Threat database

A stack-based buffer overflow vulnerability exists in the DHCP fingerprinting daemon (fingerd) of WatchGuard Fireware OS. This flaw allows an unauthenticated attacker with adjacent network access to execute arbitrary code or cause a denial of service by crashing the process via a specially crafted DHCP packet. The vulnerability is identified as CVE-2026-81433 and is classified as high severity. No affected versions or patch information are provided, and no known exploits are reported in the wild.

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.

An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service.

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.

A reflected cross-site scripting (XSS) vulnerability exists in the Wikimedia Foundation's Mediawiki Cargo extension before version 1.46.1. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts into web pages. No CVSS score is provided for this vulnerability. The issue is classified as high severity due to the potential impact of XSS attacks. A fix is available in version 1.46.1.

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A stored cross-site scripting (XSS) vulnerability exists in the Mediawiki CentralAuth extension maintained by The Wikimedia Foundation. This vulnerability is caused by improper neutralization of input during web page generation, which allows malicious scripts to be stored and executed in users' browsers. It affects versions prior to 1.46.1, 1.45.5, and 1.43.10 of the CentralAuth extension. No CVSS score is provided, but the impact is considered high due to the nature of stored XSS vulnerabilities.

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetwork/set_syslog. The manipulation of the argument conloglevel/log_size results in command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A stored cross-site scripting (XSS) vulnerability exists in the Wikimedia Foundation MediaWiki WikiLambda extension prior to version 1.46.1. This vulnerability is due to improper neutralization of input during web page generation, which allows malicious scripts to be stored and executed in users' browsers. The issue is classified as high severity. No CVSS score is provided. No known exploits in the wild have been reported. The vulnerability affects versions before 1.46.1.

A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-71189 is a cross-site scripting (XSS) vulnerability in Toptech Systems TMS7 version 7.6.3. An attacker can craft a request that, when executed by another user, causes attacker-supplied JavaScript to run in the victim's browser within their session context. The vulnerability has a low CVSS score of 3.5, indicating limited impact. There is no information on available patches or vendor advisories. No known exploits are reported in the wild.

A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.

Zetetic SQLCipher versions before 4.15.0 contain an SQL injection vulnerability in the sqlcipher_export function. This function, used to copy data between databases, temporarily disables defensive restrictions for dynamic schema manipulation. A flaw in validating the source database name parameter allows crafted input to execute unauthorized SQL statements, potentially modifying the sqlite_schema table and causing database corruption. Version 4.15.0 introduces strict validation to prevent this bypass.

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or send unauthorized notifications to registered devices.

AiSOC versions 7.2.0 up to but not including 12.0.0 have a critical OS command injection vulnerability in the actions service. This flaw allows authenticated users to inject special characters into command parameters, enabling execution of arbitrary commands on managed endpoints with SYSTEM or root privileges.

AiSOC versions 7.5.0 up to but not including 12.0.0 contain a vulnerability where a hard-coded cryptographic key is used for JWT verification in the realtime WebSocket and SSE service if the AISOC_REALTIME_JWT_SECRET environment variable is not set. This allows unauthenticated attackers to forge subscription tickets with arbitrary tenant identifiers, enabling unauthorized access to cross-tenant live alerts, cases, agent events, and graph updates via realtime endpoints.

AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the add_tenants_to_portfolio endpoint to claim unclaimed tenants and read their security alerts, incidents, and posture metrics without consent.

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials.