CVE-2026-100256 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.2.3. It allows remote code execution (rCE) via Structural Search script constraints when working with untrusted projects. The vulnerability is identified as CWE-829, which relates to inclusion of functionality from untrusted control spheres. No official patch information is provided in the input data.
A vulnerability in JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8 allows an attacker to take over administrator accounts via the password reset functionality. This issue is tracked as CVE-2026-100255 and is associated with CWE-1289. The vulnerability has a high severity rating with a CVSS 3.1 score of 8.1.
CVE-2026-100254 is a command injection vulnerability in JetBrains TeamCity affecting versions before 2026.2, 2026.1.4, and 2025.11.8. Authenticated users can exploit CRLF injection in Pipeline Git connection settings to execute arbitrary commands on Windows servers. The vulnerability has a high severity with a CVSS score of 8.8.
CVE-2026-100253 is a high-severity vulnerability in JetBrains TeamCity that allows sandbox escape and code execution via the versioned settings Kotlin DSL. It affects versions before 2026.2, including 2026.1.4 and 2025.11.8. The vulnerability is identified as CWE-184 and has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability.
A China-nexus threat cluster designated UAT-11587 has been targeting government and policy organizations across eight Asian countries since September 2025, delivering a previously undocumented Rust-compiled backdoor called Antino. The campaign primarily affected Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria through sophisticated spear-phishing operations using tailored political and diplomatic lures. The multi-stage infection chain leverages Cloudflare infrastructure for delivery and deploys Antino, which uniquely uses Microsoft 365 services—specifically Outlook and OneDrive—as dead-drop command-and-control channels rather than traditional C2 servers. The backdoor supports reconnaissance, command execution, file transfer, shellcode loading, and persistence establishment. Attribution to Chinese nexus is based on metadata containing Simplified Chinese artifacts, UTC+8 timestamps, use of China-focused Rust package mirrors, and targeting patterns consistent with Chinese intellige...
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli_query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.
This content describes a free educational course offered by Kaspersky aimed at university students to build foundational cybersecurity skills. It addresses students' concerns about practical skills and career readiness, emphasizing the importance of cybersecurity knowledge in technical fields. The course covers cybersecurity basics, common cyber threats like phishing, and introduces concepts such as Security by Design. It is designed to improve digital literacy and reduce human error-related security incidents. The course is not a security threat or vulnerability but an educational resource.
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.
CVE-2026-103398 is a vulnerability in Liquid-co's OpenSave product up to version 2.4.0. It involves improper validation of save paths supplied by paired peers in the manifest request handler, allowing attackers to specify arbitrary directories outside the configured save locations. This can lead to unauthorized reading and writing of files through manifest and sync routes. The vulnerability has a high severity with a CVSS score of 8.6.
CVE-2026-103397 is an authentication bypass vulnerability in Liquid-co OpenSave versions before 2.4.0-beta.1. The flaw allows attackers who know the room code to spoof the RelayMessage From field in WAN relay requests, impersonating paired devices. This enables unauthorized access to protected synchronization routes, including save data, snapshots, and file operations.
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.
CVE-2026-103395 is a critical vulnerability in ModelTC LightLLM versions up to 1.2.0. The vulnerability arises from an unauthenticated RPyC service with allow_pickle enabled, which deserializes attacker-controlled data in the remote_infer_images method. This allows remote attackers to execute arbitrary code with service account privileges by passing specially crafted objects.
LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disrupt inference operations and wedge workers on deployments started with --enable_rl.
CVE-2026-103243 is a server-side request forgery (SSRF) vulnerability in ModelTC LightLLM versions up to 1.2.0. The vulnerability arises because the product fails to validate the image_url and audio_url parameters in its multimodal endpoints. This allows unauthenticated attackers to supply arbitrary URLs, causing the server to fetch internal resources. The vision model processing can disclose content or error responses that reveal internal network topology. The vulnerability has a medium severity with a CVSS score of 6.9.
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.
This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
CVE-2026-102984 is a high-severity vulnerability in the Astro web framework prior to version 11.1.3. The @astrojs/node adapter improperly builds request URLs from the Host header, and a malformed port can cause an invalid URL. This leads to an uncaught TypeError exception before routing begins. In the default configuration, this results in an HTTP 500 response while the server continues running. However, if staticHeaders is enabled, the uncaught exception causes the Node.js process to terminate, impacting availability. The vulnerability does not expose data or allow code execution. The issue is fixed in version 11.1.3.
Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test(), an allowed origin appearing only in a source URL's path or query can satisfy image.domains or image.remotePatterns while the URL's actual host remains attacker-controlled. An unauthenticated request to the public /.netlify/images endpoint can therefore cause the Image CDN to request attacker-selected URLs and may probe or reach internal services. Netlify egress protections may constrain reachable targets, and image transformation limits direct response exfiltration; no confidentiality or integrity impact has been demonstrated. This issue is fixed in version 8.2.4.
CVE-2026-102717 is a high-severity vulnerability in Eclipse Foundation's NetX Duo affecting versions 6.4.4 through 6.5.1.202602. It involves an out-of-bounds read caused by an MQTT WebSocket setter ABI mismatch, which may lead to memory disclosure or application crashes.
AJA Video Systems HELO Plus devices with firmware versions before 2.1.7 contain a vulnerability where a hard-coded AES cryptographic key is embedded in the firmware. This allows unauthenticated attackers to decrypt sensitive diagnostics bundles by extracting the static passphrase from the publicly available firmware image. The vulnerability exposes highly sensitive server information through the unauthenticated diagnostics endpoint.
