WatchGuard released patches for 15 vulnerabilities in Fireware OS, including a critical remote code execution (RCE) vulnerability (CVE-2026-86131) involving code injection via BOVPN over TLS client configurations. Exploitation could allow remote attackers controlling a VPN server to execute commands with root privileges on Firebox appliances. The update also addresses 13 other high-severity issues such as RCE, authorization bypass, denial-of-service, unauthorized SSLVPN access, and arbitrary local file reads, plus a medium-severity improper authorization flaw. Additional critical and high-severity vulnerabilities affecting WatchGuard Access Points were patched in version 3.4.8. No exploitation in the wild is currently known.
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting.
This issue affects Maksisoft Gym: from 0.5.10 before 0.5.11.
Suri Oculus 4.0 is an open-source network monitoring and analysis platform built on top of Suricata, designed to provide host behavior profiling and anomaly analysis. It aggregates network data such as flows, DNS, TLS, ports, and Suricata alerts to build behavioral profiles for hosts, enabling detection of deviations from normal activity. The platform uses a combination of C++, Python, Redis, and web technologies to deliver high-performance log management and analysis. It is intended to complement Suricata's signature-based detection with statistical anomaly detection using Isolation Forest. Pre-built packages are available for multiple Linux distributions. This is a security tool project, not a vulnerability or exploit.
A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.
A missing authorization vulnerability in Amauri.IO WPMobile.App (wpappninja) allows unauthorized retrieval of embedded sensitive data. This affects versions of WPMobile.App up to and including 11.83. The vulnerability is identified as CWE-862. No patch or remediation information is currently available.
A SQL injection vulnerability exists in OS4ED openSIS-Classic up to version 9.3 in the save action function of modules/students/Student.php within the General Information Tab component. This vulnerability allows remote attackers with high privileges to manipulate the 'students' argument to execute SQL injection attacks. The vulnerability has a medium severity score of 4.7 and has been publicly disclosed. The project has been informed but has not yet responded or issued a patch.
MISP has a privilege escalation vulnerability in its tag collection creation and editing functionality. An authenticated user with tag editor permissions can exploit this flaw by including additional model data in requests, leading to unauthorized creation or modification of User and Organisation records. This allows escalation from tag editor to site administrator. The vulnerability affects MISP versions prior to 2.5.48.
A SQL injection vulnerability exists in OS4ED openSIS-Classic up to version 9.3 in the DBQuery_assignment function within the Assignment Management Endpoint. This vulnerability allows remote attackers with low privileges to manipulate the 'Tables' argument to execute SQL injection attacks. The vulnerability has a CVSS 3.1 score of 6.3, indicating a medium severity impact on confidentiality, integrity, and availability. The project has been notified but has not yet responded or issued a fix. Exploit code is publicly available, but no active exploitation in the wild has been reported.
CVE-2026-10764 is an information disclosure vulnerability affecting BVMS versions 4.5 up to 12.3. It allows man-in-the-middle attackers to gain unauthorized access to sensitive data. The vulnerability has a high severity with a CVSS score of 8.7.
MISP has a mass assignment vulnerability in its event delegation feature affecting versions prior to 2.5.48. Authenticated users with delegation permission can manipulate delegation records to gain unauthorized read access to arbitrary events and potentially transfer event ownership. This vulnerability allows overwriting existing delegation records and unauthorized event access across organizations.
MISP contains an improper input validation vulnerability in its ORM save path that allows an authenticated user with low-level write permissions to manipulate nested input data. This flaw enables attackers to overwrite, re-parent, or soft-delete database rows belonging to other organizations or events without read access. The vulnerability affects multiple entity types including Attribute, Object, EventReport, Sighting, AttributeTag, and ShadowAttribute. It impacts versions prior to 2.5.48.