NI vulnerabilities and threats

CVE-2026-87095 is a critical vulnerability in Acronis Cyber Infrastructure involving improper authorization checks, leading to sensitive information disclosure and manipulation. It affects versions before build 6.0.1-112, 6.1.1-64, and 6.2.1-71. The vulnerability has a CVSS 3.0 score of 9.1, indicating high impact on confidentiality and integrity without requiring privileges or user interaction.

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/_Session to create additional sessions for that user and add fields to _Session; these sessions are not revoked when the original session is logged out.

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.

A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the file server/src/index.ts. Performing a manipulation of the argument path results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.0.88 is sufficient to resolve this issue. The patch is named 3898085c4e701be21377ebd9e91e10b941e47168. It is recommended to upgrade the affected component.

Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15.

Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0.

An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.

Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py, to read and write host files as the runner user.

CVE-2026-110373 is an Incorrect Privilege Assignment vulnerability in the Hamid Alinia Login with phone number product. It allows privilege escalation, affecting versions from initial releases up to 1.8.77. The vulnerability has a high severity with a CVSS score of 8.1.

Tektronix 3 Series MDO devices before version 1.21.1 contain a path traversal vulnerability in their web management interface. This flaw allows remote attackers to read arbitrary files accessible to the application by exploiting insufficient validation of user-supplied file paths. Exploitation may be possible without authentication depending on the device configuration. The vulnerability has a high severity rating with a CVSS score of 7.5.

Tektronix 3 Series MDO devices before version 1.21.1 contain a path traversal vulnerability in the SCPI FILESystem command interface. This flaw allows remote attackers with limited privileges to read or modify arbitrary files on the device due to insufficient validation of file paths. The vulnerability has a high severity with a CVSS score of 8.1, impacting confidentiality and integrity but not availability.

Tektronix 3 Series MDO devices before version 1.21.1 contain an OS command injection vulnerability in the FILESystem:MOUNT:DRIve SCPI command handler. This flaw allows remote attackers with limited privileges to execute arbitrary operating system commands with elevated privileges due to insufficient neutralization of user input.

CVE-2026-96542 is a vulnerability in the standalone installer for EA Javelin Anticheat on Windows that allows local non-administrative users to elevate privileges to NT AUTHORITY\SYSTEM by modifying the service configuration and executable path. This issue affects specific versions of the standalone installer and requires manual execution outside of standard game installations. The vulnerability is fixed in version 1.0.14940699 and later, with integrated EA game titles automatically repairing service permissions.

Niefy wx-api versions up to 0.8.2 have an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by using a raw openid cookie. This enables attackers who know a victim's openid to access user information such as nickname, phone, unionid, and tags, and to modify fan tags via specific API endpoints.

abp-next-admin versions 10.2.0 through 10.6.0 contain an authorization bypass vulnerability in the LINGYUN.Abp.AIManagement module. Authenticated users with the Chat permission can access or manipulate other users' AI chat conversations by supplying the victim's ConversationId GUID. This allows reading chat messages and injecting messages into conversations without proper authorization.

DataCap through version 2025.1.1 contains an insecure direct object reference vulnerability in the BaseController.getInfoForPath function. This flaw allows authenticated users with low privileges to access other users' datasources, snippets, and dashboards by enumerating numeric IDs. Sensitive information such as datasource host, port, username, and cleartext passwords can be retrieved by exploiting this vulnerability.

An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.