Threat database

Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to temporary files during file transfer operations. This vulnerability could lead to unauthorized disclosure of sensitive information if an attacker gains access to these temporary files.

The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 contains multiple sets of hard-coded credentials. These credentials include fleet-wide BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. They are embedded directly in the firmware binary (frodobot.bin) and can be extracted through static analysis without requiring special privileges.

Progress WS_FTP Server versions prior to 2025.0.5 have insufficient protection of communications when unencrypted connections are used. This vulnerability could allow a network attacker to intercept sensitive information or modify requests. The issue affects confidentiality, integrity, and availability of data transmitted over the network.

Progress WS_FTP Server versions prior to 2025.0.5 contain an improper access control vulnerability that allows an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users. This vulnerability has a medium severity rating with a CVSS score of 6.3.

Chaos Software V-Ray versions through 2.0.19 contain an uncontrolled search path element vulnerability in the package upload feature. This flaw allows remote unauthenticated attackers to execute arbitrary code by redirecting access to libraries. The vulnerability is identified as CWE-427 and is rated critical with a CVSS 4.0 score of 9.3.

The LaserGest mobile application disables TLS certificate and hostname verification by using setServerTrustMode("nocheck"), which allows man-in-the-middle attackers to intercept or modify network traffic, including sensitive credentials and API communications. This vulnerability undermines the security of TLS connections, exposing users to significant risks.

Progress Software WS_FTP Server on Windows prior to version 2025.0.5 contains an incorrect quota accounting vulnerability. This flaw allows an authenticated user with upload and delete permissions to exceed storage quotas, which can lead to denial of service conditions. The vulnerability does not impact confidentiality or integrity but affects availability.

The LaserGest mobile application uses a hardcoded AES key and IV to encrypt stored assistance portal credentials. This practice allows an attacker who can access the application package to decrypt and recover these credentials in cleartext. The vulnerability is classified as high severity with a CVSS score of 8.7.

A TOCTOU race condition in the Sandisk Dashboard installer allows a local authenticated standard user to replace a binary in a user-writable temporary directory between validation and execution. This leads to execution of an attacker-controlled binary with elevated administrative privileges. The vulnerability affects Sandisk Dashboard versions through 5.2.2.3.

Eclipse Langium versions 3.0.0 and later have a vulnerability in the langium-sprotty package where diagnostic messages are not HTML-escaped before rendering in hover popups. This allows attacker-controlled JavaScript to execute in the browser or webview when a malicious source file triggers an unresolved cross-reference diagnostic containing HTML markup.

An XSS vulnerability exists in OpenText Filr Appliance versions up to 25.1.2 that allows an authenticated user to upload a malicious file and execute a stored cross-site scripting attack.

The AM CLUB mobile application contains hard-coded MQTT credentials that allow an authenticated attacker to connect to the MQTT broker. This vulnerability enables unauthorized access to data and actions across tenant boundaries within the application environment.

rConfig Core versions 8.2.3 through 8.2.12 contain an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, and enable passwords for managed devices via the device-credentials API. This occurs due to missing authorization checks and automatic decryption on read. The vulnerability is fixed in version 8.2.13. rConfig Pro is not affected.

CVE-2026-123802 is an improper authentication vulnerability in SuperTokens Core affecting versions from 11.3.0 up to but not including 11.3.8, 11.4.0 up to 11.4.8, 12.0.0 up to 12.0.11, 12.1.0 up to 12.1.2, 12.2.0 up to 12.2.1, and 12.3.0 up to 12.3.1. The flaw allows a licensed deployment with a configured SAML client to authenticate an identity from an assertion that does not satisfy the audience check properly, enabling an attacker to impersonate a victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

OffSeq Mirage honeypot sensors observed the URL https://github.com being used in attacker activity associated with CVE-2021-41773 on 2026-11-09. The URL was seen 9 times as part of attacker payloads involving the T1105 technique (Ingress Tool Transfer), indicating it was used for tool download, callback, or exploitation targeting. The attacker infrastructure was identified as located in the US. This URL should be blocked and monitored in proxy, web, and WAF logs to detect related malicious activity.

SuperTokens Core versions from 11.3.0 up to but not including 11.3.8, 11.4.0 up to 11.4.8, 12.0.0 up to 12.0.11, 12.1.0 up to 12.1.2, 12.2.0 up to 12.2.1, and 12.3.0 up to 12.3.1 contain an authentication bypass vulnerability in the SAML.handleCallback function. This flaw allows replay of valid SAML responses and RelayState pairs, bypassing important validation checks such as Response.InResponseTo, Destination, and SubjectConfirmationData. The issue permits attackers to reuse authorization codes and complete logins with different identities. Fixed versions are 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

Attackers are actively searching for SAP NetWeaver webshells by exploiting a known vulnerability (CVE-2025-31324) that allows unauthenticated file uploads. This vulnerability has a critical CVSS score of 10 and has been used to upload webshells typically located in the /irj/servlet_jsp/irj/root/ directory. Multiple URLs related to SAP NetWeaver and other upload endpoints are being targeted in this campaign.

CVE-2026-125041 is a vulnerability in GStreamer's gst-plugins-good MOV/MP4 demuxer used in Red Hat Enterprise Linux 10. The flaw involves improper validation of declared row alignment and chroma geometry in uncompressed video tracks, leading to an out-of-bounds heap read. This can cause the application processing the crafted file to crash, resulting in a denial of service condition. The issue is addressed in gst-plugins-good version 1.28.3 and later.

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.

CVE-2026-123800 is a critical authorization bypass vulnerability in SuperTokens Core affecting multiple versions from 6.0.0 up to but not including various fixed releases. The flaw allows an attacker with a valid API key for one application in a licensed multi-tenant deployment to update the parent connection URI domain and manipulate sibling application keys and user sessions. This can lead to unauthorized access, modification of user data, persistence establishment, and denial of service to sibling applications. The issue is fixed in versions including 12.3.1, 12.2.1, 12.1.2, 12.0.11, 11.4.8, 11.3.8, 11.2.4, 11.1.4, 11.0.9, and 10.1.9.