GouGuOA versions 6.0.5 and earlier contain a critical SQL Injection vulnerability in the /home/message/rubbish endpoint via the keywords parameter. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
WookTeam versions 1.6.6 and earlier contain a critical remote code execution vulnerability in the project task export interface. The vulnerability arises because a base64-decoded data parameter is passed directly to an eval call without proper sanitization, allowing attackers to execute arbitrary PHP code. This flaw is identified as CVE-2026-88393 and has a CVSS score of 9.8, indicating a critical severity level.
CVE-2026-37719 is a critical remote code execution vulnerability in dormakaba evolo Service affecting all versions. It allows an unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a .NET component. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
Unimall version 4 contains a directory traversal vulnerability in the FileUploadController.local() function. This flaw allows an unauthenticated attacker to execute arbitrary code on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.5. No specific affected versions or patches have been provided in the available data.
WookTeam versions 1.6.6 and earlier contain a directory traversal vulnerability in the project task export endpoint. This flaw allows an attacker to download arbitrary files from the server by supplying a crafted JSON payload to the /api/project/task/export endpoint. The vulnerability arises because the file path from the JSON is concatenated without normalization or boundary checks, enabling traversal outside the intended storage directory. This can expose sensitive files readable by the web server process.
Northstar versions up to 9.1.1 enable the H2 Console without proper authentication, exposing the /h2-console endpoint. The authentication interceptor only protects /northstar/** paths, leaving /h2-console accessible without credentials. The embedded H2 database uses the default 'sa' user with an empty password. This misconfiguration allows any network-reachable attacker to execute arbitrary system commands via the CREATE ALIAS feature, resulting in pre-authentication remote code execution.
The npm package internallib_v275 version 1.0.3 contains malicious code that executes a reverse shell by fetching and running a payload from a hardcoded IP address. This allows remote attackers to gain interactive shell access on the host machine. The package uses an unauthenticated network retrieval without integrity verification, increasing the risk of compromise. Removal of the package alone may not fully remediate the infection due to potential persistence mechanisms.
A security update for suseconnect-ng has been released, updating the software to version 1.23.0. The update includes improvements such as using product identifiers for product migrations, switching the default Go version to go1.26-openssl for package building support, fixing flag parsing to properly handle unknown flags, ensuring consistent interactive/noninteractive handling during release package installation, adding an optional collector for installed SUSE vendored RPM packages, and allowing deregistration when a subscribed registration code has expired.
This entry reports on ThreatFox Indicators of Compromise (IOCs) dated 2026-10-04. It is related to malware activity involving network behavior and payload delivery, but lacks specific technical details or exploit information.
A malicious campaign involving at least ten Visual Studio Code extensions distributed via the VS Code Marketplace and Open VSX registries has been identified. Two confirmed malicious themes execute threat actor-controlled code using encrypted JavaScript loaders, Russian-language gating, and Solana blockchain transaction memos for dynamic payload resolution. These extensions have been installed tens of thousands of times, posing a significant supply chain risk. Some extensions remain unweaponized but retain executable capabilities. The campaign is linked to the GlassWorm threat actor and uses brandjacking and infrastructure rotation tactics to evade detection.
The Psychedelic Stealer is a malware campaign active in September 2026 targeting Ukrainian small-business websites. It uses a fake Cloudflare CAPTCHA page to socially engineer victims into manually executing msiexec.exe commands, leading to malware installation. The malware steals browser credentials, session tokens, and cryptocurrency wallet data from wallets such as MetaMask and Trust Wallet. It maintains persistence via browser extensions with native-messaging bridges and scheduled tasks, and communicates with a REST API for additional commands. The campaign avoids encoded PowerShell scripts and uses signed Microsoft binaries to evade detection. The attack is financially motivated and focused on Ukrainian victims.
BraZetsu is a Python-based Windows malware framework used by the Brazilian threat actor Exilware. It functions as a toolkit for Initial Access Brokers, converting compromised systems into assets for sale in underground markets. The malware targets corporate, financial, industrial, and law enforcement sectors primarily in Iberia and Latin America. It harvests financial transaction files in the Brazilian CNAB format, browsing histories, and digital certificates. BraZetsu supports the 'Infected Marketplace' where initial access is sold to criminal clients for further exploitation. Since early 2026, it has rapidly evolved to include AI-enhanced reconnaissance and advanced evasion techniques. There is no indication of known exploits in the wild or available patches.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including multiple updated httpd-related packages. This update addresses several security issues identified by multiple CVEs. The advisory provides updated RPM versions for aarch64 and x86_64 architectures but does not specify detailed vulnerability descriptions or affected versions. The advisory indicates a high severity level and provides updated packages to remediate the issues.
This security update for jline3 addresses multiple security vulnerabilities and bugs by updating to upstream version 3.30.17. The fixes include a native stack buffer overflow in a Windows JNI method, authenticated SSH resource leaks and denial-of-service issues, and TCP socket file descriptor leaks. Additional bug fixes and dependency updates are also included. SSH agent forwarding is now disabled by default as a breaking change. No CVSS score is provided, but the update mitigates several medium-severity security issues.
A stack-based buffer overflow vulnerability exists in the type1_callsubr function of the Pdfwrite component in Artifex Ghostscript up to version 10.09.0. This flaw allows remote attackers to potentially exploit the vulnerability. A patch has been implemented to fix the issue by adjusting the font parsing logic. The vulnerability has a CVSS score of 6.3, indicating medium severity.
A reachable assertion failure in the Cell Broadcast encoding parsing component of ModemManager can cause a denial of service condition. This vulnerability affects multiple specific versions of ModemManager. No patch information is provided, and no known exploits are reported in the wild. The severity is assessed as medium due to the denial of service impact.
A high-severity vulnerability (CVE-2026-96512) was discovered in the sudo utility affecting versions prior to 1.9.17-16.p2.2.hum1. The flaw involves time-based access restrictions using NOTBEFORE or NOTAFTER rules when timestamps omit the trailing 'Z', allowing an attacker to bypass these restrictions by manipulating the TZ environment variable. Official security updates have been released by SUSE and Red Hat to address this issue. No known exploits have been reported in the wild.
A vulnerability in GIMP's Lighting Effects filter occurs when processing a specially crafted lighting preset file, leading to improper validation. This flaw has a CVSS score of 7.8, indicating a medium severity with potential high impact on confidentiality, integrity, and availability. Multiple specific GIMP versions are affected, primarily various 2.8.x, 2.10.x, and 3.x releases. A security update addressing this issue is referenced in Red Hat advisory RHSA-2026:75575 and provided by the SUSE Product Security Team as an equivalent fix. No explicit patch details or technical exploitation methods are provided in the available data.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to multiple systemd-related packages. The advisory addresses a vulnerability identified as CVE-2026-15059, classified with medium severity. The update provides bug fixes and enhancements to systemd components across aarch64 and x86_64 architectures. No specific affected versions are detailed, and no known exploits are reported in the wild. The advisory includes instructions to apply the update via Red Hat's image repository.
