Overview of incoming advisories.
2019 results found
CISA has issued an advisory for Applied Systems Engineering ASE2000 V2 Communications Test Set versions 2.25 through 2.37, disclosing two critical vulnerabilities. CVE-2018-1285 is an XXE (XML External Entity) injection flaw inherited from Apache log4net versions prior to 2.0.10, allowing attackers to read/write arbitrary files or trigger outbound network requests. CVE-2026-18717 is an improper certificate validation vulnerability affecting versions 2.35 through 2.37, enabling TLS impersonation and interception of protected communications. Both vulnerabilities carry CVSS v3.1 scores of 9.8 and 7.4 respectively, with CVSS v4.0 scores of 9.2 and 9.1. The affected product is deployed worldwide across critical infrastructure sectors including Chemical, Critical Manufacturing, Energy, and Water and Wastewater. The vendor, ASE/Kalkitech, has released version 2.38 as a fix, upgrading the log4net library and correcting TLS certificate validation logic. Interim mitigations include restricting write access to installation directories, network segmentation, and firewall protection. No known public exploitation has been reported at this time.
View original advisory →CISA issued an ICS advisory (ICSA-26-239-05) for Ebyte NA111-M Firmware 9013-2-17, disclosing 13 vulnerabilities with a maximum CVSS v3 score of 9.8 (Critical). Successful exploitation could allow an attacker to fully compromise the device. Vulnerabilities include Missing Authentication for Critical Functions, CSRF, Use of Client-Side Authentication, Cleartext Transmission of Sensitive Information (HTTP and MQTT), Weak Authentication, Missing Authorization, Broken Cryptographic Algorithms, and Cleartext Storage of Sensitive Information. The device is deployed worldwide in the Information Technology critical infrastructure sector by China-based vendor Ebyte. Ebyte acknowledged the vulnerabilities and indicated a patch was under development but has not responded to subsequent coordination requests. No patch is currently available; CISA recommends network isolation, firewall segmentation, and VPN use as mitigations. The vulnerabilities were reported by Jithin Nambiar J.
View original advisory →CISA has issued an advisory for All-Line Equipment Company Fuel-Boss systems affected by two critical CVEs: CVE-2018-19518 (argument injection via IMAP Toolkit in PHP) and CVE-2019-11043 (PHP-FPM buffer overflow enabling remote code execution). All Fuel-Boss V1 variants running PHP 7.1.5 or earlier are affected, including Standard, Portal, Master/Slave, and Backflush Systems configurations. Successful exploitation could allow remote attackers to execute arbitrary OS commands or code. Fixes are available for V1 Standard and V1 Portal; no fix is yet available for Master/Slave, and no fix is planned for Backflush Systems. CISA recommends isolating affected systems from the internet, deploying firewalls, and using VPNs for remote access. Affected critical infrastructure sectors include Critical Manufacturing, Defense Industrial Base, Emergency Services, and Transportation Systems. The advisory was initially published on 2026-08-27 and vulnerabilities were anonymously reported to CISA.
View original advisory →CISA published an ICS advisory for the Xiiaozet LK100W device affecting versions prior to 2.1.240. Three vulnerabilities were identified: CVE-2026-78037 (OS Command Injection via web management interface, CVSS 8.8), CVE-2026-78239 (Missing Authentication for Critical Function, CVSS 9.8), and CVE-2026-76943 (Authentication Bypass via Alternate Path or Channel, CVSS 9.8). Successful exploitation could allow an attacker to take complete control of the device. The vulnerabilities affect the Information Technology critical infrastructure sector and are deployed worldwide. The vendor, headquartered in China, recommends updating to firmware version v2.1.240. No known public exploitation has been reported at this time. Byron Guernsey of Okachobi, LLC reported these vulnerabilities to CISA.
View original advisory →The Australian Federal Police (AFP) has charged two Western Australian men, Louis Michael Gaebler (23) and Ruben Ian Thomson (21), with 14 offences related to their alleged involvement in the cybercrime group TeamPCP. The group is responsible for the March 2026 supply chain compromise of open-source security scanners Trivy and Checkmarx KICS, as well as the AI gateway LiteLLM. Both individuals appeared in Perth Magistrates Court on August 27. The attacks targeted widely-used security and AI tooling, potentially impacting a broad range of downstream users and organizations. This case represents a significant law enforcement action against supply chain attackers in Australia. The compromise of security scanning tools is particularly concerning as it could undermine the integrity of software security pipelines globally.
View original advisory →The ShinyHunters extortion group has published sensitive data stolen from clothing retailer Carhartt, exposing information from nearly 12.9 million accounts. The breach was reported by data breach notification service Have I Been Pwned. The data was stolen earlier in the month before being publicly released. Carhartt is a major clothing retailer, making this a significant consumer data breach. The ShinyHunters group is a known threat actor responsible for multiple high-profile data breaches. The scale of the breach, affecting nearly 13 million accounts, makes this a high-impact incident for affected customers.
