Live threat intelligence radar

CVE-2026-42922 is a critical authorization bypass vulnerability in the /nodered functionality of Frangoteam FUXA version 1.3.2-2809. This flaw allows an unauthenticated attacker to send a specially crafted HTTP request that can lead to arbitrary code execution on the affected system.

CVE-2026-40063 is an information disclosure vulnerability in the /nodered/fuxa/scripts functionality of Frangoteam's FUXA product version 1.3.2-2809. An unauthenticated attacker can send a specially crafted HTTP request to trigger this flaw and leak sensitive information.

4NTL is a browser extension for Chromium-based browsers that enables quick threat intelligence lookups from the right-click menu. It allows users to check IPs, domains, URLs, or file hashes against VirusTotal and AbuseIPDB without leaving the current page. The extension is designed to improve analyst efficiency by reducing the need to copy and paste indicators into separate tabs. It respects user privacy by only querying VirusTotal and AbuseIPDB, never submitting new samples, and keeping API keys local to the browser profile. No active exploitation or vulnerabilities are reported in the extension itself.

CVE-2026-118426 is a missing authorization vulnerability in Octopus Deploy Octopus Server when the LDAP authentication provider is enabled. Authenticated users can call LDAP user and group search functions without proper authorization. This issue affects specific versions prior to fixed releases 2026.2.13487 and 2026.3.15909. The vulnerability has a medium severity with a CVSS score of 5.3.

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.

In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.