This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-14. It is categorized as open-source intelligence (OSINT) concerning network activity and payload delivery. No specific malware details, exploits, or affected software versions are provided.
A vulnerability in containerd's CRI plugin allows containers restored from untrusted checkpoints via the CreateContainer API to bypass the destination security context, resulting in elevated privileges. The checkpoint restore process restores process credentials and security settings directly from checkpoint data without enforcing the container's configured security policies. This can enable an attacker to execute processes as root with full capabilities and no seccomp filters despite restrictive orchestrator policies. The issue affects Linux systems running containerd with CRI checkpoint restore enabled. The vulnerability is fixed by disabling checkpoint restore via CreateContainer by default in containerd 2.2.7 and 2.3.4, and the feature was removed entirely in 2.4.0. Users should update to these versions and recreate containers restored from untrusted checkpoints.
A vulnerability in containerd's layer unpack handler causes superlinear time complexity during unpacking of certain image layers with specific file configurations. This can lead to increased unpack times and moderate CPU usage, delaying container startup and reducing concurrency for image pulls in orchestrators like Kubernetes. The issue is fixed in containerd versions 2.3.5, 2.2.8, 2.0.12, and 1.7.35. No workarounds exist, so users should only pull trusted images until patched.
A vulnerability in oauth-proxy allows improper validation of the destination redirect parameter after login, enabling an attacker to redirect users to arbitrary external websites. This open redirect flaw can be exploited for phishing or credential theft. Red Hat has issued a security advisory with updates for OpenShift Container Platform 4.20.41 to address this issue.
A heap buffer overflow vulnerability (CVE-2026-102560) exists in libsoup 2.4 when the permessage-deflate WebSocket extension compresses very large outgoing messages. The flaw is caused by truncated size calculations that lead to buffer growth wrapping and zlib writing beyond allocated memory. This vulnerability has a high severity with a CVSS score of 9.8. Red Hat has issued an important security update for Red Hat Enterprise Linux 9 to address this and related heap buffer overflow issues in libsoup.
Akaunting version 3.1.21 contains an authenticated improper authorization vulnerability in its common BulkActions dispatcher component. This flaw allows users with some level of authorization to perform actions beyond their intended permissions. The vulnerability is identified as CVE-2026-19198 and is classified under CWE-863 (Improper Authorization). No patch or remediation information is currently provided.
CVE-2025-43715 is a local privilege escalation vulnerability in Nullsoft Scriptable Install System (NSIS) on Windows versions before 3.11. It arises from improper handling of the temporary plugins directory creation under %WINDIR%\temp, allowing unprivileged users to exploit a race condition and escalate privileges to SYSTEM during installation.
CVE-2025-1390 is an improper access control vulnerability in the pam_cap.so module of libcap on OpenAnolis Anolis OS. The vulnerability arises because group names not starting with '@' are incorrectly recognized as group names during configuration parsing. This can cause unintended users to inherit capability sets, potentially allowing local privilege escalation. The issue affects systems using /etc/security/capability.conf for user privilege configuration.
CVE-2024-42513 is a vulnerability in the OPC UA .NET Standard Stack versions prior to 1.5.374.158 that allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints. The vulnerability has a medium severity with a CVSS score of 5.3. It does not impact confidentiality, integrity, or availability beyond authentication bypass. No known exploits are reported in the wild. No official patch or remediation information is provided in the available data.
CVE-2024-42512 is a high-severity vulnerability in the OPC UA .NET Standard Stack versions before 1.5.374.158. It allows an unauthorized attacker to bypass application authentication if the deprecated Basic128Rsa15 security policy is enabled. This could lead to unauthorized access with high confidentiality impact, limited integrity impact, and limited availability impact.