Overzicht van binnengekomen advisories.
2014 resultaten gevonden
Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture WordPress plugin, which has over 6,000 active installs. The flaw allows unauthenticated attackers to upload arbitrary files, including PHP backdoors, leading to remote code execution on affected sites. Wordfence, a WordPress security company, identified and disclosed the vulnerability and has reported blocking numerous exploitation attempts. The plugin's widespread use makes this a significant threat to WordPress-based e-commerce sites. Attackers are leveraging the flaw to plant PHP web shells, enabling persistent access and further compromise of affected servers. Site owners using this plugin are urged to apply patches or mitigations immediately.
Bekijk origineel advisory →A critical vulnerability tracked as CVE-2026-5430 (CVSS 9.8) has been discovered in WSO2 API Manager. The flaw involves improper verification of cryptographic signatures in JWT authentication, allowing attackers to forge admin tokens and perform account takeover. The vulnerability was discovered and reported by the Hacktron Team and has been credited to watchTowr for identifying active exploitation in the wild. Attackers are actively attempting to exploit this flaw to gain unauthorized administrative access. The severity and active exploitation status make this a high-priority patching concern for organizations using WSO2 API Manager.
Bekijk origineel advisory →CVE-2026-92299 affects @jitsi/electron-sdk versions before 10.0.5, where the getDesktopSources() API is exposed via Electron's contextBridge without requiring an active getDisplayMedia() picker. This allows any script running in the meeting page to enumerate screens and windows without user consent. Attackers can invoke the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution, bypassing operating system permission prompts entirely. The vulnerability poses a significant privacy risk as it enables silent screen capture of a victim's desktop during a Jitsi meeting session. The fix was introduced in version 10.0.5, which adds proper gating logic to restrict access to screen sources. Proof-of-concept references and patch details are available via the official GitHub repository and commit history. The issue was also documented by VulnCheck in their advisory database.
Bekijk origineel advisory →A server-side request forgery (SSRF) vulnerability has been identified in the a2ui-project a2ui software up to version 0.10.7. The vulnerability exists in the httpx.get function within the FileResolver component, specifically in the file agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py. Remote attackers can exploit this vulnerability without authentication to perform SSRF attacks, potentially allowing them to make the server issue requests to internal or external resources. A patch has been identified with commit ID 2bb8423060308bbdea8ba468dabed4fc256d18ea and users are advised to deploy it immediately. The issue was tracked and reported via GitHub issues and pull requests, and is also documented on VulDB.
Bekijk origineel advisory →CVE-2026-73447 affects Arista EOS-based products via the gRPC Network Security Interface (gNSI) Certz service. An authenticated but privileged attacker can send a crafted Certz Rotate request to escalate privileges and execute arbitrary OS commands with root-level access. This leads to full device compromise. The Bootz service on affected devices is also vulnerable. The vulnerability requires prior authentication, limiting the attack surface somewhat, but the impact of successful exploitation is critical. Arista has published a security advisory (SA-0162) detailing affected versions and mitigations. Network infrastructure devices running Arista EOS should be patched or mitigated promptly.
Bekijk origineel advisory →CVE-2026-27565 describes a critical vulnerability allowing an unauthenticated remote attacker to upload a malicious IODD file to a vulnerable device. The uploaded file places and executes a shell script with root privileges, granting full system control. The persistence mechanism ensures the malicious shell script survives reboots, making remediation more complex. No authentication is required to exploit this vulnerability, significantly lowering the barrier for attackers. The vulnerability affects industrial or IoT devices that support IODD file uploads. Multiple advisories have been published by CERT VDE covering related devices and vendors. The impact is rated High given the combination of unauthenticated access, root-level code execution, and persistent compromise. Organizations using affected devices should apply patches or mitigations immediately and audit for signs of exploitation.
Bekijk origineel advisory →CVE-2026-27546 describes a critical authentication bypass vulnerability in the _account_log function that allows unauthenticated remote attackers to gain administrative access. The flaw can be exploited even when accounts are properly configured, meaning standard security hardening does not mitigate the risk. No authentication credentials are required, making this trivially exploitable by any remote attacker. The vulnerability has been reported via NVD and multiple CERT-VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), suggesting it affects multiple product versions or vendors. The ability to log in as admin without credentials represents a complete authentication control failure. This type of vulnerability typically leads to full system compromise, data exfiltration, and lateral movement. The involvement of CERT-VDE indicates the affected products are likely industrial or embedded systems.
Bekijk origineel advisory →The TrueBooker Appointment Booking and Scheduler System plugin for WordPress contains a critical authorization bypass vulnerability affecting all versions up to and including 1.2.3. The flaw stems from the plugin failing to properly verify user authorization before performing sensitive actions. Unauthenticated attackers can exploit this to modify the email address of any user account, including administrator accounts. Once the email is changed, attackers can trigger a password reset to fully compromise the account. This effectively allows complete account takeover without any prior authentication. The vulnerability has been patched in version 1.2.4. The fix is visible in the changeset for the function_ajax.php file. The issue is tracked under CVE-2026-14349 and documented by both NVD and Wordfence.
Bekijk origineel advisory →The JetFormBuilder Dynamic Blocks Form Builder plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 3.6.2. The flaw stems from the plugin failing to validate that a submitted form ID actually belongs to a JetFormBuilder form before parsing the referenced post content as a form schema and executing Advanced Validation server-side callbacks. This oversight allows unauthenticated remote attackers to exploit the plugin to create new administrator-level user accounts, effectively granting full site control. The vulnerability requires no authentication or special privileges to exploit, making it particularly dangerous for WordPress sites running the affected plugin versions. A patch has been released and is available via the WordPress plugin repository changeset 3575346.
Bekijk origineel advisory →Acronis has disclosed a high-severity local privilege escalation (LPE) vulnerability affecting its backup plugin for cPanel, WebHost Manager (WHM), and Plesk on Linux systems. The flaw is reported to be actively exploited in the wild, raising urgency for affected users to apply patches. The vulnerability allows local attackers to escalate privileges on Linux-based hosting environments. Acronis has issued a warning to users of the affected plugin to update immediately. The issue highlights ongoing risks in third-party backup and hosting management integrations. Hosting providers using Acronis backup solutions with cPanel or Plesk are particularly at risk. No specific CVE identifier was mentioned in the available content snippet.
Bekijk origineel advisory →A threat actor compromised the maintainer's website for the Admin Menu Editor Pro WordPress plugin and pushed malicious updates to over 200 customers. The tampered plugin versions created hidden user accounts, effectively backdooring more than 1,500 WordPress sites. This is a supply chain attack targeting WordPress plugin infrastructure. The attacker leveraged the legitimate update distribution mechanism to propagate the malicious code. Site administrators using the affected plugin versions are at risk of unauthorized administrative access. The attack highlights risks associated with third-party plugin ecosystems and the importance of verifying plugin integrity.
Bekijk origineel advisory →Cybersecurity researchers at Elastic Security Labs have uncovered a previously undocumented Brazilian banking malware operation known as KREMLIN, tracked under the activity cluster REF9334. Active since at least May 2025, the threat actor uses lures impersonating over a dozen Brazilian banks to distribute a malicious browser extension targeting Google Chrome and Microsoft Edge. The malware is designed to hijack browser sessions, steal credentials, and capture session tokens from victims. The toolkit represents a sophisticated threat to Brazilian banking customers and financial institutions. The operation highlights the continued evolution of browser-based credential theft techniques employed by Latin American cybercriminal groups.
Bekijk origineel advisory →Cybersecurity agencies from the United States, United Kingdom, and Netherlands have jointly detailed a Windows-based malware attributed to Iran's intelligence service. The malware is controlled through the Telegram messaging application, enabling covert command and control. It targets dissidents, journalists, and activists globally. Capabilities include copying emails and chat messages, taking screenshots, and activating the microphone to record audio. The operation represents a state-sponsored surveillance campaign against political opponents and civil society members. The use of a legitimate messaging platform like Telegram as a C2 channel helps evade traditional network detection. The joint advisory underscores the international concern over Iranian cyber espionage activities.
Bekijk origineel advisory →Cybersecurity researchers have uncovered a multi-platform malware campaign leveraging the MQTT protocol as a covert command-and-control communication channel. The malware family, dubbed BambooToken, targets both Windows and Linux systems. Active since at least February 2023, the campaign has been observed targeting organizations across Asia and South America. MQTT, typically used in IoT and lightweight messaging scenarios, is being abused to blend malicious traffic with legitimate network communications. The use of MQTT as a C2 channel represents an emerging evasion technique that may bypass traditional network security controls. The campaign's cross-platform capability indicates a sophisticated threat actor with resources to develop and maintain malware for multiple operating systems.
