The KRVTZ-NET IDS alerts for 2026-05-18 report network reconnaissance and scanning activities targeting various systems, including attempts against Fortigate VPN (CVE-2023-27997). The alerts include probes for hidden files, user-agent tests, webcrawler scans, SQL injection time delay probes, and Laravel debug mode scans. These are informational observations without confirmed active exploitation or successful attacks. The overall severity is low due to the lack of confirmed exploitation.
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.
CVE-2026-42897 is a high-severity cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 23. It involves improper neutralization of input during web page generation, allowing unauthorized attackers to perform spoofing attacks over a network. The vulnerability has a CVSS score of 8.1 and is known to be exploited in the wild. An official fix is available from Microsoft.
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
CVE-2026-0257 is an authentication bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. It allows attackers to bypass security restrictions and establish unauthorized VPN connections. Panorama and Cloud NGFW products are not affected. The vulnerability has a high severity with a CVSS score of 7.8. Exploits are known in the wild, and the vulnerability has been used in ransomware campaigns.
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
### Impact
A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted `Authorization` header to any LLM API route (for example `POST /chat/completions`) and reach this query through the proxy's error-handling path.
An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages.
### Patches
Fixed in **`1.83.7`**. The caller-supplied value is now always passed to the database as a separate parameter. Upgrade to `1.83.7` or later.
### Workarounds
If upgrading is not immediately possible, set `disable_error_logs: true` under `general_settings`. This removes the path through which unauthenticated input reaches the vulnerable query.
### References
- Patched release: [`v1.83.7-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable)
**Discovery Credit**: Tencent YunDing Security Lab
CVE-2026-42271 is a command injection vulnerability in BerriAI's LiteLLM proxy server versions 1.74.2 up to but not including 1.83.7. Two endpoints allowed authenticated users, including those with low-privilege API keys, to execute arbitrary commands on the proxy host by submitting crafted server configurations. This flaw arises from insufficient role checks and improper neutralization of command execution parameters. The vulnerability has been patched in version 1.83.7.
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses.
Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to the control panel. This critical vulnerability has a CVSS 4.0 score of 9.3 and is known to be actively exploited in the wild, including use in ransomware campaigns.
Samsung MagicINFO 9 Server contains a path traversal vulnerability (CVE-2024-7399) that allows an attacker with limited privileges to write arbitrary files with system authority. This vulnerability has a high severity score of 8.8 and has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2023-27351 is an improper authentication vulnerability in PaperCut NG/MF that allows remote attackers to bypass authentication via the SecurityRequestFilter class. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided.
CVE-2026-39987 is a critical pre-authorization remote code execution vulnerability in the Marimo Python notebook platform. Shortly after disclosure, multiple threat actors exploited this flaw to deploy malware via typosquatted HuggingFace Spaces, leveraging the NKN blockchain for command and control. The malware, disguised as a Kubernetes tool named kagent, established persistence on infected systems and targeted AWS credentials, API tokens, and databases such as PostgreSQL and Redis. Exploitation events were observed from multiple countries, demonstrating active and widespread abuse of this vulnerability in AI/ML infrastructure environments.
CVE-2026-32201 is a medium severity vulnerability in Microsoft SharePoint Enterprise Server 2016 caused by improper input validation. This flaw allows an unauthorized attacker to perform spoofing attacks over a network. The vulnerability affects multiple versions prior to specific fixed releases. Microsoft has issued official fixes for the affected versions. Exploitation in the wild is confirmed, and the vulnerability is listed in the CISA KEV catalog.
CVE-2026-33825 is a high-severity vulnerability in Microsoft Defender Antimalware Platform caused by insufficient granularity of access control. It allows an authorized local attacker to elevate privileges. The vulnerability affects versions from 4.0.0.0 up to but not including 4.18.26030.3011. Exploits are known in the wild, including use in ransomware campaigns. An official fix is available from Microsoft.