Threats tagged 'cisa-kev'

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

CVE-2026-87886 is a local privilege escalation vulnerability in Acronis Backup plugins for cPanel & WHM, Plesk, and DirectAdmin on Linux. It is caused by insecure file permissions allowing an attacker with limited privileges to escalate to higher privileges. The issue affects versions before build 1.9.3.1021 for cPanel & WHM, 1.8.11.638 for Plesk, and 1.2.3.238 for DirectAdmin. A fix is available in these builds. The vulnerability has a high severity score of 7.8 and is known to be exploited in the wild.

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

The threat intelligence report from September 14, 2026, details multiple cyber incidents including data breaches, vulnerabilities, and AI-related threats. Notably, a data breach at Mathspace was caused by exploitation of CVE-2026-72898, a SQL injection vulnerability in the self-hosted Metabase tool, exposing user names, emails, usernames, and locations. Other significant vulnerabilities include Microsoft’s Patch Tuesday addressing 974 flaws including privilege escalation zero-days, and GitLab’s critical path traversal vulnerability CVE-2026-85706 allowing unauthenticated arbitrary file reads. MikroTik RouterOS vulnerabilities enabling passwordless SSH and privilege escalation were also fixed. The report includes AI threats involving prompt evasion and sandbox escapes. Check Point IPS provides protections for several mentioned vulnerabilities. The report does not specify affected versions for CVE-2026-72898. No CVSS score is provided for this vulnerability.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

This security update for ClamAV addresses multiple vulnerabilities including improper boundary checks, invalid memory frees, integer overflows and underflows, out-of-bounds reads/writes, path traversal, and thread-safety issues. These flaws affect various parsers such as ZIP, PESpin, GPT partition names, PDF hex strings, Mach-O files, XAR, and OneNote notebooks. The update also fixes issues related to NTFS alternate data stream handling on Windows and improves thread safety and resource management in the daemon and cryptographic components.

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Microsoft's September 2026 Patch Tuesday release addresses 973 vulnerabilities across multiple products, including 113 critical issues. Among these, several vulnerabilities have been exploited in the wild, notably CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows ALPC), both elevation of privilege flaws with CVSS scores of 7.8. The update also includes multiple remote code execution vulnerabilities with high CVSS scores, such as CVE-2026-69676 (Windows Kerberos) with a score of 8.8 and CVE-2026-69730 (Windows DNS Server) with a score of 9.8. Microsoft highlights some vulnerabilities as more likely to be exploited and others as less likely. The vulnerabilities affect a broad range of Microsoft products including Windows components, Azure services, and Microsoft SQL Server. No explicit patch links are provided in the source, but these vulnerabilities are part of the official monthly security update. The vendor manages remediation through this update.

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.