Bekijk origineel advisory →BambooToken is a previously unknown malware framework that has been active since at least 2023. It targets both Windows and Linux systems, using the Message Queuing Telemetry Transport (MQTT) protocol as its command-and-control communication channel. MQTT is typically used in IoT environments, making this an unconventional choice that may help evade traditional network detection tools. The malware represents a cross-platform threat capable of compromising a wide range of enterprise and server environments. Its use of a lightweight messaging protocol suggests the authors are attempting to blend malicious traffic with legitimate IoT or industrial communications. The framework's capabilities and full infection chain are still being investigated, but its dual-OS targeting and protocol abuse make it a notable and potentially high-impact threat.
Bekijk origineel advisory →Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress. The attack allows threat actors to upload a PHP backdoor to compromised WordPress sites. The plugin, designed for WooCommerce-based stores, contains a flaw being leveraged in the wild. This represents an active exploitation campaign targeting WordPress e-commerce installations. Site administrators using the affected plugin are at immediate risk of full site compromise. The backdoor upload capability could grant attackers persistent remote access and control over affected sites. WordPress and WooCommerce site owners are urged to patch or remove the vulnerable plugin immediately.
Bekijk origineel advisory →CISA has issued a warning that ransomware gangs are actively exploiting a critical remote code execution (RCE) vulnerability in VMware vCenter Server. The flaw was patched by VMware in July but continues to be targeted by threat actors. CISA's alert indicates that exploitation has escalated beyond initial attackers to include ransomware groups, significantly raising the threat level. Organizations running VMware vCenter are urged to apply the patch immediately if they have not already done so. The vulnerability allows attackers to execute arbitrary code remotely, potentially giving them full control over affected systems. This type of critical infrastructure exposure is particularly dangerous as vCenter manages virtualized environments at enterprise scale.
Bekijk origineel advisory →CISA issued an advisory for CareCam CM2507 IP cameras running firmware v251211.1507, disclosing seven vulnerabilities. The flaws include missing authentication for live video streaming (CVE-2026-88259), empty password on the ONVIF management service (CVE-2026-84398), an unprotected remote debugging activation mechanism (CVE-2026-84400), arbitrary code execution via unverified removable media scripts (CVE-2026-81305), an unauthenticated physical debug interface exposing the bootloader (CVE-2026-85478), weak password hashing for the root account (CVE-2026-85497), and cleartext storage of wireless credentials (CVE-2026-81321). CVSS v4.0 scores range from 2.3 to 9.3, with two vulnerabilities rated CRITICAL. CareCam has not responded to CISA coordination attempts, leaving no vendor patch available. Users are advised to isolate devices behind firewalls, minimize network exposure, and use VPNs for remote access. No public exploitation has been reported at the time of publication.
Bekijk origineel advisory →Siemens Reyrolle 7SR5 protective relay devices running firmware versions prior to V2.70 are affected by 14 vulnerabilities spanning a wide range of weakness types. The highest severity vulnerability (CVE-2026-62645) carries a CVSS v3 score of 9.8 CRITICAL and allows unauthenticated remote attackers to bypass authentication by calculating session IDs exposed through the web interface. Additional critical issues include insufficient entropy in session ID generation, authentication bypass via alternate paths, out-of-bounds writes causing denial-of-service, and resource exhaustion from unthrottled HTTP requests. Physical access vulnerabilities allow arbitrary unsigned code execution via a maintenance boot mode and memory corruption during firmware update mode. The Cesanta Mongoose Web Server v7.14 component contributes several integer overflow, pointer offset, and delimiter neutralization flaws. The device is deployed worldwide in the Energy critical infrastructure sector. Siemens has released V2.70 to address all vulnerabilities and recommends immediate update. CISA republished this advisory from Siemens ProductCERT SSA-142885 on 2026-09-15.
Bekijk origineel advisory →CISA issued an advisory for Wärtsilä FOS-Onboard version 5.07.0923.01, disclosing two critical vulnerabilities (CVE-2026-78225 and CVE-2026-81855) involving hard-coded cryptographic keys (CWE-321). CVE-2026-78225 affects the deployer-ng Update Controller component with a hardcoded server key, while CVE-2026-81855 affects the robot testing framework with a hardcoded client authentication key. Both vulnerabilities carry CRITICAL CVSS scores (9.0 and 9.1 respectively for CVSS 3.1). Successful exploitation could allow attackers to deliver unauthorized updates, execute code, or extract credentials to impersonate privileged clients. The affected product is deployed worldwide in the Transportation Systems critical infrastructure sector, with Wärtsilä headquartered in Finland. Wärtsilä states vulnerabilities are not exploitable when installed as recommended and has developed a security patch available via direct contact. The vulnerabilities were reported by Cydome Security Ltd. No known public exploitation has been reported at the time of publication.
Bekijk origineel advisory →