A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials.
src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KEX_DH_GEX_REPLY (33) when a server receives them from an unauthenticated client. IsMessageAllowedServer() applies no direction check to the key exchange message range: when the peer is keying and no particular message is expected, which is the state a server is in for the whole window after it processes the client's KEXINIT because nothing sets handshake->expectMsgId there, the function falls out of its expectation branch without a verdict and reaches a numeric bound that admits every message id from 30 through 34. A client that negotiates diffie-hellman-group-exchange-sha256 and then sends message 31 makes the server run the client-side handler DoKexDhGexGroup(), which validates the attacker-supplied group with two 8-round Miller-Rabin primality tests, one on p and one on (p-1)/2, on a value of up to 8192 bits. The handler then returns success: the server stores the attacker's prime and generator, generates a Diffie-Hellman key pair in the attacker's group, and sends the client-role message SSH_MSG_KEX_DH_GEX_INIT (32) back to the attacker. Published RFC 3526 safe primes are the worst-case input and cost the attacker nothing to obtain. The primality validation was added in 1.5.0; versions from 1.2.0 through 1.4.22 admit the same message and enter the same client-role path without the primality cost. Message 33 is admitted as well, but on a server it is rejected before any cryptography because no public key check callback is registered, so it carries no comparable cost. Builds that define WOLFSSH_NO_DH_GEX_SHA256, which is implied by WOLFSSH_NO_DH or NO_SHA256, are unaffected.
Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSH_RealPath() in src/ssh.c appends each path component with a remaining-size bound (outSz - curSz) rather than the full destination size, so once the accumulated path reaches half the output buffer the size_t computation n - strlen(s1) - 1 wraps to near SIZE_MAX. The strncat() call is then effectively unbounded and copies the whole component; when that component exactly fills the remainder of the buffer, its terminating null is written one byte past the end. The caller's own length check keeps the copied data inside the buffer, so the overflow is limited to that single null byte, which may corrupt an adjacent stack value and crash the process. Applications that call the public wolfSSH_RealPath() with an output buffer smaller than the input path are additionally exposed to an unbounded copy, because the word32 expression outSz - segSz in that length check also wraps.
When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged user with a valid account on the server can exploit this to force a login as a more privileged user. The vulnerability was introduced with the initial Windows port of wolfSSHd in wolfSSH version 1.4.15 and affects all versions through 1.5.0. Non-Windows builds of wolfSSHd are not affected.
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.
wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated ssh->handshake->pubKeyId, and the RFC 5656 curve identifier string is discarded via GetSkip() rather than compared. An active network man-in-the-middle attacker can substitute a host key blob containing a different ECDSA curve, causing the client to import the key on the wrong curve. Because the attacker controls the private key for the substituted curve, signature verification passes. Exploitation requires an active MitM position and a lax public key check callback (e.g., TOFU, algorithm-name-only check, or fingerprint match against the parsed key).
CVE-2026-106061 is a medium severity vulnerability in GIMP's X cursor (XMC) thumbnail loader on Red Hat Enterprise Linux 10. The flaw involves an integer overflow during pixel buffer size calculation, leading to an out-of-bounds read on the heap. This can cause GIMP to crash or corrupt process memory. The vulnerability requires local access with user interaction and does not impact confidentiality or integrity but affects availability.
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the '
Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing session.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
CVE-2026-19386 is a critical stack-based buffer overflow vulnerability in ASUS router modules. It allows an authenticated nearby user to execute arbitrary code by uploading a crafted configuration file that exceeds the expected buffer size. The vulnerability requires high privileges and no user interaction. No specific affected versions or patch information is provided in the available data.
This is a conceptual open-source project proposing a passive, drop-in defense kit for small websites to detect, slow down, and persuade misbehaving autonomous AI agents. It aims to provide small sites, which typically lack dedicated security teams, with tools such as unique bait files, canary credentials, embedded stop notices, and logging to identify automated misuse without active countermeasures. The project is in early planning stages with no production-ready code yet and builds on existing tools like Canarytokens and Nepenthes. It does not represent a vulnerability or exploit but rather a security tool concept addressing emerging AI agent threats.
CVE-2026-16528 is a vulnerability in certain ASUS router models where sensitive information, specifically DDNS credentials, is inserted into system log files. This flaw allows a remote authenticated attacker to access these credentials from the logs, which could potentially enable unauthorized modification of DNS settings. The vulnerability has a high severity score of 8.4. No specific affected versions or patch information is provided in the available data.
This entry is a daily podcast update from the SANS Internet Storm Center (ISC) dated October 7th, 2026. It provides general information about the ISC Stormcast podcast and related SANS classes but does not contain any specific security threat, vulnerability, or exploit details.
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations.
A cyberattack on the Arizona Supreme Court system resulted in the theft of personal information for approximately 1.3 million people, including data related to unpaid court fees, fines, and restitution payments dating back 30 years. Additionally, records of nearly 30,000 orders of protection and 150,000 foster care reports from 2010 onward were stolen. The breach began when a court employee clicked a malicious email link. The attack was detected and stopped within two hours, with no evidence of data misuse or sharing. No court cases were affected or delayed, and no records were altered or deleted. Information about jurors, witnesses, or court employees was not compromised.
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's X-Sendfile mechanism to retrieve sensitive files without authentication.
Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RWC1 as well as from ADM 5.0.0 through ADM 5.1.4.RL21.
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a vulnerability (CWE-94) that allows a remote authenticated attacker to execute arbitrary code due to improper control of code generation. This vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.
CVE-2026-93443 is a high-severity vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.2. It allows a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, classified as CWE-94 (Code Injection). The vulnerability requires low privileges and high attack complexity. No official patch information is provided in the input data.
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to access sensitive information by improperly limiting pathnames to restricted directories. This vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity. The flaw does not impact integrity or availability but allows unauthorized disclosure of information. No official patch or remediation details are provided in the available data.