Overview of incoming advisories.
2018 results found
A critical security vulnerability has been identified in itsourcecode Online Medicine Delivery System version 1.0. The flaw resides in the doInsert function within /rider/orders/controller.php?action=add, part of the Order Management Controller component. By manipulating the 'image' argument, an attacker can perform an unrestricted file upload, potentially leading to remote code execution (RCE). The vulnerability is remotely exploitable without requiring physical access to the target system. A public exploit has already been released, increasing the risk of active exploitation in the wild. The affected system is a PHP-based web application used for managing medicine delivery orders. This issue is classified as high severity due to its public exploit availability and remote exploitability. Organizations using this software should apply patches or mitigations immediately.
View original advisory →Checkmate versions through 3.11.0 contain a missing authorization vulnerability where the isAllowed role guard middleware is omitted on maintenance-window, notification, and check-deletion routes. This flaw allows read-only users with standard user-role sessions to perform administrative actions without proper privilege checks. Attackers can exploit this to create arbitrary maintenance windows that silence monitoring alerts, modify notification channels, and delete monitor check history to erase evidence of incidents. The vulnerability affects three distinct route files: checkRoutes.ts, maintenanceWindowRoutes.ts, and notificationRoutes.ts. The issue has been reported via GitHub issue #3916 and documented by VulnCheck. The impact is significant as it allows tampering with monitoring integrity and incident response capabilities.
View original advisory →Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform. The flaw allows remote code execution, enabling attackers to deploy reverse shells on vulnerable systems. No authentication is required to exploit the vulnerability, making it particularly dangerous for exposed deployments. The Sangoma Switchvox platform is a widely used VoIP and unified communications solution in enterprise environments. Active exploitation in the wild significantly raises the risk for organizations that have not patched their installations.
View original advisory →A critical SQL injection vulnerability has been discovered in the All-in-One WP Migration and Backup plugin for WordPress, a widely used plugin with millions of active installations. The flaw allows unauthenticated attackers to exploit the vulnerability without any prior authentication or privileges. Successful exploitation can lead to remote code execution, enabling attackers to take full control of affected WordPress websites. The vulnerability poses a significant risk given the plugin's large install base, potentially exposing millions of sites to takeover attacks. Website administrators are urged to update the plugin immediately to a patched version to mitigate the risk.
View original advisory →An active malware campaign is distributing malicious software installers through bogus download websites that impersonate trusted software vendors. The campaign primarily targets Chinese-speaking users and China-based operations of multinational organizations. Victims are lured into downloading fake versions of popular software, which then disable Windows Update and weaken Microsoft Defender protections. The attack has resulted in compromises across multiple organizations and industries. By disabling security mechanisms, the malware leaves systems vulnerable to further exploitation and persistence. Microsoft has identified and reported on this campaign, highlighting its broad impact on enterprise environments.
View original advisory →A critical authentication bypass vulnerability tracked as CVE-2026-82329 has been discovered in JFrog Artifactory and is being actively exploited in the wild. Attackers are leveraging the flaw to forge tokens that grant full administrative access to affected Artifactory instances. The vulnerability allows threat actors to bypass authentication controls entirely, posing a severe risk to organizations using JFrog Artifactory for software artifact management. Successful exploitation could allow attackers to manipulate build artifacts, inject malicious packages into the software supply chain, or exfiltrate sensitive data. Organizations are urged to apply patches immediately and audit existing admin tokens for signs of unauthorized creation.
View original advisory →Manifold Security has disclosed eight security flaws across seven command-line AI coding agents, including Claude, Codex, and Cursor. The vulnerabilities allow a malicious Git configuration file within a repository to name a command that the AI agent will execute on the developer's machine. The execution occurs as the user, bypassing the agent's sandbox and without triggering any approval prompt. Exploitation requires only that the malicious repository be cloned or opened by the developer. At the time of publication, four of the eight flaws remained unpatched. This class of vulnerability represents a supply chain and social engineering risk, as developers may unknowingly run attacker-controlled code simply by interacting with a repository. The attack surface is broad, affecting multiple widely-used AI-assisted development tools.
