Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

AlienVault OTX General

CVE Database V5

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

CVE-2026-1064 is a medium severity command injection vulnerability in bastillion-io Bastillion versions up to 4. 0. 1, specifically in the System Management Module's SystemKtrl. java component. The flaw allows remote attackers with high privileges to execute arbitrary commands without user interaction. Although the exploit is public, no known active exploitation has been reported. This vulnerability can compromise system confidentiality, integrity, and availability by enabling unauthorized command execution. European organizations using Bastillion for SSH session management or privileged access are at risk, especially those with exposed or poorly segmented Bastillion instances. Mitigation requires immediate upgrade once a patch is available, restricting Bastillion access to trusted networks, and applying strict input validation or command execution controls. Countries with higher adoption of Bastillion or critical infrastructure relying on Bastillion-managed systems, such as Germany, France, and the UK, are more likely to be affected.

CVE-2026-1064 identifies a command injection vulnerability in bastillion-io Bastillion versions 4.0.0 and 4.0.1, located in the System Management Module's source file SystemKtrl.java. This vulnerability arises from improper handling of input that is passed to system commands, allowing an attacker to inject and execute arbitrary commands on the underlying operating system. The attack vector is remote network access, and the attacker requires high privileges on the Bastillion system but does not need user interaction to exploit the flaw. The vulnerability affects the confidentiality, integrity, and availability of the affected system by enabling unauthorized command execution, potentially leading to full system compromise. Although the vendor has not responded and no patches are currently available, the exploit code has been publicly disclosed, increasing the risk of exploitation. Bastillion is typically used as a centralized SSH session management and privileged access management tool, making it a high-value target for attackers seeking lateral movement or privilege escalation within enterprise environments. The CVSS 4.0 score of 5.1 reflects medium severity, considering the ease of remote exploitation without user interaction but requiring high privileges. No known active exploitation in the wild has been reported yet, but the public availability of the exploit increases urgency for mitigation.

Detailed information about CVE-2026-1064: Command Injection in bastillion-io Bastillion affecting bastillion-io Bastillion. Get real-time updates, technical det

CVE-2026-1064: Command Injection in bastillion-io Bastillion - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-1064: Command Injection in bastillion-io Bastillion

CVE-2026-1063 is a medium severity command injection vulnerability in bastillion-io Bastillion versions up to 4. 0. 1, specifically in the Public Key Management System component. The flaw exists in the AuthKeysKtrl. java file and allows remote attackers to execute arbitrary commands without user interaction or authentication. Although the vendor has not responded and no patches are currently available, the exploit details have been publicly disclosed. The vulnerability has a CVSS 4. 0 score of 5. 1, indicating moderate risk. No known exploits are currently observed in the wild.

CVE-2026-1063 is a command injection vulnerability identified in bastillion-io Bastillion, an open-source SSH key management system, affecting versions 4.0.0 and 4.0.1. The vulnerability resides in the Public Key Management System, specifically within the source file src/main/java/io/bastillion/manage/control/AuthKeysKtrl.java. Due to insufficient input validation or sanitization, an attacker can manipulate inputs to inject arbitrary commands that the system executes. This flaw can be exploited remotely without requiring user interaction or authentication, increasing the attack surface significantly. The vulnerability was disclosed publicly on January 17, 2026, but the vendor has not issued any patches or responses. The CVSS 4.0 vector indicates network attack vector (AV:N), low attack complexity (AC:L), no authentication required (AT:N), no user interaction (UI:N), and partial impacts on confidentiality, integrity, and availability (VC:L, VI:L, VA:L). The exploitability is rated as partially functional (E:P). Although no known exploits are currently active in the wild, the public disclosure increases the risk of exploitation. Bastillion is often deployed in enterprise environments to manage SSH keys, making this vulnerability critical in contexts where secure access to servers is essential. Successful exploitation could allow attackers to execute arbitrary commands on the Bastillion server, potentially leading to full system compromise, lateral movement, or disruption of SSH key management operations.

Detailed information about CVE-2026-1063: Command Injection in bastillion-io Bastillion affecting bastillion-io Bastillion. Get real-time updates, technical det

CVE-2026-1063: Command Injection in bastillion-io Bastillion - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-1063: Command Injection in bastillion-io Bastillion

CVE-2026-1062 is a medium severity Server-Side Request Forgery (SSRF) vulnerability in xiweicheng TMS versions up to 2. 28. 0. The flaw exists in the Summary function within the HtmlUtil. java file, where improper validation of the 'url' argument allows remote attackers to induce the server to make arbitrary HTTP requests. Exploitation does not require authentication or user interaction, and the vulnerability has a CVSS 4. 0 base score of 5. 3. Although no known exploits are currently observed in the wild, a public exploit has been published. This vulnerability could allow attackers to access internal resources, bypass firewalls, or perform reconnaissance within the victim’s network.

