Threat database

The Iris Plaza online shopping platform suffered a data breach due to compromise of an external cloud service. Personal information of approximately 7.7 million individuals was potentially exposed, including names, addresses, phone numbers, email addresses, dates of birth, gender, and encrypted passwords for platform members. Non-members who made purchases without registration also had some personal data exposed. No credit card information or physical stores were affected. The company has blocked attacker access, notified authorities, and suspended the platform while investigating and remediating the incident.

CVE-2026-112171 is a medium-severity SQL Injection vulnerability in GALENO SISTEMI's MAGISTRA product version 3.12. It allows an attacker with low privileges and local access to inject malicious SQL statements via user-controlled input, potentially leading to unauthorized access, modification, or disclosure of database data.

Multiple security vulnerabilities have been identified and fixed in the dnsmasq packages used in Red Hat Enterprise Linux 8.8. These include heap buffer overflows, infinite loops, out-of-bounds reads, and source validation bypasses affecting DNS and DHCP functionalities. An update is available that addresses these issues along with a new DNSSEC trust anchor key for 2024.

GALENO SISTEMI MAGISTRA version 3.12 has a vulnerability where the software downloads upgrade files without performing integrity checks. This flaw allows the installation of tampered updates, potentially compromising the system.

MAGISTRA software version 3.12 by GALENO SISTEMI contains an undocumented backdoor that enables authentication bypass. This flaw allows attackers to create privileged user accounts without credential verification, posing a significant security risk. The vulnerability is classified under CWE-288 (Authentication Bypass) and CWE-912 (Hidden Functionality).

CVE-2026-112168 affects GALENO SISTEMI's MAGISTRA software version 3.12. The vulnerability involves the use of weak custom encryption, reliance on an outdated compression algorithm for database protection, and the presence of embedded secrets, leading to cleartext storage of sensitive information.

A use-after-free vulnerability exists in Samsung Open Source Escargot before commit 8bc35b7b88f0f96c66a42aa965a1a710308b61d5. This flaw allows pointer manipulation, potentially leading to a denial of service. The vulnerability has a medium severity rating with a CVSS score of 5.1.

A vulnerability in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS) allows an attacker who can control or inject content into a manifest URL to include file:// URIs. This causes the application to read arbitrary local files, potentially disclosing sensitive information. The issue affects certain versions of GStreamer plugins used in Red Hat Enterprise Linux 10.2 and later, Fedora 43, and others. The vulnerability has a high confidentiality impact but does not affect integrity or availability.

This vulnerability involves XML parsers that process attacker-controlled update manifests or network responses with external entity resolution enabled, which can lead to XML External Entity (XXE) attacks. XXE vulnerabilities allow attackers to interfere with the processing of XML data, potentially leading to information disclosure or denial of service. The vulnerability is rated critical with a CVSS score of 9.2. No specific affected software versions or patches are provided in the available data.

This vulnerability involves shared telemetry and logging components that store or transmit sensitive patient and doctor identifiers, clinical information, and low-entropy identifiers without sufficient pseudonymization or protection. The issue could lead to exposure of sensitive healthcare data due to inadequate data handling practices.

This vulnerability involves shared components that expose hard-coded credentials for Access, workgroup, CCBasic, DBISAM, and related databases. These credentials are identical across different installations, potentially allowing unauthorized local attackers to access sensitive database resources. The issue is classified under CWE-798, indicating the use of hard-coded credentials.

This vulnerability involves shared cryptographic services that use fixed vendor-wide secrets, deterministic initialization vectors (IVs), null salts, and reversible transformations to protect sensitive data such as credentials, inter-process communication (IPC) data, configuration values, and clinical fields. These cryptographic weaknesses can undermine the confidentiality and integrity of protected information.

This vulnerability involves a shared client component that accepts doctor identifiers controlled by the caller for both read and write operations without requiring any authentication or authorization. This lack of access control allows unauthorized users to perform potentially sensitive operations impersonating doctors.

This vulnerability involves update components that download and execute code without properly verifying its authenticity. The verification process relies on ignored hashes or forgeable checksums, which undermines the integrity checks. Additionally, some update mechanisms allow archive traversal or script execution, increasing the risk of unauthorized code execution.

This vulnerability involves embedded private keys that are protected by a shared password. An attacker who obtains these keys can use them to sign practitioner assertions for arbitrary practitioner identifiers. This enables unauthorized requests for practitioner tokens, potentially allowing impersonation or unauthorized access.

CVE-2026-118459 is a vulnerability where a time-derived emergency password can be extracted from publicly available application code, allowing authentication without valid credentials. This flaw enables unauthorized access by deriving the emergency password based on timing information embedded in the code.

Venere is installed outside the Program Files directory and loads or registers unsigned components from locations where unprivileged users can create files. This configuration introduces a security risk by allowing potential unauthorized code execution or privilege escalation through manipulation of these unsigned components.

CVE-2026-118458 is a critical vulnerability involving the shared AIS login routing mechanism, which improperly selects a production-shipped test Data Access Object (DAO) and uses plaintext comparison for application codes. This flaw allows acceptance of fixed administrator accounts, potentially enabling unauthorized access.

CGM XDent and XMedical contain PHP synchronization endpoints that are vulnerable to unauthenticated manipulation of session variables and arbitrary SQL query execution against backend MySQL databases. This vulnerability allows attackers to perform unauthorized actions without any authentication.

A security vulnerability (CVE-2026-124590) exists in the zhangbw409 library_manager_system affecting the BookController.addBook function in UserController.java. Improper authorization occurs due to manipulation of userName, userPwd, userEmail, or userId arguments. The vulnerability can be exploited remotely and public exploit code is available. The project uses a rolling release model, so no specific affected versions or patches are identified. The vendor has not yet responded to the issue report.