View original advisory →Microsoft heeft een groot aantal kwetsbaarheden verholpen in diverse Office-producten, waaronder SharePoint, Teams, Word, Excel, Outlook, Access, PowerPoint en cloudservices. De kwetsbaarheid CVE-2026-65667 in Microsoft Teams heeft een maximale CVSS-score van 10.0. CVE-2026-70306 in SharePoint (CVSS 9.3) vereist actie en stelt aanvallers in staat willekeurige code uit te voeren via cross-site scripting. CVE-2026-63520 in SharePoint wordt actief misbruikt in het wild, met name bij publiek toegankelijke installaties. CVE-2026-50515 (Azure Service Bus, CVSS 9.9), CVE-2026-62896 (Teams, CVSS 9.6) en CVE-2026-70332 (SharePoint, CVSS 9.6) zijn reeds centraal verholpen en vereisen geen verdere actie. Succesvolle aanvallen vereisen doorgaans dat een slachtoffer een kwaadaardig bestand opent of een link volgt. De kwetsbaarheden leiden tot uitvoering van willekeurige code, privilege escalatie, identiteitsvervalsing en toegang tot gevoelige gegevens.
View original advisory →Arctic Wolf, with medium confidence, linked threat actors to Dark Caracal in a June 2026 intrusion targeting an unnamed communications organization in Venezuela. The attackers deployed GoCaracal, a previously undocumented Go-based malware framework. GoCaracal leverages Ethereum smart contracts to fetch replacement C2 addresses, providing resilience against takedowns. The malware grants operators remote shell access and payload execution capabilities. An extended profile adds browser data theft, keylogging, and remote desktop control. This represents a novel use of blockchain technology to maintain C2 infrastructure. The target being a communications organization raises concerns about potential intelligence collection. The use of Go and blockchain-based C2 reflects increasing sophistication in malware development.
View original advisory →CISA has issued an emergency directive ordering U.S. federal agencies to patch their Citrix NetScaler appliances against an actively exploited remote code execution (RCE) vulnerability. The vulnerability is being leveraged in real-world attacks, prompting CISA to set an urgent deadline of Saturday for remediation. The flaw affects Citrix NetScaler ADC and NetScaler Gateway appliances. Active exploitation in the wild makes this a critical priority for government and enterprise environments. Federal agencies are required to comply with CISA's Known Exploited Vulnerabilities (KEV) catalog directives. Failure to patch could expose sensitive government systems to unauthorized remote access. The urgency of the patch deadline reflects the severity and exploitation activity observed by CISA.
View original advisory →The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has confirmed a 'major incident' following breach claims made by the Qilin ransomware gang. ATF is a U.S. federal regulatory agency responsible for enforcing laws governing firearms and explosives. The Qilin ransomware group claimed responsibility for compromising one of ATF's systems. This incident represents a significant attack on a U.S. law enforcement and regulatory agency. The breach raises serious concerns about the exposure of sensitive federal data related to firearms and explosives enforcement. Qilin is a known ransomware-as-a-service operation that has targeted various high-profile organizations. The confirmation of a 'major incident' suggests the compromise may have had significant operational or data impact. Further details on the extent of the breach and any data exfiltration are pending investigation.
View original advisory →Academic researchers from the University of Toronto have disclosed a new Rowhammer attack called GPUThor targeting NVIDIA workstation GPUs equipped with GDDR6 memory. The attack defeats error correction codes (ECC), which is the primary mitigation NVIDIA recommends against GPU Rowhammer attacks. GPUThor enables both denial-of-service (DoS) and privilege escalation attacks, ultimately allowing an attacker to gain a root shell on the host system. The attack demonstrates that ECC alone is insufficient as a defense against Rowhammer-class attacks on modern GPU hardware. This research highlights significant security risks for workstation and high-performance computing environments using NVIDIA RTX A6000 GPUs, and potentially other GDDR6-based GPU products.
View original advisory →JFrog Artifactory contains an improper limitation of a pathname to a restricted directory (path traversal) vulnerability tracked as CVE-2026-66384. The flaw allows an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and is subject to BOD 26-04, which prioritizes security updates based on risk. JFrog has published security advisories and release notes for self-managed Artifactory instances addressing this issue. Organizations using JFrog Artifactory in self-managed deployments are advised to apply the relevant patches immediately. CISA has also provided forensics triage requirements as part of the BOD 26-04 implementation guidance. The NVD entry for this CVE provides additional technical details and scoring.
View original advisory →CVE-2026-53362 is a vulnerability in the Linux Kernel affecting the IPv6 networking subsystem that allows for privilege escalation. The vulnerability is unspecified in nature but has been assigned a high criticality rating. It impacts multiple products and distributions that rely on the Linux Kernel, including SUSE, Red Hat, and others. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog. Multiple kernel commits have been identified as patches for this issue across several stable branches. The vulnerability affects open-source components and third-party libraries or implementations used by various products. BOD 26-04 directives from CISA require prioritization of security updates based on risk for this vulnerability.
