Overview of incoming advisories.
2018 results found
CVE-2026-84696 affects Phison PS3111-S11 SSD controller firmware versions through SBFQT1.3, exposing privileged vendor unique commands (VUCs) over the ATA interface with weak or absent authentication. Attackers can bypass a CRC-16-based unlock handshake or exploit firmware builds that have no VUC lock entirely. Successful exploitation allows reading and writing to controller memory and raw NAND flash storage. This enables persistent implant installation that survives power cycles, making it a severe supply chain and hardware-level threat. The vulnerability requires physical or logical ATA interface access but no elevated OS privileges once interface access is obtained. Proof-of-concept tools and detailed technical research are publicly available on GitHub and researcher blogs. The exposure affects a widely used OEM SSD controller chip found in many consumer and enterprise storage devices. The lack of strong authentication on privileged commands represents a fundamental firmware security design flaw.
View original advisory →CVE-2026-52833 affects Nuclio, a serverless framework for real-time events and data processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file using Go's text/template package without proper escaping. The template renders runtimeAttributes.repositories[] values using the {{ . }} action, which performs no sanitization. An attacker can inject a closing brace character to break out of the repositories block and append arbitrary Groovy statements. These malicious statements execute unconditionally during the Gradle configuration phase, enabling potential remote code execution or build environment compromise. The vulnerability is classified as a template injection issue rooted in unsanitized user-controlled input. The issue has been patched in Nuclio version 1.16.5, with fixes available via the official GitHub repository.
View original advisory →Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. The flaw allows an authenticated low-privilege author to bypass the replacePeerFiles permission check by omitting the assetId parameter from a request. When sourceAssetId and targetFilename are supplied without assetId, the target asset is resolved by folder and filename after permission checks have already executed, meaning the replacePeerFiles permission is never enforced. This enables an attacker with only the replaceFiles permission on a shared folder to overwrite a peer's asset file with attacker-controlled bytes. The vulnerability is an authorization logic flaw stemming from the order of operations in the permission enforcement flow. It requires authentication but only low-privilege access. The issue has been patched in Craft CMS version 5.10.11.
View original advisory →CVE-2026-84699 affects Team Password Manager versions before 14.184.308, where the local account password reset flow fails to enforce authentication requirements. This critical flaw allows unauthenticated attackers to reset passwords for local accounts without any prior authentication. Once reset, attackers can log in as those users and gain unauthorized access to managed passwords and sensitive data. The vulnerability is classified as an authentication bypass in the password reset mechanism. A patch has been released in version 14.184.308, which also includes an updated Chrome extension (6.42.27). Organizations using Team Password Manager are strongly advised to upgrade immediately. The vulnerability was disclosed via NVD and VulnCheck advisories. Given that password managers store highly sensitive credentials, exploitation could have severe downstream consequences.
View original advisory →A path traversal vulnerability has been identified in Piwigo versions up to 16.3.0, affecting the i.php file within the Image Derivative Handler component. The flaw allows remote attackers to traverse file system paths without authentication. The vulnerability has been publicly disclosed with a proof-of-concept exploit available on GitHub, increasing the risk of active exploitation. Remote exploitation is possible without requiring local access or elevated privileges. The issue stems from improper input validation in the image derivative handling functionality. Organizations using Piwigo up to version 16.3.0 are advised to review and apply any available patches or mitigations. The public availability of the exploit raises the severity and urgency of remediation.
View original advisory →Craft CMS versions before 5.10.11 contain a critical authentication bypass vulnerability where the admin flag is not properly validated during user registration. This flaw allows the admin flag to persist from deactivated admin accounts. An attacker can exploit this by registering a new account using a deactivated administrator's email address, thereby inheriting full administrator privileges. The attack is feasible when the target instance has public registration enabled and email verification disabled. This represents a significant privilege escalation risk for affected deployments. The vulnerability has been assigned CVE-2026-84795 and has been patched in version 5.10.11. Organizations using Craft CMS with public registration should prioritize upgrading immediately.
View original advisory →CVE-2026-84353 is a critical use-after-free vulnerability in the Shared Tab Groups feature of Google Chrome on Android. Versions prior to 152.0.7977.75 are affected. A remote attacker can exploit this vulnerability through social engineering, tricking a user into visiting a crafted HTML page. Successful exploitation allows arbitrary code execution outside the browser sandbox, representing a full sandbox escape. The vulnerability has been assigned a Critical severity rating by the Chromium security team. Users are urged to update to Chrome 152.0.7977.75 or later on Android immediately.
View original advisory →A critical vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches allows an unauthenticated remote attacker to execute arbitrary code with root privileges. The flaw exists due to TCP ports 43210 and 43211 being accessible by default in the Layer 3 virtual routing and forwarding (VRF) context. An attacker can connect to these open ports and send specially crafted input to trigger code execution at the root level. Additionally, successful exploitation can crash the S1HAL process, potentially causing the affected device to reload and resulting in a denial of service condition. No authentication is required to exploit this vulnerability, significantly lowering the barrier for attackers. The vulnerability is tracked as CVE-2026-20212 and is currently awaiting full analysis by NVD. Cisco has published a security advisory with further details and remediation guidance.
View original advisory →ION-DTN versions prior to 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function. Unauthenticated remote attackers can exploit this by sending truncated SDNV values via UDP datagrams to the LTP link service input port. The vulnerability can trigger memory reads up to nine bytes past buffer boundaries and cause byte counter underflows. No authentication is required to exploit this flaw, making it accessible to any network-adjacent or remote attacker. The vulnerability has been patched in ION-DTN version 4.2.0. ION-DTN is NASA JPL's open-source implementation of the Delay-Tolerant Networking (DTN) protocol, commonly used in space communications infrastructure. A fix commit is available on GitHub along with a security advisory via GHSA-85pw-28vw-2jf7.
View original advisory →BookStack versions before 26.05.4 contain a stored cross-site scripting (XSS) vulnerability in the drawing upload endpoint. The endpoint accepts unvalidated base64 content and stores it without content inspection, allowing SVG files with embedded scripts to be uploaded. Attackers with editor-level permissions can exploit this by uploading malicious SVG files that execute scripts in administrator browsers when accessed via the image gallery API. The vulnerability is compounded by the absence of content-type validation and CSP headers. The issue has been patched in BookStack version 26.05.4. A fix was committed to the repository and a release was tagged accordingly. Organizations using affected versions should upgrade immediately to mitigate risk of privilege escalation or session hijacking via stored XSS.
View original advisory →CVE-2026-78408 is a privilege escalation vulnerability in the util-linux nsenter utility affecting its --join-cgroup option. When nsenter opens the target cgroup.procs file as root, it leaves the file descriptor open across namespace and credential changes and across execve() calls. The Linux kernel uses the credentials from the original open to authorize later cgroup migrations, meaning a program in an attacker-controlled container can inherit root-level cgroup manipulation capabilities. After a privileged operator invokes --join-cgroup against a malicious target, an unprivileged user inside that environment can migrate arbitrary host processes between cgroups and terminate unrelated root processes. This represents a container escape/host process interference scenario requiring no additional privileges from the attacker beyond control of the target container. The vulnerability is tracked by Red Hat and has an associated GitHub security advisory in the util-linux repository.
View original advisory →APITable versions through 1.13.0-beta.1 expose an internal organization loadOrSearch endpoint without any authentication requirement. Unauthenticated attackers can exploit this vulnerability to retrieve sensitive information including member names, email addresses, and team hierarchy structures. The attack vector requires only a space identifier, which can be obtained from publicly shared links or public templates. This allows attackers to enumerate the complete member directory of any workspace. The vulnerability resides in the InternalOrganizationController and is related to missing authentication checks in the ResourceInterceptor. The flaw represents a significant information disclosure risk for organizations using APITable. No authentication or special privileges are required to exploit this issue.
View original advisory →Aesto LLC, operating as Aesto Health, disclosed a significant data breach affecting more than 9.5 million individuals. The breach was discovered recently and reported publicly. The incident represents one of the larger healthcare data breaches in terms of patient count. Healthcare data breaches are particularly sensitive due to the nature of personal and medical information involved. The scale of the breach places it among the more impactful incidents in the healthcare sector. Further details about the nature of the compromised data and the attack vector were not fully elaborated in the article excerpt. Regulatory notifications and patient advisories are likely underway given the magnitude of the breach.
