This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-20. It is categorized as open-source intelligence (OSINT) focusing on malware-related payload delivery and network activity. No specific technical details, affected software versions, or exploits in the wild are provided.

The data represents a collection of IOCs published by ThreatFox on 2026-10-20. These IOCs are intended to aid in identifying malware-related activity, specifically payload delivery and network behavior. However, no detailed technical information, exploit mechanisms, or affected software versions are included in the provided information.

ThreatFox MISP Feed

Unknown RAT botnet C2 domain (confidence level: 100%)

SmartApeSG payload delivery URL (confidence level: 100%)

SmartApeSG payload delivery domain (confidence level: 100%)

Unknown malware payload delivery URL (confidence level: 100%)

Unknown malware botnet C2 (confidence level: 100%)

Unknown malware credit card skimming domain (confidence level: 100%)

Coruna botnet C2 domain (confidence level: 90%)

GHOSTBLADE payload (confidence level: 90%)

FAKEUPDATES botnet C2 domain (confidence level: 100%)

Unknown malware payload delivery URL (confidence level: 75%)

Sliver botnet C2 server (confidence level: 100%)

Mirai payload delivery server (confidence level: 75%)

Unknown malware botnet C2 server (confidence level: 100%)

Mozi payload delivery URL (confidence level: 75%)

Hades botnet C2 domain (confidence level: 100%)

php.shin_webshell payload delivery domain (confidence level: 50%)

Unknown Loader payload (confidence level: 95%)

NjRAT botnet C2 server (confidence level: 100%)

This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-20. It is categorized as open-source intelligence (OSINT) focusing on malware-related payload delivery and network activity. No specific technical details, affected software versions, or exploits in the wil

ThreatFox IOCs for 2026-10-20

CVE-2026-113735 is a vulnerability in the D-Link DCS-6501LH device version 3.03.02 involving the use of weak credentials in the mydlink_set_root_pwd function. The vulnerability can be exploited remotely but requires a high level of complexity, making exploitation difficult. The vulnerability has been publicly disclosed and carries a medium severity rating with a CVSS 4.0 score of 6.3.

This vulnerability affects the D-Link DCS-6501LH device running firmware version 3.03.02. It is located in the mydlink_set_root_pwd function within the /mnt/mtd/aoni_ipc file. The flaw allows an attacker to manipulate the system to use weak credentials, potentially compromising device security. The attack vector is remote network access, but the attack complexity is high and no privileges or user interaction are required. The vulnerability has been publicly disclosed, but no known exploits are currently observed in the wild.

CVE Database V5

CVE-2026-113735 is a vulnerability in the D-Link DCS-6501LH device version 3.03.02 involving the use of weak credentials in the mydlink_set_root_pwd function. The vulnerability can be exploited remotely but requires a high level of complexity, making exploitation difficult. The vulnerability has bee

CVE-2026-113735: Use of Weak Credentials in D-Link DCS-6501LH

a2a-rs

CVE-2026-113707 is a medium severity race condition vulnerability in the a2aproject a2a-rs software, specifically in the InMemoryTaskStore::update function within a2a-server/src/task_store/inmemory.rs. It affects versions 0.4.0 through 0.4.4. The flaw can be exploited remotely and may lead to inconsistent or unintended behavior due to concurrent access. A patch identified by commit 7050c7d329238539424ee46440e23b91c4825bee is available to fix this issue.

This vulnerability involves a race condition in the InMemoryTaskStore::update function of a2aproject a2a-rs up to version 0.4.4. The race condition arises from improper handling of concurrent operations, potentially allowing an attacker to manipulate the task store state remotely. The issue has been addressed in a patch identified by commit 7050c7d329238539424ee46440e23b91c4825bee.

CVE-2026-113707 is a medium severity race condition vulnerability in the a2aproject a2a-rs software, specifically in the InMemoryTaskStore::update function within a2a-server/src/task_store/inmemory.rs. It affects versions 0.4.0 through 0.4.4. The flaw can be exploited remotely and may lead to incons

CVE-2026-113707: Race Condition in a2aproject a2a-rs

CVE-2026-113706 is an information disclosure vulnerability in the a2aproject a2a-rs software up to version 0.4.3. The issue arises from manipulation of the argument historyLength in a function within the file a2a-server/src/task_store/inmemory.rs. This vulnerability can be exploited remotely and may lead to unauthorized information disclosure. A patch identified by commit 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb is recommended to fix the issue.

The vulnerability CVE-2026-113706 affects a2aproject a2a-rs versions 0.4.0 through 0.4.3. It involves an information disclosure flaw triggered by manipulating the argument historyLength in an unspecified function located in a2a-server/src/task_store/inmemory.rs. The flaw allows remote attackers to gain access to information that should be protected. The issue has a CVSS 4.0 base score of 5.1 (medium severity), indicating a network attack vector with low complexity and limited impact on confidentiality. A patch has been identified (commit 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb) and deployment of this patch is recommended to remediate the vulnerability.

CVE-2026-113706 is an information disclosure vulnerability in the a2aproject a2a-rs software up to version 0.4.3. The issue arises from manipulation of the argument historyLength in a function within the file a2a-server/src/task_store/inmemory.rs. This vulnerability can be exploited remotely and may

CVE-2026-113706: Information Disclosure in a2aproject a2a-rs

Metasploit Framework

CVE-2026-109682 is a server-side request forgery (SSRF) vulnerability in Rapid7 Metasploit Framework versions before 6.5.7. The flaw allows HTTP requests made through the send_request_cgi! method to follow redirects to different hosts without restrictions. This can enable a malicious HTTP server to induce the Metasploit operator's system to make arbitrary HTTP requests to internal or otherwise inaccessible services.

Metasploit Framework versions prior to 6.5.7 contain an SSRF vulnerability (CWE-918) where the send_request_cgi! function does not restrict HTTP redirect destinations. An attacker controlling a malicious HTTP server can exploit this by causing the Metasploit client to follow redirects to arbitrary hosts reachable from the operator's network, potentially accessing internal services not directly accessible to the attacker.

CVE-2026-109682 is a server-side request forgery (SSRF) vulnerability in Rapid7 Metasploit Framework versions before 6.5.7. The flaw allows HTTP requests made through the send_request_cgi! method to follow redirects to different hosts without restrictions. This can enable a malicious HTTP server to 

CVE-2026-109682: CWE-918 Server-Side request forgery (SSRF) in Rapid7 Metasploit Framework

A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVE-2025-60496: n/a

Description

Technical Details

Community Reviews

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional