Threat database

Capcom suffered a data breach impacting approximately 11.7 million email addresses from its CAPCOM ID service. The breach also involved unauthorized changes to login passwords for 196 accounts. Additional personal information such as dates of birth, gender, country/region, and nicknames were compromised for 43 users. Capcom has reset affected passwords and notified impacted users. The company reported the incident to authorities and continues to investigate while maintaining service availability.

Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager platform, potentially compromising certain patient records. The breach was discovered recently and is under investigation, with the company working alongside federal law enforcement and cybersecurity experts. The exact number of affected patients and the scope of the data accessed remain unknown. Quest Diagnostics has experienced similar breaches in the past, affecting tens of thousands to millions of patient records. The company confirmed this breach is unrelated to recent PHP vulnerabilities affecting many websites. The incident highlights ongoing cybersecurity challenges in healthcare data protection.

CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in the victim's browser when the URL is visited, allowing the attacker to steal session cookies and perform actions on behalf of the victim within the application. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

CGM CLININET contains a local privilege escalation vulnerability (CVE-2025-30054) due to incorrect permission assignments on scripts and configuration files used by a root-privileged service processing HL7 messages. An attacker with uhcapache user privileges can modify these files to execute arbitrary code as root. Versions up to 2026.MS3 are confirmed vulnerable. A patch is available. The vulnerability has a critical CVSS 4.0 score of 9.3.

CVE-2025-30053 is a vulnerability in the CGM CLININET application where the cgm-updater process listens on an open network port without any authentication. This missing authentication for a critical function allows unauthenticated network access. The vulnerability affects versions up to 2026.MS3. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2025-30052 is an authentication bypass vulnerability in the rsyncd service of CGM CLININET. The service grants access based solely on the client's source IP address, allowing an attacker who can spoof an allowed IP to bypass authentication and edit files on the system. This affects versions up to 2026.MS3. The vulnerability has a high severity with a CVSS score of 8.8. A patch is available, and the product is a cloud service with vendor-managed remediation.

CVE-2025-30051 is a vulnerability in the CGM CLININET application where critical credentials, including the production database login and RabbitMQ broker credentials, are stored in the SysIO.pl configuration file with insecure file permissions. This misconfiguration allows any local user to read the file, potentially exposing sensitive credentials. The issue was fixed in version 2026.MS3.

CGM CLININET contains a critical code injection vulnerability in its RunCGI.pm component. This flaw allows an attacker on an adjacent network to supply a crafted query parameter that causes the import and execution of an attacker-controlled module with root privileges. The vulnerability is fixed in version 2026.MS3.

CGM CLININET versions prior to 2026.MS1 and 2026.MS3 store user passwords as unsalted MD5 hashes, which use insufficient computational effort for password hashing. This vulnerability has a high severity score of 8.2 and was addressed in versions 2026.MS1 and 2026.MS3.

CGM CLININET contains a critical vulnerability (CVE-2025-30047) involving deserialization of untrusted data in its HTTP-based API used by the administrative module. An attacker on the same local network can send crafted serialized Java objects that, when deserialized by the server, lead to remote code execution with root privileges. This vulnerability is fixed in version 2026.MS3.

CVE-2025-30046 is a critical vulnerability in the CGM CLININET application server where HL7 communication processes run with root privileges while handling untrusted data. This allows an attacker on an adjacent network to send malicious data to these processes and achieve remote code execution with root privileges. The vulnerability affects versions up to 2026.MS3. A patch is available, and the product is a cloud service with vendor-managed remediation.

CGM CLININET contains a code injection vulnerability in its ConvExpr function that processes Perl expressions into RTF document content. This flaw allows an authenticated attacker with high privileges to execute arbitrary code with root privileges. The vulnerability affects versions up to and including 2026.MS3. A patch is available, and the product is a cloud service where the vendor manages remediation.

CGM CLININET has a vulnerability (CVE-2025-30043) involving missing authentication on the /DocManagment endpoint. This allows unauthenticated attackers on adjacent networks to access and download patient documents. The issue is fixed in version 2026.MS3. The vulnerability has a high severity score of 7.1 and affects versions prior to 2026.MS3.

LiteLLM version 1.107.0 was compromised in a supply chain attack where attackers used leaked GitHub CLI OAuth tokens to push malicious packages to PyPI and Docker. The malicious packages were available for about three hours and downloaded over 49,000 times. The malware included an information stealer and a remote access trojan (RAT) that harvested sensitive credentials and secrets, then communicated with attacker-controlled servers. The incident was traced to leaked tokens exposed via logs and involved disabling branch protections and redirecting release workflows. Enterprise customers using private repositories were not affected. Users are advised to remove the compromised version and rotate credentials.

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings. The issue has been fixed in LTS versions 5.8.4 and 5.12.0 and later.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.8.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7.

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.