthorized registry servers into the platform. These rogue servers were used to deliver malicious Terraform modules containing credential-stealing code. The attack represents a supply chain compromise targeting developers using Coder's registry. By hijacking the infrastructure layer rather than the codebase directly, attackers could silently distribute malware to unsuspecting users. The credential-stealing payloads embedded in the Terraform modules pose a significant risk to affected organizations. This incident highlights the growing trend of supply chain attacks targeting developer tooling and infrastructure registries.
View original advisory →Hewlett Packard Enterprise (HPE) has released patches addressing a critical vulnerability in the ArubaOS-CX network operating system. The flaw could allow remote attackers to execute arbitrary code on affected devices. ArubaOS-CX is a widely deployed network operating system used in enterprise switching environments. The vulnerability poses significant risk to organizations relying on HPE Aruba networking infrastructure. HPE has urged customers to apply the patches promptly to mitigate potential exploitation. No specific CVE identifier was mentioned in the article excerpt provided.
View original advisory →Cisco has released patches for a critical vulnerability (CVE-2026-20212, CVSS 9.8) affecting 10 Silicon One-based Nexus 9000 switches. The flaw allows unauthenticated remote attackers to execute arbitrary code as root. Additionally, Cisco released an IOS XR hardening update bundling 7 umbrella CVEs, two of which are rated 9.8. No workarounds exist for any IOS XR version, making patching the only remediation. The severity and unauthenticated nature of the exploit make this a high-priority issue for network administrators running affected Cisco hardware.
View original advisory →Cybersecurity researchers have uncovered a sophisticated Python-based Windows malware framework called BraZetsu that supports an underground criminal marketplace. Unlike traditional infostealers, BraZetsu functions as a comprehensive master toolkit specifically designed to empower Initial Access Brokers (IABs). The malware turns compromised Windows systems into commercial inventory that can be sold or traded on underground markets. BraZetsu represents an evolution in the IAB ecosystem by automating and streamlining the process of monetizing access to compromised hosts. The framework's design suggests a highly organized criminal operation aimed at commercializing unauthorized system access at scale.
View original advisory →A critical vulnerability CVE-2026-32475 in the Elementor Pro WordPress plugin is being actively exploited in the wild. Attackers are leveraging the flaw to deliver webshell payloads onto compromised servers, enabling arbitrary command execution. The vulnerability has been patched, but exploitation is ongoing against unpatched installations. WordPress site owners using Elementor Pro are urged to apply the patch immediately. The attacks represent a significant risk as Elementor Pro is widely used across millions of WordPress sites, making the attack surface extremely large. Successful exploitation could lead to full site takeover and server compromise.
View original advisory →Thomson Reuters disclosed that an unauthorized party gained access to files from C-Track, a court case management platform operated by its West Publishing Corporation subsidiary. The breach occurred in March 2026 and was discovered on June 30, 2026. The incident affected courts across 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. Exposed data may include sensitive personal information such as Social Security Numbers (SSNs) and sealed court records. The breach raises serious concerns about the exposure of confidential legal data and the privacy of individuals involved in court proceedings. West Publishing is notifying affected courts and individuals. The scale of the breach and the sensitivity of the data involved make this a high-impact incident for both the legal system and affected individuals.
View original advisory →A critical stack-based buffer overflow vulnerability (CVE-2026-78012) has been identified in Pyramid Solutions NetStaX EtherNet/IP Stack versions prior to v5.6.1. The flaw allows a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning. Successful exploitation could result in memory corruption, device crash, or a potential remote attack vector. All eight product variants of the NetStaX stack are affected, including adapter and scanner kits with and without CIP Security. The vulnerability carries a CVSS v3.1 score of 9.8 (CRITICAL) and a CVSS v4.0 score of 9.3 (CRITICAL). It impacts critical infrastructure sectors including Critical Manufacturing, Energy, Water and Wastewater, and Chemical industries worldwide. The fix is available in NetStaX v5.6.1, which implements compile-time assertions, runtime payload-size checks, and improved documentation. No known public exploitation has been reported to CISA at this time.
View original advisory →A denial-of-service vulnerability (CVE-2025-10478) exists in the Rockwell Automation 1756-ENBT module, a ControlLogix EtherNet/IP bridge used to connect Logix 5000 controllers with Ethernet devices. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted CIP packet, causing the module to crash and requiring a manual restart to recover. The vulnerability is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions) and carries a CVSS v3.1 score of 7.5 (HIGH) and a CVSS v4.0 score of 8.7 (HIGH). All versions of the 1756-ENBT module are affected. Rockwell Automation recommends upgrading to 1756-EN2T or 1756-EN4TR as the primary mitigation. The vulnerability affects critical infrastructure sectors including Critical Manufacturing, Food and Agriculture, Transportation Systems, and Water and Wastewater. No known public exploitation has been reported at the time of publication. The advisory was initially released on September 3, 2026, and was reported to CISA by Rockwell Automation.
View original advisory →A critical vulnerability (CVE-2026-75925) has been identified in IXON VPN Client versions prior to 1.4.7, involving Improper Neutralization of CRLF Sequences (CWE-93). Successful exploitation allows an attacker to perform remote code execution with elevated privileges (root or SYSTEM) on the affected machine. The vulnerability stems from configuration values being written to a file consumed by a privileged subprocess without sanitizing line-ending sequences, and the configuration interface accepts changes without authentication (CWE-306). The injected configuration persists across restarts, making it stealthy as no behavioral changes are visible to users. CVSS v3.1 score is 9.6 (CRITICAL) and CVSS v4.0 score is 9.4 (CRITICAL). Affected sectors include Commercial Facilities, Critical Manufacturing, Energy, IT, and Water/Wastewater globally. IXON has mitigated the issue server-side by rejecting connections from clients below v1.4.7 as of August 5, 2026, and recommends updating to v1.4.7 or later. No known public exploitation has been reported to CISA at this time.
View original advisory →CISA has published an advisory for Rockwell Automation ArmorStart LT versions up to and including v2.001, which are affected by two vulnerabilities. CVE-2026-19471 is a stored cross-site scripting (XSS) vulnerability (CWE-79) that allows attackers to inject malicious scripts executed when other users access the affected page. CVE-2026-19472 is a denial-of-service vulnerability (CWE-770) caused by improper handling of crafted HTTP PUT requests to the embedded web server, resulting in loss of web server availability. Both vulnerabilities are remotely exploitable with no authentication required. The highest CVSS v3.1 score is 7.5 (HIGH) for the DoS vulnerability. Rockwell Automation has addressed both issues in firmware version v2.002 and encourages users to update. No known public exploitation has been reported. The affected product is deployed worldwide in Critical Manufacturing sectors.
View original advisory →A vulnerability (CVE-2026-12663) exists in Rockwell Automation ControlFLASH versions up to and including V15.07. The installer incorrectly grants write permissions to the 'Everyone' group on the product installation directory, enabling arbitrary code execution at the logged-in user's permission level. The vulnerability is classified as Missing Authentication for Critical Function (CWE-306) with a CVSS v3.1 score of 7.3 (HIGH). Affected critical infrastructure sectors include Critical Manufacturing, Energy, and Water and Wastewater. Rockwell Automation has released version 15.08 to address the issue. Users unable to upgrade can manually remove the 'Everyone' group from the ControlFLASH installation directory permissions. The vulnerability is not remotely exploitable and no known public exploitation has been reported. Rockwell Automation self-reported the vulnerability to CISA.
View original advisory →CISA has published an advisory for Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior, identifying three vulnerabilities: Use of Hard-coded Credentials (CVE-2026-77847), Cross-Site Request Forgery (CVE-2026-82712), and Missing Authorization (CVE-2026-82684). Successful exploitation could allow attackers to perform man-in-the-middle attacks, cause factory resets, wipe credentials, or retrieve sensitive information. The highest CVSS v3.1 score is 8.8 (HIGH) for the CSRF vulnerability. Affected devices are deployed worldwide in Critical Manufacturing and Energy sectors. Tycon Systems has released firmware v2.4.2 as a fix, with separate update artifacts for legacy (Intel HEX) and newer (signed .tfw container) units. The vulnerabilities were reported by Abdiwelli Guled to CISA. No known public exploitation has been reported at this time.
View original advisory →CISA published an ICS advisory for Inductive Automation Ignition versions 8.1.53 and earlier, affected by CVE-2026-77393, a high-severity vulnerability with a CVSS v3.1 score of 8.8. The vulnerability stems from the 'Create Project Role(s)' gateway setting shipping blank by default, allowing any authenticated user with gateway script execution capability to create projects. This is classified as CWE-276 (Incorrect Default Permissions). Affected sectors include Critical Manufacturing, Energy, and Information Technology. Remediation includes upgrading to Ignition 8.1.54 or later, or populating the 'Create Project Role(s)' setting to restrict project creation to authorized roles. The 8.3 series is not affected. No known public exploitation has been reported. The vulnerability was reported by Christopher Lusk of North Echo Security Research and independently confirmed by Elhussain Fathy (0xSphinx).
View original advisory →