The KRVTZ-NET IDS alerts from February 9, 2026, report reconnaissance and scanning activities targeting network infrastructure, particularly Fortigate VPN devices and submission services. Indicators include repeated connection attempts from IP 152.32.151.39 suggesting brute force attacks, and IP 2001:470:1:332::148 performing repeated GET requests to the /remote/logincheck endpoint, exploiting CVE-2023-27997. Additional IPs use Google Webcrawler user-agent spoofing to evade detection while scanning. Although no active exploitation or ransomware campaigns are reported, these activities represent early-stage reconnaissance that could lead to more severe attacks. The threat is currently assessed as low severity but poses risks to confidentiality and integrity if left unmitigated. European organizations using Fortigate VPNs are particularly at risk. Proactive patching, enhanced monitoring, MFA, and network segmentation are recommended to mitigate potential impacts.
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
GitLab Community and Enterprise Editions have a server-side request forgery (SSRF) vulnerability in the CI Lint API that allows unauthorized external users to perform SSRF attacks. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.
CVE-2019-19006 is an improper authentication vulnerability in Sangoma FreePBX that allows unauthorized users to bypass password authentication and access administrative services. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.
CVE-2026-1340 is a critical vulnerability in Ivanti Endpoint Manager Mobile involving improper control of code generation, classified as CWE-94 (Code Injection). This flaw allows unauthenticated attackers to execute arbitrary code remotely. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently available. There are no known exploits in the wild at this time. The affected versions are unspecified, and the product is not a cloud service.
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
CVE-2018-14634 is an integer overflow vulnerability in the Linux Kernel's create_elf_tables() function. This flaw allows an unprivileged local user with access to a SUID or otherwise privileged binary to escalate their privileges on the affected system. The vulnerability has been exploited in the wild. Red Hat issued an important security advisory providing patches for Red Hat Enterprise Linux 7.4 Extended Update Support to address this and related kernel vulnerabilities. Systems must be rebooted after applying the update for the fix to take effect.
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.
### Summary
The contents of arbitrary files can be returned to the browser.
### Impact
Only apps explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.
### Details
- base64 encoded content of non-allowed files is exposed using `?inline&import` (originally reported as `?import&?inline=1.wasm?init`)
- content of non-allowed files is exposed using `?raw?import`
`/@fs/` isn't needed to reproduce the issue for files inside the project root.
### PoC
Original report (check details above for simplified cases):
The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice
```
$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev
```
Example full URL `http://localhost:5173/@fs/C:/windows/win.ini?import&?inline=1.wasm?init`
Red Hat OpenShift AI 3.2 has been released with updates addressing security issues identified by CVE-2025-62593 and CVE-2025-66418. The advisory notes the availability of updated images and provides guidance for upgrading clusters to apply the errata update. No specific fixes or technical details about the vulnerabilities are disclosed in the advisory. The vulnerabilities are associated with CWE-94 (Improper Control of Generation of Code), CWE-770 (Allocation of Resources Without Limits or Throttling), and CWE-352 (Cross-Site Request Forgery).
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.