View original advisory →Threat actors are actively exploiting a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-0768 in Langflow, an open-source framework used for building AI applications. The exploitation allows attackers to steal sensitive credentials, tokens, and API keys including those for OpenAI and AWS. The vulnerability requires no authentication, making it particularly dangerous for exposed instances. Langflow is widely used in the AI development community, increasing the potential attack surface. Organizations using Langflow are urged to patch immediately and rotate any exposed credentials. The active exploitation status elevates the severity of this vulnerability significantly.
View original advisory →A critical authentication bypass vulnerability in JFrog Artifactory, tracked as CVE-2026-82329 with a CVSS score of 9.8, is being actively exploited by threat actors just days after public disclosure. The flaw allows attackers to bypass authentication mechanisms present in default configurations of Artifactory, potentially granting them administrative access to the platform. Security researchers at watchTowr flagged the active exploitation in the wild. The vulnerability's severity is compounded by the widespread use of JFrog Artifactory in enterprise software development pipelines for artifact and package management. Organizations are urged to apply the available patch immediately to mitigate the risk of administrative token minting by unauthorized actors.
View original advisory →A financially motivated threat actor known as Breeze Comet (formerly UNC5669) has been targeting Brazilian financial services, retail, and e-commerce organizations since 2024. The group specializes in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers. Google Threat Intelligence Group (GTIG) and Mandiant have been tracking this adversary and provided detailed descriptions of their tactics. The threat actor has executed hundreds of fraudulent transactions through Brazilian payment infrastructure. The campaign highlights ongoing risks to the Brazilian financial sector from sophisticated, targeted cybercriminal operations.
View original advisory →Threat actors conducted a BGP hijacking attack targeting the update infrastructure of Virtualizor, a popular VPS management software. By hijacking BGP routing, attackers redirected update requests intended for legitimate Virtualizor servers to malicious servers under their control. This allowed them to push trojanized or malicious software updates to unsuspecting Virtualizor users. The attack represents a sophisticated supply chain compromise leveraging BGP routing manipulation, a technique that can affect large numbers of users simultaneously. BGP hijacking at this level requires significant resources or access to BGP routing infrastructure. Users of Virtualizor who updated their software during the attack window may have received and installed malicious code. The incident highlights the risks of software update mechanisms that lack strong cryptographic verification and the dangers of BGP as an inherently trust-based protocol. Organizations using Virtualizor should audit their systems for signs of compromise and verify the integrity of installed software.
View original advisory →Cybersecurity researchers discovered 13 malicious Composer theme packages on Packagist, the PHP package repository, designed to target unpatched iOS devices. The packages inject malicious JavaScript into Vietnamese movie and comic streaming sites that install the libraries. The injected code performs two main operations against site visitors: mobile ad-fraud and gambling redirects, while also deploying spyware targeting unpatched iPhones. The ultimate goal appears to be stealing cryptocurrency wallet seeds from compromised iOS devices. This represents a supply chain attack leveraging trusted package repositories to reach end users through compromised websites.
View original advisory →The Iranian threat group Nimbus Manticore has been linked to two newly discovered malware families targeting Linux and macOS systems. The group is using a social engineering tactic where they pose as recruiters and deliver malicious coding tests to victims. The malware consists of cross-platform remote access trojans (RATs) built with Node.js and JavaScript, enabling them to infect multiple operating systems. This campaign represents an evolution of the group's toolset and an expansion of its targeting scope beyond Windows systems. Russian cybersecurity firm Kaspersky is actively tracking this threat actor and their new malware families.
View original advisory →Nearly 22,000 Microsoft Exchange servers exposed to the internet remain unpatched against a high-severity authentication bypass vulnerability. This flaw allows attackers to hijack all user mailboxes on affected servers. The vulnerability is classified as high-severity and represents a significant risk to organizations still running unpatched versions. The large number of exposed servers indicates widespread failure to apply available security updates. Successful exploitation could lead to full compromise of email communications, data exfiltration, and further lateral movement within affected organizations.
View original advisory →