IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion.
The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure these credentials when the remote logging feature is enabled.
An attacker with administrative access to the Management Console or direct access to product files can retrieve these sensitive credentials. This allows for potential manipulation of log entries and compromise of the integrity and confidentiality of the remote log server.
A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the key blob into each task, and does not roll back tasks when later constraint parsing fails. An attacker that can speak the agent protocol locally or through agent forwarding can exhaust memory and tasks until the agent process is starved or terminated, denying SSH agent service. This issue is fixed in version 0.64.1.
A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
This content discusses cybersecurity challenges faced by small and medium-sized businesses (SMBs), focusing on vulnerabilities in people, processes, and technology that can lead to cyberattacks. It highlights how attackers exploit gaps such as unpatched software, insufficient employee training, and inadequate protection of cloud infrastructure. A real-world case study describes an ERP system breach during cloud migration, where attackers used phishing and exploited unpatched vulnerabilities to gain administrator access and steal confidential data. The article emphasizes the importance of targeted employee training, structured patch management, and appropriate technological defenses to mitigate risks.
CVE-2025-7043 is a vulnerability in WSO2 API Manager where the ForgeRock client fails to properly validate refresh tokens. This flaw allows a refresh token to be used directly as an access token, bypassing the required client credential verification step. An attacker with a stolen or exposed refresh token can exploit this to access protected resources without proper authorization. The vulnerability affects multiple versions of WSO2 API Manager prior to specific patch releases. The CVSS score is 5.4, indicating a medium severity level.
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.
Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.
Federal authorities arrested Edward Dubrovsky, a Canadian cybersecurity executive involved in ransomware negotiation, on charges related to assisting the ShinyHunters hacking group. ShinyHunters is known for stealing sensitive data, including from FBI servers, and extorting victims. Dubrovsky allegedly had knowledge of these breaches and did not inform the FBI prior to public threats by ShinyHunters. The case is part of a broader FBI investigation centralized in Texas, with other arrests and ongoing inquiries into ransomware negotiation firms. Dubrovsky's role as a negotiator raises concerns about conflicts of interest in ransomware response services.
A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 5.0.0 is sufficient to fix this issue. The identifier of the patch is fcf2904cdb884230e9676f50f37a44d09fa97040. The affected component should be upgraded. The vendor confirms: "This issue was identified quite some time ago, and we have already fixed it in the v5 branch. (...) The fix will also be included in an upcoming v4 release.
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active HTML can therefore reach the DOM and execute when another user views the application. This issue is fixed in version 3.2.11.
The TeamUpdraft.com website was compromised on October 17-18, 2026, resulting in unauthorized access to customer data including names, emails, billing addresses, order history, hashed passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. The UpdraftPlus plugin and backups stored on third-party remote storage were not affected. Attackers appear to be using compromised backup datasets to create new administrator accounts on WordPress sites using Updraft. The vendor has contained the breach, reset credentials, and is releasing emergency updates to disconnect old keys and connections. Users are advised to change passwords, check for unauthorized admin accounts, remove suspicious plugins, and follow specific remediation steps for UpdraftCentral, UpdraftVault, and UpdraftClone users.
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.
Mercury, a Python framework for sharing Jupyter notebooks as web applications, has a critical vulnerability in versions from 3.0.0 up to but not including 3.2.4. A missing comma in the BLOCKED_PATTERNS regular expression causes concatenation of patterns, allowing requests to /api/terminals to bypass endpoint restrictions. This enables unauthenticated attackers to access Jupyter Server's terminal API, potentially executing commands and accessing data with the Mercury process's privileges. The issue is fixed in version 3.2.4.
A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.