Threat database

IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 contain an authorization vulnerability that could allow a remote authenticated attacker to perform unauthorized account takeover. This flaw arises from improper authorization checks within the affected versions.

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 contains a vulnerability that allows low-privileged users to execute administrative functions by directly invoking backend APIs. This bypasses UI-level access controls because the backend does not enforce role-based access control properly.

IBM Sterling B2B Integrator versions 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1, as well as IBM Sterling File Gateway versions 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1 Standard Edition, contain an improper authorization vulnerability. This flaw could allow a remote authenticated attacker to access unauthorized pages within the affected products.

The bundyfed package on PyPI versions 1.0.0 and 1.0.1 contains malicious code that downloads and executes an infostealer during installation. This is achieved by overriding the install command in setup.py to run the malicious payload.

In October 2026, the Cambodia-based threat actor Storm-3358 began using the agentic AI offensive framework ARTEX to target financial organizations mainly in Southeast Asia and some global institutions. The group combines ARTEX with automated tools to scan systems, exploit vulnerabilities such as anonymous file upload and server-side request forgery, and deploy open-source remote access trojans including WISP, vshell, and AdaptixC2. ARTEX agents automate credential compromise, web shell deployment, lateral movement, privilege escalation, and data exfiltration at machine speed. This reflects a trend of threat actors accelerating attack chains using AI-powered penetration testing frameworks.

CVE-2026-123962 is a high-severity vulnerability in FreedomBox versions 21.5build1 through 24.8 that allows reading and writing of the authorized keys file using user account privileges. This flaw affects multiple versions of FreedomBox and has a CVSS score of 8.4, indicating a significant impact on confidentiality, integrity, and availability. The vulnerability can be exploited locally without user interaction and requires low attack complexity. No public exploits or known active exploitation have been reported as of the publication date.

OpenSSH versions before 10.6p2 on Linux systems using musl libc without PAM are vulnerable to a password authentication bypass. This occurs due to a misinterpretation of whether a string is intended to be a password hash, allowing any password between 256 and 1024 characters to succeed for certain account configurations. Alpine Linux is an example of a platform affected by this issue.

A vulnerability in Moodle, an open-source platform for internet-based courses, allows information disclosure. The issue affects versions prior to 5.2.4 and is fixed in version 5.2.4. Moodle supports a constructivist teaching and learning approach globally. No CVSS score or detailed impact description is provided.

Multiple security vulnerabilities have been identified in Keycloak, an open-source identity and access management solution enabling single sign-on for modern applications and services. The vulnerabilities include an account takeover via an authentication race condition in the reset-credentials path, unauthenticated denial of service through SAML parsing loops, bypasses in type validation allowing arbitrary class instantiation, cross-owner resource access due to insufficient validation, cryptographic signature bypasses, SQL injection enabling data exfiltration and authorization bypass, and various denial of service vectors. These issues are addressed in Keycloak version 26.8.2.

A denial-of-service vulnerability affects LibreOffice versions prior to 26.2.6. This issue allows an attacker to cause a denial of service in the affected software. The vulnerability has been fixed in version 26.2.6.

A vulnerability in MariaDB allows bypassing security measures. MariaDB is a relational database system compatible with MySQL. The issue affects versions prior to 11.8.9 and is fixed in version 11.8.9.

A vulnerability in IBM App Connect Enterprise allows information disclosure. The product integrates IBM Integration Bus technologies with cloud-native technologies. No specific affected versions or detailed impact metrics are provided.

Multiple vulnerabilities have been identified in JetBrains IntelliJ IDEA, a Java development environment. These issues affect versions prior to and including 2026.3. A fix is available in version 2026.3.

Multiple vulnerabilities have been identified in JetBrains YouTrack, a web-based platform for project management, issue and bug tracking, helpdesk, and workflow management. No specific details about the nature, impact, or affected versions of these vulnerabilities are provided.

Multiple vulnerabilities have been identified in Wazuh, an open-source security monitoring platform that provides intrusion detection, log analysis, and SIEM capabilities. These vulnerabilities affect versions prior to 4.14.9. A fix is available in version 4.14.9.

Rmcp versions prior to 3.9.0 contain a vulnerability in their built-in Streamable HTTP clients where response bodies are buffered in memory without size limits. This affects the reqwest and Unix socket clients, causing them to fully buffer certain HTTP responses, including application/json POST responses and non-2xx error responses. A malicious or compromised MCP server can exploit this by sending an unending response body, leading to memory exhaustion and process termination. The issue is fixed in version 3.9.0 by imposing strict size limits on response bodies and rejecting oversized content.

CVE-2026-118515 is a high severity vulnerability affecting multiple specific versions of the Symfony framework. The vulnerability has a CVSS 4.0 base score of 8.4, indicating significant impact potential. However, no detailed description or technical details about the nature of the vulnerability are available. There is no information about public exploits or active exploitation in the wild. The affected versions are explicitly listed, but no patch or remediation information is provided.

CVE-2026-118514 is a medium severity vulnerability affecting multiple specific versions of the Symfony framework. The exact nature and technical details of the vulnerability are not provided in the available data. The CVSS 4.0 base score is 6.3, indicating a network-exploitable issue with low complexity and partial impact on confidentiality and integrity. There is no information about public exploits or vendor patches.

Multiple security vulnerabilities have been identified in the Tesseract OCR engine as packaged in Red Hat Enterprise Linux 9. These include heap out-of-bounds writes and reads, stack buffer overflow, and heap corruption, which can lead to information disclosure, arbitrary code execution, or denial of service. Red Hat has released an important security update addressing these issues.

A vulnerability in the heifer-hevc-dec crate causes a panic when decoding HEVC Range Extensions streams that enable chroma QP offsets but provide an empty offset list. This panic results from an out-of-range access when reading the empty list, aborting the decoding thread or the entire process if built with panic abort. The issue does not cause memory corruption due to the crate's safe Rust codebase. The flaw affects all versions before 0.3.27 and was fixed in version 0.3.27 by treating empty offset lists as zero offsets.