An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
The KRVTZ-NET IDS alerts from February 9, 2026, report reconnaissance and scanning activities targeting network infrastructure, especially Fortigate VPN devices and submission services. The activity includes brute force attempts from IP 152.32.151.39 and exploitation attempts of CVE-2023-27997 from IP 2001:470:1:332::148. Some attackers use Google Webcrawler user-agent spoofing to evade detection. No active exploitation or ransomware campaigns are currently reported, but these reconnaissance actions could lead to more serious attacks. European organizations using Fortigate VPNs are particularly at risk. The threat is assessed as low severity but could impact confidentiality and integrity if unmitigated. Recommended mitigations include proactive patching, enhanced monitoring, multi-factor authentication, and network segmentation.
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability (CVE-2026-1731). An unauthenticated remote attacker can send specially crafted requests to execute operating system commands with site user privileges. This vulnerability has a very high CVSS score of 9.9 and is known to be exploited in the wild, including use in ransomware campaigns.
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
CVE-2019-19006 is an improper authentication vulnerability in Sangoma FreePBX that allows unauthorized users to bypass password authentication and access administrative services. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.
GitLab Community and Enterprise Editions have a server-side request forgery (SSRF) vulnerability in the CI Lint API that allows unauthorized external users to perform SSRF attacks. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.
CVE-2026-1340 is a critical vulnerability in Ivanti Endpoint Manager Mobile involving improper control of code generation, classified as CWE-94 (Code Injection). This flaw allows unauthenticated attackers to execute arbitrary code remotely. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently available. There are no known exploits in the wild at this time. The affected versions are unspecified, and the product is not a cloud service.
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
CVE-2026-21509 is a high-severity vulnerability in Microsoft 365 Apps for Enterprise where reliance on untrusted inputs in a security decision allows a local unauthorized attacker to bypass a security feature. The vulnerability has a CVSS score of 7.8 and is known to be exploited in the wild. An official fix is available from Microsoft.
CVE-2018-14634 is an integer overflow vulnerability in the Linux Kernel's create_elf_tables() function. This flaw allows an unprivileged local user with access to a SUID or otherwise privileged binary to escalate their privileges on the affected system. The vulnerability has been exploited in the wild. Red Hat issued an important security advisory providing patches for Red Hat Enterprise Linux 7.4 Extended Update Support to address this and related kernel vulnerabilities. Systems must be rebooted after applying the update for the fix to take effect.
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.
### Summary
The contents of arbitrary files can be returned to the browser.
### Impact
Only apps explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.
### Details
- base64 encoded content of non-allowed files is exposed using `?inline&import` (originally reported as `?import&?inline=1.wasm?init`)
- content of non-allowed files is exposed using `?raw?import`
`/@fs/` isn't needed to reproduce the issue for files inside the project root.
### PoC
Original report (check details above for simplified cases):
The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice
```
$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev
```
Example full URL `http://localhost:5173/@fs/C:/windows/win.ini?import&?inline=1.wasm?init`
Red Hat OpenShift AI 3.2 has been released with updates addressing security issues identified by CVE-2025-62593 and CVE-2025-66418. The advisory notes the availability of updated images and provides guidance for upgrading clusters to apply the errata update. No specific fixes or technical details about the vulnerabilities are disclosed in the advisory. The vulnerabilities are associated with CWE-94 (Improper Control of Generation of Code), CWE-770 (Allocation of Resources Without Limits or Throttling), and CWE-352 (Cross-Site Request Forgery).
