Threat database

A NULL pointer dereference vulnerability (CVE-2026-24722) affects File Station 5. A remote attacker with a user account can exploit this flaw to cause a denial-of-service (DoS) condition. The issue has been fixed in File Station 5 version 5.5.6.5243 and later.

A path traversal vulnerability (CVE-2025-66272) affects Video Station, allowing a remote attacker with a user account to read unauthorized files or system data. The vulnerability has been fixed in Video Station version 5.8.5 and later. The CVSS score is 6.5, indicating a high severity issue.

A path traversal vulnerability (CVE-2025-66275) affects Video Station, allowing a remote attacker with a user account to read unexpected files or system data. The vulnerability has been fixed in Video Station version 5.8.5 and later. The CVSS score is 6.5, indicating a high severity issue.

CVE-2026-101306 is a critical vulnerability involving SCM_RIGHTS file descriptor passing that fails to preserve the FD_RESOLVE_BENEATH restriction when transferring descriptors over Unix domain sockets. This flaw allows a process to clear filesystem root restrictions by sending a directory file descriptor to itself, enabling escape from a jail environment's filesystem confinement.

The renameat(2) system call did not enforce the FD_RESOLVE_BENEATH flag on its directory arguments, allowing a jailed process to rename a directory relative to a restricted descriptor and potentially escape the jail root via fchdir(2). This vulnerability requires the directory to be on a filesystem accessible from the jail's root. A process in a jail that has a directory file descriptor from another jail can exploit this to bypass filesystem root restrictions.

CVE-2026-79607 is a vulnerability in Xenstore where during a live update, the state record for a Xenstore watch with a specified watch depth is written with two bytes missing. This causes an inconsistent state when the state is read back in the new Xenstore instance, potentially leading to a crash or incorrect Xenstore data.

Multiple heap buffer overflow vulnerabilities have been identified in libsoup3, an HTTP library used in GNOME applications for asynchronous HTTP communication. These vulnerabilities affect various aspects of data processing, including base64 decoding of data-URIs, WebSocket message handling, and buffer growth during WebSocket operations. Red Hat has issued security updates addressing these issues in Red Hat Enterprise Linux 10 and related products.

This entry provides Indicators of Compromise (IOCs) from ThreatFox dated 2026-10-15. It relates to observed malware activity involving network behavior and payload delivery. No specific technical details, affected software versions, or exploit information are provided.

Red Hat has issued a security advisory for an update to Red Hat Hardened Images RPMs, specifically including multiple nodejs26-related packages. The update addresses a security issue identified as CVE-2026-109855. No explicit details on the nature of the vulnerability or its exploitation are provided. The advisory lists updated package versions for nodejs26 and related components across multiple architectures.

Red Hat AI Inference 3.4.6 (rocm) is identified with multiple security vulnerabilities including CVE-2026-15679. The advisory lists numerous CVEs affecting the Red Hat AI Inference Server but does not provide details on specific vulnerabilities or fixes. No patches or remediation steps are currently available as per the vendor advisory.

Red Hat AI Inference Model Optimization Tools 3.4.6 (cuda) has been identified with multiple security vulnerabilities. The advisory lists several CVEs affecting this product, but no fixes or patches are currently provided. The vulnerabilities include issues related to path traversal, improper certificate validation, and code injection among others. The vendor has published an advisory but does not indicate any available remediation at this time.

A denial of service vulnerability exists in the Tornado Python library's CurlAsyncHTTPClient component due to a decompression bomb attack vector (CVE-2026-103262). This issue affects Red Hat Enterprise Linux 10 and its extended update support versions across multiple architectures. Red Hat has issued a security advisory and provided updated python-tornado packages to address this vulnerability.

Multiple security vulnerabilities have been identified in the goose component of Red Hat Enterprise Linux 10. These include arbitrary command execution via malicious Git configuration, token impersonation due to missing OAuth resource field validation, denial of service through unauthenticated session table leak, and denial of service via crafted Certificate Revocation List. A security update is available that addresses these issues by updating goose to version 1.45.0-1.el10_2. The update is applicable to Red Hat Enterprise Linux 10 on multiple architectures including x86_64, s390x, ppc64le, and aarch64.

An improper authorization vulnerability exists in Apache SkyWalking BanyanDB versions from 0.11.0 before 0.11.1. Under a non-default configuration involving a readonly Canopy user and a reachable monitoring target, the readonly user can send non-read requests through the monitoring proxy, bypassing intended access controls. This vulnerability is fixed in version 0.11.1.

LMCache multiprocess mode (distributed mode) exposes an unauthenticated ZeroMQ ROUTER socket that accepts msgpack messages. A vulnerability in the deserialization process allows remote attackers to execute arbitrary code via a specially crafted message. This occurs because the server calls pickle.loads on untrusted data before request handling. The default transport binds to localhost, but if configured with a routable address, it can be exploited remotely. Official container images run the LMCache process as root, increasing the impact of exploitation.

CVE-2024-0858 is a high severity vulnerability in the Innovs HR WordPress plugin prior to version 1.0.3.7.1. The plugin lacks proper Cross-Site Request Forgery (CSRF) protections in certain areas, which could allow attackers to trick logged-in users into performing unintended actions, such as adding themselves as employees.