View original advisory →Hackers executed a Border Gateway Protocol (BGP) hijack to divert traffic intended for Softaculous, the distributor of the Virtualizor control panel software. The diverted traffic was used to deliver a malicious Virtualizor package to targeted installations. At least one hosting provider confirmed that 5 out of 34 checked Virtualizor hypervisors were compromised at the root level. The attack established persistent root access on affected systems. The incident window began approximately August 28 at 20:57. This represents a sophisticated supply chain attack combining network-level manipulation with software update poisoning. The attack targeted server virtualization infrastructure, potentially exposing all virtual machines hosted on compromised hypervisors. The use of BGP hijacking indicates a highly capable threat actor with access to routing infrastructure.
View original advisory →Dropbox is warning users that an unauthorized party accessed accounts by exploiting a flaw in Lenovo's email verification process. Attackers used the flaw to register fraudulent Lenovo IDs, which were then leveraged to gain unauthorized access to Dropbox accounts. The vulnerability resided in Lenovo's identity and authentication pipeline, enabling account takeover without the victim's credentials. This incident highlights risks associated with third-party identity provider integrations and cross-platform authentication dependencies. Affected Dropbox users are being notified of the breach. The attack vector involves abusing the trust relationship between Dropbox and Lenovo's verification system. No specific CVE has been mentioned in the article content provided.
View original advisory →SonicWall has released security updates addressing two zero-day vulnerabilities in its Secure Mobile Access (SMA) 1000 series VPN appliances. The flaws were discovered internally by SonicWall researchers William Perry and Adam Babis. One of the vulnerabilities, CVE-2026-83548, carries a maximum CVSS score of 10.0 and is a pre-authentication Server-Side Request Forgery (SSRF) vulnerability. The two vulnerabilities may form an attack chain, potentially allowing attackers to escalate their access or impact. Active exploitation in the wild has been confirmed, classifying these as zero-day vulnerabilities. SonicWall has urged users to apply the released patches immediately to mitigate risk.
View original advisory →Unit 42 investigated a real-world cyberattack in which an attacker leveraged autonomous AI agents to breach an enterprise network within hours. The incident highlights the emerging threat of agentic AI being weaponized for offensive cyber operations. The attacker used AI to accelerate and automate various stages of the attack lifecycle. This case represents a significant evolution in attack sophistication and speed. The article aims to help defenders understand agentic attack techniques and how to mitigate them. Organizations are urged to adapt their defenses to account for AI-driven threat actors.
View original advisory →SonicWall has patched two zero-day vulnerabilities in its SMA1000 Appliance that were actively exploited in the wild. The first vulnerability is a pre-authentication Server-Side Request Forgery (SSRF) in the Work Place interface, allowing unauthenticated remote attackers to perform unauthorized actions. The second vulnerability enables post-authentication remote code execution, allowing attackers with valid credentials to execute arbitrary code remotely. Both vulnerabilities have been confirmed as actively exploited zero-days. The Dutch NCSC (National Cyber Security Centre) urges organizations to follow SonicWall's advisory and apply the available patches immediately. The combination of an unauthenticated SSRF and an authenticated RCE poses a significant risk to organizations using this appliance.
View original advisory →Two vulnerabilities in GeoNetwork, the open-source geospatial metadata catalog, can be chained to achieve unauthenticated remote code execution (RCE). The flaws affect many government and agency geoportal backends that rely on GeoNetwork. Fixes were shipped in versions 4.4.12 and 4.2.17 on July 8, 2026, with full vulnerability details published on August 31, 2026. GeoNetwork originated at the United Nations Food and Agriculture Organization and is widely used in public sector infrastructure. The chained attack requires no authentication, making it particularly dangerous for exposed government systems. Organizations running GeoNetwork are urged to upgrade immediately to the patched versions.
View original advisory →Forescout Research - Vedere Labs demonstrated the use of Anthropic's Claude AI to port a pre-authentication remote code execution exploit from one WAGO programmable logic controller (PLC) model to another. The exploit targets CVE-2021-31886, a stack-based buffer overflow vulnerability in the Nucleus FTP server's handling of the USER command. Researchers successfully executed attacker-supplied ARM shellcode on live hardware, showcasing the potential of AI tools to accelerate exploit development and porting. This research highlights significant risks to industrial control systems and operational technology environments. The ability to leverage AI to adapt existing exploits lowers the barrier for attackers targeting critical infrastructure. WAGO PLCs are commonly used in industrial automation and critical infrastructure settings, amplifying the severity of this finding.
