The URL http://play.nopixel-rp.ir/ was observed twice in attacker activity on 2026-10-24 by OffSeq Mirage honeypot sensors. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating its use in attacker payloads such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified as originating from Great Britain. This URL serves as an indicator of compromise (IOC) and should be blocked and monitored in network defenses.
ANAT (AI Network Anomaly Tracker) is an open-source, lightweight Intrusion Detection System (IDS) designed for real-time network traffic monitoring and anomaly detection. It captures packets, detects suspicious activities such as port scans, floods, and large packets, and visualizes alerts through a cyberpunk-themed dashboard. The tool supports alert logging, filtering, trusted source suppression, and integration with Discord for alert notifications. It is intended for educational and authorized security testing purposes only and requires elevated privileges for packet capture.
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
An attacker URL https://wrpddqm0rp.rbmock.dev/ was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-24. The URL was seen 4 times in attacker activity related to the T1105 technique (Ingress Tool Transfer), indicating its use for payload delivery or command and control. The attacker infrastructure was located in Colorado, USA. This URL is associated with attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software versions are affected, and no known exploits are reported in the wild for this indicator.
Postiz-app versions from 2.15.0 up to but not including 2.25.3 have a critical vulnerability (CVE-2026-115933) where session, invitation, and password reset tokens are signed with a single shared secret without distinguishing token types. This flaw allows an attacker with limited privileges to craft tokens with arbitrary claims that the application accepts as valid sessions, invitations with chosen roles, password resets, or provisioning tokens. The vulnerability stems from improper authentication design (CWE-290) and insecure token handling.
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters.
Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation.
An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.
The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
BookStack versions before 26.09.2 have an authorization vulnerability in the AttachmentController that allows authenticated users with attachment permissions to access draft page attachments of other users by enumerating attachment IDs. This can lead to unauthorized downloading, renaming, relinking, or replacing of files on unpublished draft pages.
Grav versions from 2.0.15 up to but not including 2.2.13 contain a vulnerability that allows attackers with page-edit permissions to bypass allowlist restrictions and invoke arbitrary public static methods. This can lead to unauthorized deletion of directories, overwriting of files, or reading files outside the intended page tree by embedding crafted fields in Flex form overrides within page frontmatter.
CVE-2026-116018 is an insecure direct object reference vulnerability in ONEARMY community-platform versions before 2.165.2. It allows authenticated users to mark other users' notifications as read by manipulating notification IDs in API requests. This can cause users in the same tenant to miss important notifications such as replies, comments, and new content alerts.
Xiaozhi-esp32-server versions before 0.9.8 have an insecure direct object reference vulnerability in the DeviceController.getAddressBook API. Authenticated users, including those with self-registered accounts, can access other users' device address books by specifying another user's device MAC address. This exposes contact MACs, aliases, call permissions, and owner user IDs.
CVE-2026-116016 is an authorization bypass vulnerability in yudao-cloud through version 2026.09. Authenticated users can bypass row-level data scope restrictions by sending a specially crafted header (data-permission-enable set to false) in /admin-api requests. This allows unauthorized reading or modification of other departments' and users' records within the same tenant.
CVE-2026-116015 is an authorization bypass vulnerability in the yudao-cloud product by YunaiV, affecting versions up to 2026.09. It allows authenticated users to access other members' after-sale operation logs by manipulating the afterSaleId parameter. This can expose sensitive information such as refund amounts, status changes, and timestamps.
CVE-2026-116013 is a vulnerability in OpenResty lua-resty-dns versions before 0.24 where improper input validation in parse_section() and _decode_name() allows attackers controlling or spoofing a DNS server to send malformed DNS responses. This causes uncaught Lua exceptions in resolver:query(), aborting DNS requests and breaking name resolution.
Ghidra versions prior to 12.2 contain a numeric truncation vulnerability in the PackedDecode::skipAttribute and skipAttributeRemaining functions. This flaw arises from storing 64-bit string lengths in 32-bit variables, which can be triggered by a crafted packed stream such as a malicious .sla file. Exploitation may allow injection of attributes into the decompiler's input or cause the decompiler process to crash. The vulnerability has a low CVSS score and does not indicate critical impact or widespread exploitation.
CVE-2026-116011 is a high-severity vulnerability in Crow versions before 1.3.4. It involves uncontrolled recursion in the crow::json::load() function, which can be triggered by sending deeply nested JSON objects. This causes the server's worker thread stack to be exhausted, leading to process termination and dropped connections.