CVE-2026-127029 is a vulnerability in the FreeRADIUS EAP-SIM module on Red Hat Enterprise Linux 10. It involves a stack buffer overflow caused by improper length checking of a client-supplied identity during authentication. An unauthenticated remote attacker can exploit this by sending crafted EAP-SIM messages, causing the RADIUS server to crash and resulting in a denial of service. This flaw only affects deployments with the EAP-SIM submodule enabled. Mitigation includes disabling the EAP-SIM submodule if not needed and restricting RADIUS UDP traffic to trusted sources.
SOGo versions before 5.12.13 contain a server-side request forgery (SSRF) vulnerability that allows authenticated users to make the server connect to arbitrary internal host and port destinations. This is achieved by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can also trigger reloads of subscribed web calendars and observe different response outcomes to probe the internal network from the server's perspective.
SOGo versions before 5.12.13 have a denial of service vulnerability where authenticated attackers can exhaust all worker processes by configuring an IMAP account pointing to a host that accepts connections but never responds. This causes workers to be held indefinitely without timeout, denying service to all users for about five minutes until the workers are restarted.
CVE-2026-127135 is a vulnerability in SOGo versions before 5.12.13 that allows authenticated users to inject arbitrary Sieve directives via unescaped notification address values. This injection can enable attackers to embed redirect or discard statements in the Sieve script, bypassing forwarding-domain constraints and manipulating incoming mail handling.
An active campaign targets Internet-facing Microsoft SQL Server instances by abusing T-SQL commands to deliver malware. Attackers scan for exposed servers on TCP port 1433 and use brute-force attacks with predefined credentials to gain access. Once authenticated, malicious T-SQL commands download and execute malware including a UPX-packed Go binary with the Naabu scanner, an XMRig cryptocurrency miner, and the Gh0st RAT remote access trojan. The malware enables CPU resource hijacking for Monero mining and provides extensive remote control capabilities such as keylogging and screen capture.
A sophisticated phishing campaign targeting the construction industry uses a fake Microsoft Teams meeting scheduler to trick victims into authorizing device codes. The attackers employed a typosquatted domain and impersonated a senior executive to deliver spear-phishing emails with multi-stage redirects. The phishing site covertly initiates a Microsoft device-code sign-in and copies the code to the clipboard before redirecting victims to the legitimate Microsoft device-login page. The campaign includes fallback mechanisms for multi-factor authentication and uses residential proxies to evade detection.
SCKit is a malicious toolkit discovered in November 2026 that abuses ScreenConnect's remote management functionality. It uses a Guest-to-Host file execution technique exploiting CVE-2026-84869 to compromise technicians. The toolkit's RelayTrap component replaces legitimate ScreenConnect Guest processes to send malicious payloads to technicians and attempts to steal .ASPXAUTH cookies to reuse management permissions for lateral command distribution. Testing shows that patched ScreenConnect Host clients block this reverse execution attack. The campaign mainly targets managed service provider (MSP) environments where technician sessions are compromised.
CVE-2026-70642 is an authorization bypass vulnerability in ToolJet versions before 3.21.94. It affects the app environments init endpoint, allowing authenticated users to access app version metadata from other workspaces by manipulating the editing_version_id parameter. This vulnerability permits unauthorized reading of version name, description, status, current environment ID, and app ID across workspace boundaries.
SOGo versions before 5.12.13 have a vulnerability in the web login TOTP verification process that lacks rate limiting. This flaw allows attackers who know a victim's password to brute-force the second-factor authentication code without triggering lockout mechanisms, bypassing two-factor authentication.
SOGo versions before 5.12.13 have a vulnerability in cryptographic signature verification that allows remote attackers to replace a victim's contact S/MIME certificate. By sending a spoofed multipart/signed message with a mismatched signature and impersonated From address, attackers can inject a self-signed certificate into the victim's contact card. This flaw enables attackers to decrypt subsequent encrypted communications intended for the victim.
SOGo versions prior to 5.12.13 have a vulnerability that allows unauthenticated attackers to bypass authentication protections by repeatedly guessing answers to secret questions without any lockout or rate limiting. This flaw enables attackers to obtain a valid recovery token and reset account passwords, leading to full account takeover on accounts without two-factor authentication (TOTP).
CVE-2026-126329 is a vulnerability in Docker Sandboxes where existing state and configuration directories are reused without verifying ownership. This flaw allows a local unprivileged user to potentially execute commands as root if the sandbox processes run as root with environment variables pointing to attacker-controlled locations. The issue affects Linux and macOS and is fixed in Docker Sandboxes version 0.53.0.
The SANSAR Linux cryptomining intrusion is a sophisticated malware operation that uses a Rust-based orchestrator to manage CPU and GPU miners via Tor. Attackers exploited an exposed Ray job agent to gain root access on Linux GPU hosts, deploying a kernel rootkit to hide processes and files. It includes an NVIDIA Management Library wrapper that falsifies GPU telemetry to show 0% utilization, concealing cryptomining activity. The malware also uses a backdoor named netns to retrieve command and control addresses from Ethereum smart contracts. SANSAR controls XMRig and SRBMiner-MULTI miners and maintains command handlers for configuration and interactive shells. Multiple stealth techniques such as ftrace-based rootkit hooks, modified GPU monitoring libraries, and Tor-based communications with bridge support enhance anonymity and evasion.
CVE-2026-126330 is a vulnerability in Docker Sandboxes where the daemon can silently republish a sandbox service after its host-port mapping is removed. Although the active binding is removed, the original publication request remains, allowing the service to be published again on a new host port after a port change or sandbox restart. This affects both TCP and UDP mappings and is limited to the original bind address, which defaults to loopback. The issue is fixed in Docker Sandboxes version 0.53.0.
CVE-2026-119618 is a critical remote code execution vulnerability in the Apache HTTP Server's mod_http2 module, affecting versions 2.4.55 through 2.4.70. It arises from a race condition that allows unauthenticated attackers to execute arbitrary code on servers with HTTP/2 enabled. The flaw was patched in version 2.4.71. Disabling HTTP/2 can serve as a temporary mitigation if patching is not immediately possible.
A vulnerability in PostgreSQL's CREATE EXTENSION and ALTER EXTENSION commands allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. This occurs due to an uncontrolled search path element that leads a trusted-extension script to execute arbitrary SQL chosen by the attacker. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
A type confusion vulnerability in PostgreSQL allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This occurs due to inadequate tracking of typed values, leading to stale values appearing in various system components. The flaw can be exploited primarily via ALTER ... SET DATA TYPE commands and other DDL operations. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The vulnerability has a high severity score of 8.8 CVSS v3.1.
A server-side request forgery (SSRF) vulnerability exists in JeecgBoot up to version 3.9.5, specifically in the OpenApiController.call function of the Authentication Filter component. This flaw allows remote attackers to manipulate requests, potentially leading to information disclosure and system impact. Public exploit code is available, but the vendor has not responded or provided a fix.
CVE-2026-16237 is a vulnerability in PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. It involves improper protection in the INSERT ... ON CONFLICT command on auto-updatable views. An attacker with INSERT and UPDATE privileges on the view can read and modify every row in the base table, bypassing the view's WHERE condition, including security_barrier views.
A format string vulnerability exists in PostgreSQL's pg_basebackup utility that allows an attacker with prior server compromise to potentially disclose memory contents from the backup manifest. The vulnerability does not leak data directly to the attacker, requiring additional secrets to exploit. Integrity impact is unlikely as the formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.