A vulnerability in Unisoc (Shanghai) Technologies Co., Ltd. modem products T8100, T9100, and T8300 allows local information disclosure due to missing filtering of sensitive data in crash dumps. This issue does not require additional execution privileges and has a medium severity rating with a CVSS score of 5.5.
CVE-2026-87765 is a medium severity vulnerability in the Unisoc kernel apsys DVFS driver caused by improper input validation of the frequency index. This flaw can lead to out-of-bounds reads or hardware register corruption, potentially causing system instability or denial of service when exploited with local privileges.
CVE-2026-108785 is a medium severity vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It involves a flaw in the JwtTokenUtil.refreshHeadToken function within the JwtAuthenticationTokenFilter component, which can be exploited remotely to cause session expiration. An exploit has been published, and a patch identified by commit 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a is recommended to remediate the issue.
CVE-2026-108784 is a business logic vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It affects the Payment Endpoint component, specifically the AlipayServiceImpl.pay function, where manipulation of the total_amount argument can cause business logic errors. The vulnerability can be exploited remotely without authentication. A patch identified by commit dcaa93b3150352e5044708d7211b5bed0af4509f is available to remediate this issue. The CVSS 4.0 base score is 6.9, indicating medium severity.
CVE-2026-108783 is a security vulnerability in PRVTPRO Amnezia-Web-Panel versions 1.6.0 through 1.7.2. It involves the use of default credentials in the Backup Download component, specifically in the app.py file. The vulnerability can be exploited remotely without authentication. Public exploit details have been disclosed, but the vendor has not responded or provided a fix. The CVSS 4.0 score rates this vulnerability as medium severity.
CVE-2026-108782 is a medium severity SQL injection vulnerability in erzhongxmu JEEWMS version 2026.09.27-W39. The issue exists in the CommonServiceImpl.getAutoList function of the Autocomplete Handler component, where manipulation of the argument trem/searchField/entityName can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, but the vendor has not responded or provided a fix.
CVE-2026-108781 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically affecting version 2026.09.27-W39. The flaw exists in the WmToMoveGoodsController.list function of the PDA Interface component, where manipulation of the searchstr argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, but there is no vendor response or patch at this time.
CVE-2026-108779 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically in the WmSttInGoodsController.list function. The vulnerability arises from unsafe manipulation of the 'searchstr' argument, allowing remote attackers to perform SQL injection. The affected version is 2026.09.27-W39. Public exploit code exists, but there is no vendor response or patch available as of the publication date.
CVE-2026-108778 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically affecting version 2026.09.27-W39. The flaw exists in the WmInQmIController.list function of the Inbound Quality Check Pda Interface component, where manipulation of the 'searchstr' argument allows SQL injection. The vulnerability can be exploited remotely without user interaction and has been publicly disclosed. The vendor has not responded to the disclosure, and no patch or remediation information is currently available.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to libpng packages. The update addresses multiple security issues identified by several CVEs. The advisory provides updated RPM versions for various architectures. No explicit details on the vulnerabilities or their exploitation are provided. The update is available and should be applied to affected systems.
This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-11. It is categorized as OSINT related to network activity and payload delivery but does not specify a particular malware or exploit. No affected software versions or technical details are provided.
Noir is a cryptocurrency wallet-drainer malware kit that uses DNS TXT records and DNS-over-HTTPS (DoH) as a dynamic command-and-control mechanism. It queries public DoH services to locate active infrastructure hosted on Cloudflare Pages, enabling operators to redirect phishing lures by changing a single DNS record. The malware does not require victims to input seed phrases or private keys but instead requests wallet connection permissions and spending approvals, which appear less suspicious. Its architecture separates long-lived phishing lures from short-lived operational infrastructure, with DNS caching and retry logic. The kit is AI-assisted, with extensive code comments documenting its development, and is used across multiple cryptocurrency-themed phishing campaigns.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing a medium severity vulnerability identified as CVE-2026-107655 in the cups package. The update includes multiple cups-related RPMs across various architectures. No explicit details on the vulnerability's nature or exploitation are provided beyond the CWE-476 reference. A security update is available to address this issue.
OpenPrinting CUPS versions through 2.4.20 have a resource-exhaustion vulnerability in the submission-timeout handling of the cupsdCheckJobs() function. This flaw allows a client connected to the IPP service to hold an incomplete Send-Document request, preventing unrelated incomplete jobs from timing out. As a result, incomplete jobs can accumulate until the MaxJobs limit is reached, causing denial of service by rejecting legitimate print submissions. The issue resolves when the held connection closes.
Red Hat has released a security and bug fix update for Red Hat Advanced Cluster Security for Kubernetes (RHACS) version 4.11.5. This update addresses multiple security vulnerabilities identified by CVE-2026-84304 and CVE-2026-84445. Users of earlier RHACS versions are advised to upgrade to 4.11.5 to benefit from these security patches and bug fixes. The update also fixes an issue related to view-based report creation permissions. The advisory references release notes for detailed information on fixes and enhancements.
SUSE Linux Enterprise 15 SP5 kernel received a security update addressing multiple vulnerabilities across various kernel components including networking, bonding, team, cpuidle, bpf, netfilter, sctp, futex, dm log, locking, virtiofs, tipc, keys, apparmor, scsi target, ipv6, tunnels, netfilter synproxy, nfc, security keys, net tls, drm, af_unix, vsock, RDMA, crypto, bpf devmap, ipv4 igmp, ALSA, KVM, rhashtable, fib, gtp, xfrm, btrfs, pppoe, ceph, and others. These fixes resolve issues such as memory leaks, infinite loops, type confusion, use-after-free, out-of-bounds reads/writes, race conditions, and other kernel-level bugs. The update is classified as high severity due to the breadth and nature of the vulnerabilities fixed. No CVSS score is provided. No specific affected versions are explicitly stated in the input data.
The npm package 'api-nebula' version 1.0.0 contains a malicious preinstall script that executes obfuscated JavaScript code during installation. This code uses a custom pseudo-random number generator and string-table decoder to conceal its true behavior, which includes executing arbitrary attacker-controlled code on the installer's machine. The obfuscation prevents static analysis from revealing network destinations or commands. Installing this package can lead to full system compromise, and any secrets or keys on the affected machine should be considered exposed and rotated immediately.
An out-of-bounds read vulnerability exists in libX11's X Input Method (XIM) attribute parser in versions before 1.8.14. This flaw could be exploited by a malicious X server to crash connected X clients, causing a denial of service. The vulnerability has a medium severity rating with a CVSS score of 6.5. Fixes are available in updated libx11 package versions across multiple Ubuntu releases.
An out-of-bounds read vulnerability exists in libX11's X Input Method (XIM) trigger-key registration parser before version 1.8.14. This flaw could be exploited by a malicious X server to crash connected X clients, causing a denial of service. The vulnerability has a medium severity rating with a CVSS score of 5.5. Fixes are available in updated libx11 package versions across multiple Ubuntu releases.
An out-of-bounds read vulnerability exists in libX11's byte-oriented codeset parser in versions before 1.8.14. This flaw could be exploited by a malicious X server to crash attached X clients, resulting in a denial of service. The vulnerability has a medium severity rating and a CVSS score of 5.1. A patch addressing this issue is available and should be applied to affected systems.