CVE-2026-1062 is a Server-Side Request Forgery vulnerability affecting xiweicheng TMS software versions from 2.0 through 2.28.0. The vulnerability resides in the Summary function implemented in the source file src/main/java/com/lhjz/portal/util/HtmlUtil.java. Specifically, the function improperly handles the 'url' parameter, allowing an attacker to supply a crafted URL that the server then uses to initiate HTTP requests on behalf of the attacker. This SSRF flaw enables remote attackers to coerce the server into making arbitrary requests to internal or external systems, potentially bypassing network access controls and firewalls. The vulnerability requires no authentication or user interaction, increasing its exploitability. The CVSS 4.0 vector indicates network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:L), no user interaction (UI:N), and low impact on confidentiality, integrity, and availability (VC:L, VI:L, VA:L). While no active exploitation has been reported, a public exploit is available, raising the risk of future attacks. The vulnerability can be leveraged for reconnaissance, accessing internal services, or pivoting within the network, posing a significant risk to affected deployments. No official patches have been linked yet, so mitigation may require configuration changes or network-level controls until updates are released.

Detailed information about CVE-2026-1062: Server-Side Request Forgery in xiweicheng TMS affecting xiweicheng TMS. Get real-time updates, technical details, and 

CVE-2026-1062: Server-Side Request Forgery in xiweicheng TMS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-1062: Server-Side Request Forgery in xiweicheng TMS

CVE-2026-1061 is a medium severity vulnerability in xiweicheng TMS versions up to 2. 28. 0, involving an unrestricted file upload flaw in the Upload function of FileController. java. The vulnerability allows remote attackers to manipulate the filename parameter to upload arbitrary files without proper validation or restrictions. Exploitation requires no user interaction or authentication and can lead to partial compromise of confidentiality, integrity, and availability. Although no known exploits are currently observed in the wild, the exploit code is publicly available, increasing the risk of attacks. European organizations using xiweicheng TMS should prioritize patching or mitigating this vulnerability to prevent potential unauthorized file uploads that could lead to further system compromise. Countries with higher adoption of xiweicheng TMS or critical infrastructure relying on it are at greater risk. Mitigation includes implementing strict filename validation, restricting upload types, and monitoring upload activity closely.

CVE-2026-1061 is a vulnerability identified in the xiweicheng TMS product, affecting all versions up to 2.28.0. The flaw resides in the Upload function within the FileController.java source file, where the filename argument is insufficiently validated, allowing an attacker to perform unrestricted file uploads remotely. This lack of validation means an attacker can upload arbitrary files, potentially including malicious scripts or executables, which could be used to execute code, escalate privileges, or disrupt service. The vulnerability does not require authentication or user interaction, making it easier to exploit remotely over the network. The CVSS 4.0 score of 5.3 reflects a medium severity, indicating moderate impact on confidentiality, integrity, and availability with low attack complexity. The exploit is publicly available, increasing the likelihood of exploitation attempts. No known exploits in the wild have been reported yet. The vulnerability affects a wide range of versions from 2.0 through 2.28.0, indicating a long-standing issue in the product. The absence of official patches or mitigation links suggests that users must implement their own controls or await vendor updates. This vulnerability could be leveraged to upload web shells or malware, leading to further compromise of affected systems.

Detailed information about CVE-2026-1061: Unrestricted Upload in xiweicheng TMS affecting xiweicheng TMS. Get real-time updates, technical details, and mitigati

CVE-2026-1061: Unrestricted Upload in xiweicheng TMS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-1061: Unrestricted Upload in xiweicheng TMS

CVE-2026-1050 is a medium severity SQL injection vulnerability affecting risesoft-y9 Digital-Infrastructure versions 9. 6. 0 through 9. 6. 7. The flaw exists in an unknown function within the REST Authenticate Endpoint, specifically in the Y9PlatformUtil. java source file. This vulnerability allows unauthenticated remote attackers to manipulate SQL queries, potentially compromising confidentiality, integrity, and availability of backend databases. Although no confirmed exploits are currently observed in the wild, a proof-of-concept exploit has been published. The vendor has not yet responded or issued a patch.

CVE-2026-1050 identifies a SQL injection vulnerability in the risesoft-y9 Digital-Infrastructure product, specifically affecting versions 9.6.0 through 9.6.7. The vulnerability resides in an unspecified function within the REST Authenticate Endpoint component, implemented in the Y9PlatformUtil.java file. An attacker can remotely exploit this flaw without authentication or user interaction by crafting malicious input that manipulates SQL queries executed by the backend database. This manipulation can lead to unauthorized data access, modification, or deletion, impacting confidentiality, integrity, and availability of the system. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector, low complexity, no privileges or user interaction required, and limited scope impact. Although the vendor was notified early, no patch or mitigation guidance has been provided yet. The exploit code is publicly available, increasing the risk of exploitation. The vulnerability is critical for environments where Digital-Infrastructure manages sensitive or critical data, especially in sectors like government, finance, or utilities. The lack of authentication requirements and remote exploitability make this a significant threat vector for attackers aiming to compromise backend databases or pivot within affected networks.

Detailed information about CVE-2026-1050: SQL Injection in risesoft-y9 Digital-Infrastructure affecting risesoft-y9 Digital-Infrastructure. Get real-time update

Geographic Threat Map

Global Threat Distribution

Threat Levels

Recent Threats

CVE-2026-1064: Command Injection in bastillion-io Bastillion

CVE-2026-1063: Command Injection in bastillion-io Bastillion

CVE-2026-1062: Server-Side Request Forgery in xiweicheng TMS

CVE-2026-1061: Unrestricted Upload in xiweicheng TMS

CVE-2026-1050: SQL Injection in risesoft-y9 Digital-Infrastr...

Country Risk Levels

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility