Threat database

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.

A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file application/database.php of the component Database Management. The manipulation results in execution with unnecessary privileges. The attack may be launched remotely. The exploit is now public and may be used.

CVE-2026-102245 is a medium severity vulnerability in MODSetter SurfSense versions 2.0.0 through 2.0.3. It involves missing authentication in an unspecified function within the circleback_webhook_route.py file of the circleback endpoint component. The vulnerability can be exploited remotely without privileges or user interaction. Public exploit code is available, but there are no known exploits in the wild. The vendor has not responded to disclosure attempts, and no patch or mitigation guidance is currently available.

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded.

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file /lib/functions/backup_common.sh of the component Backup/Restore. This manipulation of the argument aes_pass causes use of hard-coded cryptographic key . It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

The ISC Stormcast for Tuesday, September 29th, 2026, is a security news update published by the SANS Internet Storm Center. It provides general information and resources related to cybersecurity but does not describe any specific security threat or vulnerability.

CVE-2026-101878 is a vulnerability in Bitwarden Server versions 2025.6.0 up to but not including 2026.5.0. It involves an incorrect implementation of the authentication algorithm where the @ExternalId parameter in a stored procedure is declared with a shorter NVARCHAR(50) length than the actual NVARCHAR(300) column it queries. This causes silent truncation of the SSO login identifier on SQL Server deployments, allowing an attacker whose identity-provider identifier begins with another user's full 50-character identifier to authenticate as that user and obtain their access token.

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-101859 is an OS command injection vulnerability in the RaspAP raspap-webgui up to version 3.5.5. It affects the escapeshellcmd function in the ajax/openvpn/del_ovpncfg.php file within the OpenVPN Configuration Handler component. The vulnerability allows remote attackers to manipulate the cfg_id argument to execute arbitrary OS commands. The vulnerability has been publicly disclosed, but the vendor has not responded or issued a fix. The CVSS score is 5.3, indicating a medium severity level.

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in the Rich Text Editor Field. This vulnerability exists in all versions up to and including 2.10.2 and allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.

A security vulnerability exists in Trusted Domain Project OpenDMARC up to version 1.4.2. The flaw is an integer overflow caused by manipulation of the 'pct' argument in the DMARC Parser component, specifically in the file libopendmarc/opendmarc_policy.c. Remote exploitation is possible, and the exploit has been publicly disclosed. The vendor has not responded to the disclosure. The vulnerability has a medium severity rating with a CVSS score of 6.5.

A vulnerability in Trusted Domain Project OpenDMARC up to version 1.4.2 allows remote attackers to bypass authentication by spoofing due to a flaw in the opendmarc_policy_query_dmarc function within the Multi-Record Set Handler component. The vulnerability has a CVSS score of 7.3 (medium severity). Exploit code is publicly available, but no vendor response or patch has been provided.

CVE-2026-101278 is a medium severity vulnerability in Trusted Domain Project OpenDMARC versions 1.4.0, 1.4.1, and 1.4.2. It involves an origin validation error caused by manipulation of the PSL Wildcard Handler in the opendmarc_get_tld function. No patch or fix is currently available, and the vendor has not responded to the disclosure. Public exploit code exists, but no exploitation in the wild has been reported.

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Performing a manipulation results in stack-based buffer overflow. The attacker must have access to the local network to execute the attack. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability in Trusted Domain Project OpenDMARC up to version 1.4.2 allows remote attackers to cause improper authentication via the opendmarc_sp2_find_mailfrom_domain function in the SPF Macro Handler component. This flaw has a CVSS 4.0 base score of 6.9 (medium severity). An exploit has been published, and a patch is available to remediate the issue.

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.