Threat database

CVE-2026-92824 is an out-of-bounds read vulnerability in libmodulemd used by Red Hat Enterprise Linux 10. The flaw occurs in the module stream v2 rpm-map emission path, where an inner loop incorrectly uses the count of digest algorithms instead of the number of checksums, leading to a potential crash and denial of service during YAML serialization of crafted metadata.

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.

This entry is a daily update from the SANS Internet Storm Center (ISC) Stormcast podcast dated October 21, 2026. It provides general information about the ISC handlers and links to educational content but does not describe any specific security threat or vulnerability.

Threat actors are conducting phishing campaigns targeting Google Cloud Platform (GCP) environments by using sponsored search ads to steal privileged user credentials. They disable security controls, create service accounts with Gemini API access, and link attacker-controlled external projects to victim billing accounts. This enables unauthorized large-scale AI workload execution, causing significant unexpected charges within 24-48 hours. The attackers use evasion techniques such as geographic IP blending and demoting legitimate administrators to avoid detection and remediation.

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.

CVE-2026-113744 is a critical stack-based buffer overflow vulnerability in the Tenda AC19 router firmware version 16.03.10.07. The flaw exists in the formSetFirewallCfg function of the httpd Web Management Service component, triggered by manipulation of the firewallEn argument. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed, increasing the risk of exploitation.

CVE-2026-113743 is a path traversal vulnerability in Tenstorrent tt-metal versions up to 0.80.0. The flaw exists in the function load_hf_state_dict_filtered within the file models/tt_transformers/tt/load_checkpoints.py. This vulnerability allows remote attackers to manipulate the weight_map argument to perform path traversal. A public exploit is available. Upgrading to version 0.81.0-dev20261016 addresses the issue.

CVE-2026-105044 is an OS command injection vulnerability in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0. It affects Security Toolbox versions before 20260929 and allows an authenticated console administrator to execute arbitrary commands on attached clients. The vulnerability arises from improper neutralization of special elements used in OS commands.

A threat actor breached TeamUpdraft's infrastructure, compromising UpdraftCentral connection keys used to manage WordPress sites remotely. These stolen keys have been used to backdoor connected WordPress sites by installing malicious plugins that grant attackers administrator privileges. The breach affects an estimated 10% of UpdraftPlus users with UpdraftCentral or Migrator keys, potentially impacting around 400,000 websites. The vendor responded by revoking affected keys and releasing patched versions of UpdraftPlus. Users are advised to update to the latest versions and remove existing UpdraftCentral keys from their sites to mitigate risk.

A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the file /404.php. Such manipulation of the argument useruid leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

The certificate authority eMudhra revoked eight compromised intermediate certificates after researchers discovered their private keys were extremely weak, allowing near-instant recovery and potential forgery of trusted certificates. Major browsers including Mozilla, Google, and Apple have blocked these compromised certificates to prevent misuse.

A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility

Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility

Best Practice Software Bp Premier versions before 1.14.1.1128 contain a hardcoded Microsoft SQL Server administrative password shared across all installations. This password cannot be changed without breaking the application. An attacker with network access to the database can authenticate as sysadmin, bypassing application authentication and potentially executing operating system commands as SYSTEM.

Vyper versions 0.3.4 through 0.5.0b1 contain a vulnerability in the create_from_blueprint function where an unchecked uint256 subtraction can cause an integer wraparound. This allows an attacker controlling the code_offset parameter to deploy contracts with no runtime code, potentially trapping ETH and tokens.

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.

Vyper versions from 0.1.0b1 up to but not including 0.1.0b17, and versions 0.4.1 through 0.5.0b1, have a vulnerability where the source-line table is built using str.splitlines(), which treats certain characters as line breaks differently than the Python parser. This discrepancy allows an attacker to hide special characters in comments, strings, or indentation to alter numeric literals silently.