View original advisory →Threat actors are actively exploiting a critical security vulnerability in Sangoma Switchvox, an enterprise VoIP platform. The vulnerability, tracked as CVE-2026-9586, carries a CVSS score of 9.3 and affects Sangoma Switchvox SMB Edition 8.3 (build 104997). The flaw is an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary code without any credentials. Attackers are leveraging this vulnerability to deploy reverse shells on compromised systems. The unauthenticated nature of the exploit makes it particularly dangerous as no prior access or credentials are required. The critical severity and active exploitation make this a high-priority patching concern for organizations using the affected VoIP platform.
View original advisory →SonicWall has issued a warning to customers regarding two newly discovered zero-day vulnerabilities affecting its SMA1000 series appliances. Threat actors are actively chaining these two flaws together to achieve remote code execution. The vulnerabilities are being exploited in the wild, making them a critical and immediate threat. SonicWall has urged customers to apply patches or mitigations as soon as possible. The SMA1000 product line is used for secure remote access in enterprise environments, making it a high-value target. The chaining of two zero-days suggests a sophisticated threat actor. No CVE identifiers were specified in the available content. Organizations using SMA1000 devices should treat this as a high-priority incident response situation.
View original advisory →Kludex Starlette contains an HTTP request/response smuggling vulnerability tracked as CVE-2026-48710. The flaw allows attackers to inject paths into the host part of a request, prepending the actual path and potentially causing authentication bypass when authentication logic depends on the reconstructed URL path. This vulnerability can be chained with CVE-2026-42271 to amplify impact. It affects an open-source component that may be used by a wide range of products and implementations. CISA has catalogued this vulnerability under BOD 26-04, which prioritizes security updates based on risk. A security advisory has been published on GitHub by Kludex. Organizations using Starlette-based applications should apply patches promptly. The vulnerability is rated High criticality.
View original advisory →GitLab's Threat Research Group discovered a critical sandbox escape vulnerability (CVSS 3.1: 10.0) in vm2, a widely used Node.js sandboxing library with ~1.25 million weekly npm downloads. The flaw allows remote code execution when using the default configuration from vm2's own README, specifically when require.external is enabled with root set to './'. The attack works by requiring vm2's own package from within the sandbox, which loads through Node's real unsandboxed require() due to the default context: 'host' setting, then spinning up a second unrestricted NodeVM with access to child_process. The vulnerability was fixed in vm2 version 3.11.7, but the fix is narrow and broader configuration risks remain. Users relying on require.external with overly broad require.root settings remain vulnerable even after patching. GitLab recommends restricting require.root strictly, setting context: 'sandbox', and for truly untrusted code isolation, using containers or separate processes instead of vm2.
View original advisory →SonicWall SMA1000 Appliances contain a server-side request forgery (SSRF) vulnerability tracked as CVE-2026-83548. The flaw allows remote unauthenticated attackers to gain unauthorized access to sensitive functionality and perform unauthorized operations. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. SonicWall has published an advisory via its PSIRT portal. The vulnerability is rated high severity given its unauthenticated remote exploitation potential. Federal agencies and organizations using SMA1000 appliances are urged to apply patches promptly. CISA also references forensic triage requirements as part of the BOD 26-04 implementation guidance. The NVD entry provides additional technical details on the vulnerability.
View original advisory →Sangoma Switchvox contains a critical SQL injection vulnerability (CVE-2026-9586) that allows unauthenticated remote attackers to execute arbitrary SQL statements against the backend PostgreSQL database. Exploitation requires only a single crafted request, enabling database manipulation and remote code execution. The vulnerability is unauthenticated, significantly raising its severity and risk profile. CISA has listed this vulnerability under BOD 26-04, mandating prioritized patching for federal agencies. A patch is available in Switchvox version 8.4.0.2, released July 14, 2026. Organizations using Sangoma Switchvox should apply the update immediately. CISA also requires forensic triage for affected systems per BOD 26-04 implementation guidance.
View original advisory →