CVE-2026-114259 is a vulnerability in the oretnom23 file-management-system-php affecting the save_files function in admin_class.php. It allows remote attackers to perform unrestricted file uploads by manipulating the Upload argument. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). The project uses rolling releases, so specific affected and fixed versions are not available. The issue was reported early but has not yet been addressed by the vendor. Exploit code has been published, increasing the risk of exploitation.
CVE-2026-76497 is a medium severity vulnerability in Cisco TelePresence Video Communication Server (VCS) Expressway involving insecure temporary file handling. The issue relates to improper management of temporary files, categorized under CWE-377. Cisco addressed this vulnerability as part of a broader internal security review and software hardening effort. No specific affected versions or patch information is provided in the available data.
CVE-2026-76495 is a high-severity vulnerability in Cisco TelePresence Video Communication Server (VCS) Expressway involving incorrect permission assignments to critical resources. This issue falls under CWE-732, indicating improper permission management. The vulnerability was identified during an internal security review by Cisco, leading to software hardening releases. The CVSS 3.1 score is 7.8, reflecting high impact on confidentiality, integrity, and availability. No specific affected versions or patch information are provided in the available data.
CVE-2026-76489 is a medium severity vulnerability in Cisco Open Source Snort3 affecting multiple versions. It involves improper memory management due to incomplete error checking when processing files, which can lead to unreleased memory. An unauthenticated remote attacker could exploit this by sending many files to the Snort 3 Detection Engine, causing it to restart unexpectedly and resulting in a denial-of-service (DoS) condition that interrupts packet inspection.
CVE-2026-76487 is a vulnerability in Cisco Unified Communications Manager and its Session Management Edition that allows unauthenticated remote attackers to bypass access controls by sending specially crafted HTTP requests. This is caused by improper input validation of certain HTTP requests, potentially enabling attackers to access network areas beyond their authorized scope. The vulnerability affects multiple specific versions of the product. The CVSS score is 5.3, indicating a medium severity level.
CVE-2026-114258 is a SQL injection vulnerability in the oretnom23 file-management-system-php affecting the files.php component. The flaw arises from manipulation of the fid/id argument, allowing remote attackers to perform SQL injection. The vulnerability has a medium severity score of 6.9 and public exploit code is available. The project uses a rolling release model, so no specific affected or fixed versions are provided. The vendor has been informed but has not yet responded or issued a fix.
CVE-2026-20291 is a high-severity vulnerability in Cisco Cyber Vision involving improper privilege management. It affects multiple specific versions of the product. The flaw allows an attacker with limited privileges to potentially gain elevated access, impacting confidentiality, integrity, and availability. No known exploits are reported in the wild. Cisco has conducted internal security reviews and released software hardening updates addressing these issues.
CVE-2026-114257 is a SQL injection vulnerability in the oretnom23 file-management-system-php affecting the readfile function in download.php. The vulnerability allows remote attackers to manipulate the ID argument to execute SQL injection attacks. The product uses a rolling release system, and no specific affected or fixed versions are disclosed. The vulnerability has been publicly disclosed, but the vendor has not yet responded or issued a fix.
CVE-2026-114256 is a SQL injection vulnerability in the oretnom23 file-management-system-php affecting the Folder Management component. The flaw exists in multiple functions of admin_class.php, allowing remote attackers to manipulate parameters such as name, parent_id, id, type, folder_id, and description to execute SQL injection attacks. Exploit code is publicly available. The product uses a rolling release model, so specific affected or fixed versions are not provided. The vendor has not yet responded to the issue report.
A security vulnerability (CVE-2026-114248) exists in the dhikshitha29 Insurance-Management-System affecting the Plan Management Form component. The vulnerability involves manipulation of the submit, Plan_no, and Name arguments in the /Admin/includes/AddNewPlan-inc.php file, leading to missing authentication. This flaw can be exploited remotely. The vulnerability has a medium severity with a CVSS score of 5.3. The project uses a rolling release model, so no specific affected or fixed versions are available. The issue was reported early but has not yet received a response or patch from the vendor. Public exploit details have been disclosed but no known exploitation in the wild has been confirmed.
Multiple vulnerabilities in PHP versions 5.5, 7.0, 7.2, and 7.4 were discovered affecting Ubuntu LTS releases. These vulnerabilities involve incorrect handling of out-of-memory conditions and improper management of internal request state across worker reuse, which could allow a remote attacker to execute arbitrary code. Ubuntu has released patches for these issues across supported LTS versions, including updates for older releases via Ubuntu Pro and Legacy Support add-ons.
CVE-2026-114255 is a SQL injection vulnerability in the oretnom23 file-management-system-php affecting the save_user function in admin_class.php. It allows remote attackers to manipulate user-related parameters (name, username, password, type, id) to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). The project uses a rolling release model, so specific affected or fixed versions are not available. The issue was reported early but has not yet been addressed or patched by the vendor. Public exploit code is available, increasing the risk of exploitation.
The threat actor k0t is conducting a large-scale campaign targeting network edge devices from FortiGate, FortiWeb, and Palo Alto GlobalProtect. The campaign exploits known vulnerabilities CVE-2025-64446 and CVE-2026-0257, combined with brute-force attacks, to harvest over 70,000 credentials globally. Post-compromise activities include credential theft, Active Directory enumeration, and data exfiltration using Rclone to cloud storage. Persistence is maintained through tools such as MeshCentral, AdaptixC2, and remote management software like Atera and AnyDesk. The campaign overlaps with ransomware groups Qilin and The Gentlemen, suggesting k0t may act as an Initial Access Broker, though no direct affiliation is confirmed.
CVE-2026-114254 is a SQL injection vulnerability in the oretnom23 file-management-system-php affecting the Login function in admin_class.php. The flaw allows remote attackers to manipulate username and password parameters to execute SQL injection attacks. Exploit code is publicly available, but no official vendor response or patch has been provided yet. The product uses a rolling release model, so specific affected or fixed versions are not detailed.
Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any that no account holds. The routes that create, update and delete a custom role require the manage_roles permission, which only the serveradmin role holds; but a full-scope API key issued for named domains, and serveradmin assigned with a domain list, are serveradmin confined to those domains and hold manage_roles. The server's authorization gate did not refuse the three role routes to a confined credential and the route named no domain, so a credential issued to one tenant could raise or lower the permissions of a custom role assigned across other tenants - granting another domain's role every permission over its mailboxes and settings, or removing what it needs. A custom role may not hold administer_server, administer_domain or manage_roles, so the confined credential cannot make itself or another a server administrator by creating or rewriting a custom role.
CVE-2026-114253 is a file inclusion vulnerability in the oretnom23 file-management-system-php. It affects the include function in index.php via manipulation of the 'page' argument, allowing remote attackers to include files. The vulnerability has been publicly disclosed with exploit code available. The product uses a rolling release model, and no specific affected or fixed versions are provided. The vendor has been informed but has not yet responded or issued a fix.
The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's access context has been modified or revoked through administrative actions.
The identified issue could lead to unauthorized access by a malicious actor, but only when all of the following conditions are met: previously issued access tokens remain active, and these tokens have been exposed to malicious actors.
CVE-2026-114249 is an improper authorization vulnerability in the dhikshitha29 Insurance-Management-System affecting the Policy Holder Update Form component. The flaw involves manipulation of the Policy_no argument in the /Agent/includes/UpdatePolicyHolder-inc.php file, allowing remote attackers to bypass authorization controls. The vulnerability has a medium severity score of 6.9 and public exploit code is available. The vendor uses rolling releases and has not yet responded or provided a fix.