Threat database

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.

CVE-2026-34926 is a directory traversal vulnerability in the on-premise version of Trend Micro's TrendAI Apex One server. It allows a pre-authenticated local attacker with administrative credentials on the server to modify a key table, potentially injecting malicious code that could be deployed to agents. Exploitation requires prior administrative access to the Apex One server and is limited to the on-premise deployment. The vulnerability has a CVSS score of 6.7, indicating medium severity. No official patch or remediation information is currently available, and no known exploits are reported in the wild.

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

Langflow suffers from an origin validation error vulnerability due to an overly permissive CORS configuration combined with a refresh token cookie set as SameSite=None. This flaw allows malicious webpages to perform cross-origin requests with credentials, enabling calls to the refresh endpoint. Exploitation can lead to arbitrary code execution and full system compromise by leveraging obtained tokens that grant access to authenticated endpoints.

The KRVTZ-NET IDS alerts from 2026-05-21 report network activity consistent with reconnaissance targeting Fortigate VPN devices. Specifically, multiple IP addresses were observed making repeated GET requests to the /remote/logincheck endpoint, which is associated with CVE-2023-27997, a known vulnerability in Fortigate VPN. Several other IPs exhibited suspicious or test user-agent strings, indicating scanning or probing behavior. No active exploitation or confirmed compromises are reported. The activity is categorized as low severity due to its reconnaissance nature without evidence of exploitation.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Microsoft Defender Denial of Service Vulnerability

CVE-2008-4250 is a buffer overflow vulnerability in the Windows Server Service of Microsoft Windows. It allows remote attackers to execute arbitrary code by sending a specially crafted RPC request that triggers an overflow during path canonicalization. This vulnerability has been exploited in the wild and is considered high severity.

Microsoft DirectX contains a vulnerability in the QuickTime Movie Parser Filter within quartz.dll in DirectShow that allows a NULL byte overwrite. This flaw can be exploited by remote attackers using a crafted QuickTime media file to execute arbitrary code. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

Adobe Acrobat and Reader have a heap-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by using a specially crafted PDF file. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Microsoft Internet Explorer contains a use-after-free vulnerability (CVE-2010-0249) that allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use.

Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute arbitrary code by accessing an invalid pointer after an object has been deleted. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use. This vulnerability has been exploited in the wild.

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.