Threat database

CGM CLININET versions prior to 2026.MS1 and 2026.MS3 store user passwords as unsalted MD5 hashes, which use insufficient computational effort for password hashing. This vulnerability has a high severity score of 8.2 and was addressed in versions 2026.MS1 and 2026.MS3.

CGM CLININET contains a critical vulnerability (CVE-2025-30047) involving deserialization of untrusted data in its HTTP-based API used by the administrative module. An attacker on the same local network can send crafted serialized Java objects that, when deserialized by the server, lead to remote code execution with root privileges. This vulnerability is fixed in version 2026.MS3.

CVE-2025-30046 is a critical vulnerability in the CGM CLININET application server where HL7 communication processes run with root privileges while handling untrusted data. This allows an attacker on an adjacent network to send malicious data to these processes and achieve remote code execution with root privileges. The vulnerability affects versions up to 2026.MS3. A patch is available, and the product is a cloud service with vendor-managed remediation.

CGM CLININET contains a code injection vulnerability in its ConvExpr function that processes Perl expressions into RTF document content. This flaw allows an authenticated attacker with high privileges to execute arbitrary code with root privileges. The vulnerability affects versions up to and including 2026.MS3. A patch is available, and the product is a cloud service where the vendor manages remediation.

CGM CLININET has a vulnerability (CVE-2025-30043) involving missing authentication on the /DocManagment endpoint. This allows unauthenticated attackers on adjacent networks to access and download patient documents. The issue is fixed in version 2026.MS3. The vulnerability has a high severity score of 7.1 and affects versions prior to 2026.MS3.

LiteLLM version 1.107.0 was compromised in a supply chain attack where attackers used leaked GitHub CLI OAuth tokens to push malicious packages to PyPI and Docker. The malicious packages were available for about three hours and downloaded over 49,000 times. The malware included an information stealer and a remote access trojan (RAT) that harvested sensitive credentials and secrets, then communicated with attacker-controlled servers. The incident was traced to leaked tokens exposed via logs and involved disabling branch protections and redirecting release workflows. Enterprise customers using private repositories were not affected. Users are advised to remove the compromised version and rotate credentials.

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings. The issue has been fixed in LTS versions 5.8.4 and 5.12.0 and later.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.8.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7.

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.8.

Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.

Atlassian's October 2026 security bulletin addresses 75 unique vulnerabilities affecting its Data Center and Server products, including Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management. Among these, 14 are critical-severity issues primarily in third-party components such as Apache Tomcat, Bouncy Castle, Netty, and Apache SSHD. Atlassian assesses the risk from these third-party component vulnerabilities as lower and non-critical for their products. The bulletin includes a variety of issues such as denial-of-service, cryptographic weaknesses, authentication and authorization problems, SSRF, information disclosure, and code execution bugs. Atlassian recommends updating to the latest product versions or fixed releases to mitigate these vulnerabilities. There is no indication of active exploitation in the wild for these issues.

CVE-2026-4952 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (AuftragsManager) version 7.0.8.6 and earlier. Authenticated users can inject JavaScript code into a business reference field via the ASMobile web interface. This code executes when a privileged user views the order in the OrderAdministration portal, potentially leading to privilege escalation or session compromise. The vulnerability has a medium severity score of 5.1 and affects versions up to 7.0.8.6. No patch or remediation information is provided by the vendor.

CVE-2026-4951 is a cross-site scripting (XSS) vulnerability in the CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem. It allows an attacker to inject JavaScript code via the "searchValue" URL parameter, which executes in the browser of a privileged user who opens a crafted link. This can lead to account takeover or user lockout since administrative users can change passwords without needing the old password. Version 7.0.8.6 and earlier versions are affected. The vulnerability has a medium severity score of 5.1. No patch or remediation information is currently available from the vendor.

CVE-2026-4950 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (KundenManager) portal. Privileged users can inject JavaScript code into user properties such as the "secondName" parameter. This code is stored and executed in the browsers of other privileged users viewing the affected user entries or user group overviews. The vulnerability affects versions from 0 up to and including 7.0.8.6. It requires authenticated access with high privileges and user interaction to trigger. No patch or remediation information is provided by the vendor.

CVE-2026-63244 is a critical authentication bypass vulnerability in WizLearn Technologies' Learning Management System. It allows an unauthenticated remote attacker to bypass both password and OAuth authentication by sending a specially crafted POST request. Successful exploitation could lead to unauthorized access to user accounts and full administrative control of the LMS platform.

Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.