CVE-2026-110385 is a high-severity remote code execution vulnerability in ONLYOFFICE Document Server versions before 10.0.0. It allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary OS commands as the ds service account. The vulnerability arises from improper processing of user-controlled converter XML in the Document Builder API, enabling path override and arbitrary file write outside the job directory. This can lead to overwriting the runtime.json configuration file and modifying executable paths and arguments, resulting in command execution during subsequent Document Builder jobs.
Hyland Desktop Host for Windows versions before 25.1.1 contains a local privilege escalation vulnerability due to incorrect default permissions on a privileged service executable located in the %PROGRAMDATA%\Hyland\DesktopHost\bin folder. This weakness allows a local user to escalate their privileges on the affected system.
CVE-2026-108473 is a high-severity vulnerability in TP-Link Systems Inc. HS103 v5 devices involving missing authentication for critical functions in the local device-management protocol. An unauthenticated attacker on an adjacent network can send management commands without proper authentication, potentially modifying device state or settings. Additionally, under certain conditions involving user, mobile app, and cloud interactions, account-related information may be exposed, risking cloud account compromise.
CVE-2026-50218 is a high-severity vulnerability in Akamai Guardicore Platform Agent (GPA) versions before 7.4. The GPA client improperly validates JWT tokens used for seeding, allowing an attacker to inject arbitrary parameters via a spoofed JWT token. This can lead to unauthorized reconfiguration and full compromise of the application's functionality. The attack requires convincing a user to interact with a malicious link or knowledge of the IDP URL used by an enrolled client. A patch is available to address this issue.
CVE-2026-50217 is a use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent. It allows a local low-privileged user to cause a denial of service (system crash or BSOD) by sending an outbound ICMPv6 packet with an IPv6 Hop-by-Hop extension header when the IPv6 ICMP redirect policy is enabled. The vulnerability arises because a buffer containing the packet is freed but still passed to a downstream filter, with the size of the freed allocation attacker-controlled. Exploitation requires the non-default IPv6 ICMP capture/redirect policy to be active on the endpoint. A patch is available for affected versions.
CVE-2026-50216 is an integer underflow vulnerability in the DNS proxy component of the macOS NetworkExtension system extension used by Akamai Guardicore Platform Agent (GPA). When a UDP datagram shorter than 96 bytes with a specific initial value is processed, a size calculation underflows, leading to an allocation failure and an uncaught Objective-C exception that aborts the root system extension. This results in a denial of service condition. The vulnerability affects GPA versions from 0 up to but not including 7.4. A patch is available to address this issue.
CVE-2026-50215 is a use-after-free vulnerability in the Windows WFP packet-capture driver of Akamai Guardicore Platform Agent before version 7.4. It can be triggered by a local attacker with Administrator privileges sending a crafted IPv6 packet when an IPv6 proxy/redirect rule is active, causing an immediate system crash.
A local privilege escalation vulnerability exists in the Akamai Guardicore Platform Agent (GPA) before version 7.4 on macOS. The flaw is in the wapptunneld component, which improperly validates network interface names used in system command execution. An unprivileged local user who can rename network interfaces can inject malicious commands that execute with root privileges when a specific logout action is triggered. This vulnerability is identified as CVE-2026-46449 and has a CVSS score of 6.7 (medium severity).
A credential phishing campaign targeted WatchGuard Mobile VPN users via a fake download site watchguard-vpn.net. The attackers used SEO poisoning to appear in search results and collected credentials through repeated browser pop-ups, deliberately rejecting the first submission to capture multiple passwords. After credential theft, the campaign downloaded the genuine WatchGuard VPN client from the official CDN, bypassing detection by security tools. The stolen credentials included server addresses, usernames, and passwords, potentially granting attackers network access. The phishing domain watchguard-ssl.online was re-registered and fully operational by September after being inactive earlier in the year.
Cybercriminals are distributing remote access trojans (RATs) via phishing emails that mimic legitimate event invitations. These emails contain download buttons leading victims through fake CAPTCHA verification pages on newly created domains. After verification, users are prompted to download an eInvite file that contains a zipped folder with a weaponized ConnectWise Screen Connect installer acting as a RAT. Execution of this installer grants attackers full remote access to the victim's device, indicated by an inconspicuous taskbar icon. The campaign exploits user curiosity, especially during holiday seasons when event invitations are common.
JTL SW GmbH JTL-WMS contains an authentication bypass vulnerability in its WMS MobileServer authorization middleware. The middleware fails to require authentication for HTTP methods other than GET and HEAD, and also allows requests with malformed or non-bearer Authorization headers to bypass token validation. This allows remote attackers with network access to invoke API functions without valid credentials. The vulnerability affects versions prior to 2.0.7, 2.1.2, and 2.2.1. The CVSS 4.0 score is 10.0, indicating critical severity.
A vulnerability in mp4v2 version 2.0.0 allows an attacker with local privileges to execute arbitrary code. The flaw exists in the MP4RtpAtom::ReadHntiType() function due to an unchecked offset subtraction that can cause an extremely large memory allocation. This can be triggered by processing a specially crafted MP4 file containing an undersized RTP atom.
A critical remote code execution vulnerability exists in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) version 1.0.3. This flaw allows an unauthenticated attacker to execute arbitrary code on the affected device, potentially leading to full compromise. The vulnerability is identified as CVE-2026-78802 with a CVSS score of 9.8, indicating high severity. No patch or remediation information is currently provided.
Mobile Security Framework (MobSF) version 4.5.2 contains a critical command injection vulnerability in its Dynamic Analyzer ADB integration module, specifically in the /download_data/ and /api/v1/scan endpoints. This vulnerability allows an unauthenticated attacker to execute arbitrary commands remotely, potentially leading to full system compromise.
This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-13. It is categorized as OSINT related to network activity and payload delivery but lacks detailed technical information or specific malware signatures.
A heap-based buffer overflow vulnerability exists in the libxml2 library's xmlXPtrEval function due to xpointer length saturation (CVE-2026-86142). This vulnerability affects Red Hat Enterprise Linux 8 across multiple architectures. Red Hat has issued a security advisory with an update to address this moderate severity issue. The advisory provides updated libxml2 packages to fix the flaw.
Red Hat has issued a security advisory for a bug fix and enhancement update to Red Hat Hardened Images RPMs, specifically updating curl and related libcurl packages. The advisory addresses CVE-2026-92392, classified with high severity. The update includes curl version 8.23.0-0.1.hum1 and corresponding libcurl packages for multiple architectures. No specific details about the vulnerability or its exploitation are provided in the advisory.
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a buffer overrun vulnerability in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. This flaw allows a remote attacker to send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector, potentially causing denial of service or arbitrary code execution on the Collector appliance. The vulnerability is identified as CVE-2026-84058 with a high severity CVSS score of 8.1.
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a buffer overflow vulnerability that could allow a remote attacker to execute arbitrary code. This vulnerability is identified as CVE-2026-84246 and has a high severity rating with a CVSS score of 8.1. The flaw could be exploited remotely without user interaction but requires high attack complexity and no privileges. No patch or remediation information is currently provided.
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a SQL injection vulnerability that allows remote unauthenticated attackers to execute crafted SQL statements. This could enable attackers to view, add, modify, or delete data in the backend database.