Live Threat Intelligence Radar

CVE-2026-105044 is an OS command injection vulnerability in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0. It affects Security Toolbox versions before 20260929 and allows an authenticated console administrator to execute arbitrary commands on attached clients. The vulnerability arises from improper neutralization of special elements used in OS commands.

A threat actor breached TeamUpdraft's infrastructure, compromising UpdraftCentral connection keys used to manage WordPress sites remotely. These stolen keys have been used to backdoor connected WordPress sites by installing malicious plugins that grant attackers administrator privileges. The breach affects an estimated 10% of UpdraftPlus users with UpdraftCentral or Migrator keys, potentially impacting around 400,000 websites. The vendor responded by revoking affected keys and releasing patched versions of UpdraftPlus. Users are advised to update to the latest versions and remove existing UpdraftCentral keys from their sites to mitigate risk.

CVE-2026-113741 is a cross-site scripting (XSS) vulnerability in the itsourcecode Online Cake Ordering System version 1.0. The issue exists in the /404.php file where manipulation of the useruid argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. The CVSS 4.0 score rates this as a medium severity issue.

CVE-2026-111943 is a vulnerability in the Go standard library's crypto/x509 package related to improper checking of certificate revocation. In some cases, system trust stores may not be updated automatically, potentially allowing untrustworthy intermediate certificates to be accepted. To mitigate this, a denylist was added to crypto/x509 to reject verification attempts involving known untrustworthy intermediate certificates. This vulnerability affects Go versions from 0 up to but not including 1.26.10, and versions from 1.27.0 up to but not including 1.27.3.

The certificate authority eMudhra revoked eight compromised intermediate certificates after researchers discovered their private keys were extremely weak, allowing near-instant recovery and potential forgery of trusted certificates. Major browsers including Mozilla, Google, and Apple have blocked these compromised certificates to prevent misuse.

CVE-2026-113740 is a medium severity SQL injection vulnerability in itsourcecode Online Cake Ordering System version 1.0. The flaw exists in the /deletecustomer.php file where manipulation of the ID parameter allows remote attackers to perform SQL injection. Exploit code has been published, but no known active exploitation in the wild has been reported. No official patch or remediation details are provided.

Mandiant FLARE floss versions before 3.2.0 contain a deserialization vulnerability (CWE-502) that allows arbitrary code execution when processing crafted .viv or .exe.viv workspace files. This vulnerability has a high severity score of 8.7 and requires user interaction with a locally accessible file. The flaw arises from unsafe deserialization of untrusted data.

Mandiant FLARE capa versions before 10.0.0 contain a deserialization vulnerability that allows arbitrary code execution when processing crafted .viv or .exe.viv workspace files. This vulnerability is identified as CWE-502 and has a high severity rating with a CVSS score of 8.7. The flaw arises from deserializing untrusted data, which can lead to remote code execution under certain conditions.

Best Practice Software Bp Premier versions before 1.14.1.1128 contain a hardcoded Microsoft SQL Server administrative password shared across all installations. This password cannot be changed without breaking the application. An attacker with network access to the database can authenticate as sysadmin, bypassing application authentication and potentially executing operating system commands as SYSTEM.

Vyper versions 0.3.4 through 0.5.0b1 contain a vulnerability in the create_from_blueprint function where an unchecked uint256 subtraction can cause an integer wraparound. This allows an attacker controlling the code_offset parameter to deploy contracts with no runtime code, potentially trapping ETH and tokens.