Threat database

CVE-2026-46472 is a high-severity vulnerability in GStreamer's gst-plugins-good component prior to version 1.28.2. The isomp4 plugin's qtdemux_parse_chnl function may read beyond the bounds of a global array when parsing MP4 files, potentially causing information disclosure. This flaw does not affect integrity or availability but can expose sensitive data. No known exploits are reported in the wild. The issue is fixed in version 1.28.2.

A heap buffer over-read vulnerability exists in the isomp4 plugin of GStreamer gst-plugins-good before version 1.28.2. The issue occurs during MP4 file parsing in the qtdemux_parse_uuid function, potentially allowing an attacker to disclose heap memory contents. This vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-26846 is a critical buffer overflow vulnerability in WEINVEIW CO.,LTD EBPro version 6.10.01.510_20251022. It affects the UtilityManagerEx.exe component and allows a remote attacker to execute arbitrary code without any privileges or user interaction.

ELADMIN (eladmin-mp) versions up to 2.7 have an improper access control vulnerability in the role management module. The vulnerability exists in the PUT /api/roles/menu endpoint, which authorizes requests only by comparing role levels but does not validate the granted menu set or prevent users from modifying their own roles. A logged-in non-admin user with delegated 'roles:edit' permission can exploit this to modify their own role's menu permissions arbitrarily.

CVE-2026-95182 is a critical vulnerability in DeepSeek Harness (dsh) identified by an untrusted search path issue. This flaw allows attackers to execute arbitrary code by supplying and opening crafted executable files that replace legitimate content. The vulnerability has a CVSS score of 10, indicating maximum severity with network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Z.ai ZCode version 3.11.2.6792 has a vulnerability where it automatically connects to MCP servers specified in a repository's workspace configuration. This behavior may allow attackers to execute arbitrary code by opening a specially crafted repository. The vulnerability has a high severity rating with a CVSS score of 7.8, indicating significant potential impact on confidentiality, integrity, and availability.

A Cross Site Scripting (XSS) vulnerability exists in InstantForum.NET version 4.1.4 and earlier. The flaw allows an attacker to execute arbitrary code by reflecting unsanitized input from query string parameters directly into the HTML response without proper output encoding.

CVE-2026-95183 is a high-severity vulnerability in the context-compaction feature of DeepSeek Harness (dsh) identified in commit c291e796. It allows attackers to perform prompt injection attacks by supplying crafted external content. The vulnerability has a CVSS score of 8.8, indicating a significant risk with network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability. No affected versions or patches are explicitly stated in the provided data.

CVE-2026-84823 is a path traversal vulnerability in WildFly on Red Hat Enterprise Linux 8. A user with the Monitor role, which has the lowest standard RBAC privileges, can exploit this flaw via the take-snapshot operation by manipulating the name parameter. This allows writing a copy of the server configuration to an arbitrary location and subsequently reading sensitive configuration data, including credentials, bypassing RBAC restrictions. The vulnerability has a CVSS score of 7.1, indicating high severity.

A critical vulnerability (CVE-2026-102764) exists in internal components of BeyondTrust's Remote Support product due to inadequate validation of message origins. This flaw could allow an attacker to perform unauthorized file operations on the appliance without any privileges or user interaction. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

Trisolutions BRPerfX version 1.4.4.0 contains a vulnerability that exposes LDAP credentials in plaintext within its administrative configuration interface. An authenticated administrator can access the client-side code to retrieve these credentials, potentially compromising LDAP security. This issue has a high severity rating with a CVSS score of 7.5.

Red Hat has released an important security update for the Red Hat build of Quarkus 3.33.4 that addresses multiple vulnerabilities across various components including jackson-databind, jackson-core, Hibernate Validator, MongoDB Java Driver, RESTEasy, and others. The update fixes issues such as denial of service, path traversal, information disclosure, cross-site scripting, memory leaks, and certificate validation bypass. These vulnerabilities affect the Quarkus 3.33 build and related libraries. The advisory recommends applying this update after ensuring all previous errata are applied.

KGB RAT is a Windows Remote Access Trojan actively marketed on underground forums since late 2025. It is sold as Malware-as-a-Service with prices ranging from $150 to $800. The malware includes features such as credential theft, keylogging, hidden desktop takeover, ransomware, and psychological harassment tools like screamers and forced blue screens. It uses a daily updated fully undetectable (FUD) crypter to evade detection by Windows Defender and communicates with its command and control (C2) servers without requiring port forwarding. Notifications are delivered via Telegram. The malware is based on the NjRAT framework and includes a CryptoClipper module that swaps cryptocurrency wallet addresses. Development reportedly began in early 2022.

A high-severity authorization bypass vulnerability (CVE-2026-44084) affects Video Station. This flaw allows remote attackers to bypass authorization controls via a user-controlled key, potentially exposing sensitive data. The vulnerability has been fixed in Video Station version 5.8.8 and later.

A SQL injection vulnerability (CVE-2026-26244) affects Video Station. A remote attacker with a user account can exploit this flaw to execute unauthorized code or commands. The vulnerability has been fixed in Video Station version 5.8.8 and later. The CVSS v3.1 score is 8.8, indicating high severity.

A SQL injection vulnerability (CVE-2026-26245) affects Video Station. An attacker with a user account can exploit this flaw to execute unauthorized code or commands remotely. The vulnerability has been fixed in Video Station version 5.8.8 and later.

A path traversal vulnerability (CVE-2026-34015) affects Video Station. An attacker with a user account can exploit this flaw to read unauthorized files or system data. The vulnerability has been fixed in Video Station version 5.8.8 and later.

A NULL pointer dereference vulnerability in File Station 5 allows a remote attacker with a user account to cause a denial-of-service (DoS) condition. The issue has been fixed in version 5.5.6.5243 and later.

A NULL pointer dereference vulnerability exists in File Station 5 that can be exploited by a remote attacker with a user account to cause a denial-of-service (DoS) condition. The vulnerability has been fixed in File Station 5 version 5.5.6.5243 and later.