View original advisory →CVE-2023-49105 is a critical improper authentication vulnerability in ownCloud that allows unauthenticated attackers to access, modify, or delete any file if the victim's username is known and no signing-key is configured. The vulnerability affects the WebDAV API via pre-signed URLs, enabling a complete bypass of authentication controls. This flaw poses significant risks to organizations using ownCloud for file storage and sharing. It has been flagged by CISA and is listed in their Known Exploited Vulnerabilities catalog. Remediation guidance is available through ownCloud's security advisories and CISA's BOD 26-04 directive on prioritizing security updates based on risk.
View original advisory →CVE-2026-81097 affects rails-mcp-server versions 1.4.0 through 1.6.0, where the execute_ruby tool's sandbox can be escaped via the pseudo-terminal (PTY) library's spawn entry points. The tool was documented as a read-only Ruby sandbox enforced by a pattern denylist and replacements for Kernel process-spawning methods. However, PTY spawn entry points were never included in the denylist, allowing an attacker to start a shell and execute arbitrary OS commands as the server's running account. The vulnerability was introduced when the denylist was added in version 1.4.0 and persisted through 1.6.0. Version 1.6.1 mitigates the issue by restricting allowed requires to a data-only list and blocking dynamic dispatch to execution entry points. Version 2.0.0 removes the vulnerable tool entirely.
View original advisory →A denial-of-service vulnerability exists in openssl_encrypt versions before 1.4.9. The library fails to validate the 'total' field from QR JSON payloads prior to materializing ranges, allowing attackers to craft malicious QR images containing extremely large total values. This triggers unbounded memory allocation, leading to out-of-memory conditions and denial of service. No authentication or special privileges appear to be required to exploit this vulnerability, as attackers only need to supply a crafted QR image. A fix is available in version 1.4.9 of the openssl_encrypt library. The vulnerability has been assigned CVE-2026-81693 and is documented on NVD as well as GitHub Security Advisories and VulnCheck.
View original advisory →A vulnerability in openssl_encrypt before version 1.4.9 allows attackers to inject ANSI escape sequences via unsanitized email fields in imported identity documents. This enables manipulation of terminal output to display fraudulent cryptographic fingerprints, effectively bypassing the out-of-band verification mechanism designed to protect against key substitution attacks. Attackers can deliver crafted identity bundles through standard contact-exchange flows or keyserver responses, making the attack vector accessible and realistic. The core risk is that users performing fingerprint verification — a critical trust step in encrypted communications — can be deceived into accepting a forged key. This undermines the fundamental security model of tools relying on openssl_encrypt for identity verification and key authentication.
View original advisory →Multiple Zbtlink and MoreQuick router firmware versions ship with a pre-installed backdoor C2 implant called 'yunmgrd' that communicates over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack this channel and execute arbitrary commands as root on affected devices. The vulnerability affects a wide range of devices including Zbtlink L3_V2_8, WE826-T2, ZBT-7628, ZBT-ZBT7621, MoreQuick MQAC/MQAP series, AP522, AP7628, HC5661A, APG721B, HK300, and MAP-N10. Beyond remote code execution, the attacker can modify DNS entries, exfiltrate PPPoE credentials, and establish reverse SSH tunnels for persistent access. This is effectively a supply-chain-level backdoor shipped in production firmware, posing severe risks to network infrastructure and connected environments. The issue was reported by VulnCheck under the campaign name 'DarkLantern/SpeakingStone'.
View original advisory →openssl_encrypt versions prior to 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler. The implementation uses unstretched SHA-256 instead of the recommended Argon2id algorithm for key derivation. This flaw allows attackers to perform offline password guessing attacks against encrypted files at speeds six to seven orders of magnitude faster than the documented protection level. The vulnerability stems from missing key stretching and hash rounds in the encryption pipeline. Exploitation requires access to encrypted files but no authentication or special privileges. Users are advised to upgrade to version 1.4.9 or later to mitigate the risk. The issue is tracked as CVE-2026-81704 and has been assigned a high criticality rating.
View original advisory →A relative path traversal vulnerability exists in the zip extraction functionality of AWS diagram-as-code (awsdac) affecting versions 0.10 through 0.23. The flaw allows a third party to write arbitrary files to the local filesystem by crafting malicious zip entry names containing path traversal sequences. Exploitation could enable unauthorized file writes and inappropriate actions within the diagram bundle. The vulnerability is tracked as CVE-2026-81838 and was disclosed via NVD and an AWS security bulletin. Users are advised to upgrade to version 0.24 or later to remediate the issue. The fix is available on the official GitHub releases page for the awsdac project.
View original advisory →