Admidio versions prior to 5.0.17 have an improper access control vulnerability that allows authenticated users to bypass server-side restrictions on event guest registration. Specifically, attackers can manipulate the additional_guests field to register more guests than allowed, exhausting event capacity and preventing other users from registering.
Umbraco CMS versions before 17.7.2 and 18.2.2 contain an authentication bypass vulnerability via an open redirect flaw. This allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by manipulating the Host header. Exploitation involves sending signed-in users authorization links with response_mode=form_post to capture authorization codes, which attackers then redeem using HTTP Basic client credentials. Successful exploitation can hijack back-office sessions and execute code through Razor templates.
Check Point Research identified a malware campaign named Yoba that abuses the popularity of AI tools like ChatGPT and Claude by creating fake GitHub projects impersonating AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. These projects host malicious installers containing a dropper and loader that fetch and execute malware. The campaign uses DLL sideloading with legitimate signed binaries to evade detection and employs strong operational security by avoiding traditional command-and-control infrastructure, instead using Telegram, Tor, Catbox, and DNS over HTTPS. The threat actor shows indicators of Russian origin and operates primarily in the UTC-4 timezone. The malicious releases are hosted on GitHub without password protection, leveraging SEO poisoning to appear in top Google search results and lure victims.
This analysis discusses how AI is expanding the attack surface of critical infrastructure managed by state, local, and education (SLED) agencies. Cyber attackers often target under-resourced SLED organizations operating critical infrastructure such as water systems, hospitals, and emergency services. AI adoption by these agencies and adversaries' use of AI automation complicate security efforts. A whole-of-state cybersecurity approach, treating all local entities as a unified defensive perimeter, is recommended to mitigate risks. The report highlights concerns about aging operational technology, limited cyber staff in small communities, and unclear governance responsibilities. Attacks on smaller entities can have cascading effects on larger systems and public safety. Insider threats and excessive access privileges further increase risk. Nearly 90% of state CIOs rate cyberattacks on critical systems as a high concern.
CVE-2026-92546 is an authentication bypass vulnerability in Keepnet Labs Cybersecurity Inc.'s Agentic AI / Agentic Ally product. The flaw allows an attacker to bypass authentication by spoofing, potentially granting unauthorized access. The vulnerability affects versions before commit 0ef61f2e and has a high severity rating with a CVSS score of 7.5. A fix is available in version 0ef61f2e.
CVE-2026-116627 is a cross-site scripting (XSS) vulnerability in Devolutions PowerShell Universal versions 2026.3.0 and earlier. It affects the notifications feature, allowing an authenticated user with permission to create notifications to execute arbitrary JavaScript in another user's browser via a crafted notification target URL. This vulnerability is fixed in version 2026.3.1.
CVE-2026-15586 is a vulnerability in İdvlabs Software and Consulting Services Inc.'s Ontime product that allows brute force attacks due to improper restriction of excessive authentication attempts. The vulnerability affects versions up to and including 2026-10-27. The vendor was contacted but did not respond to the disclosure. The CVSS score is 5.3, indicating a medium severity level.
Dell PowerProtect Data Domain versions 7.7.1.0 through LTS 2026, including specific LTS2024, LTS2025, and LTS2026 release versions, contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS score is 4.9 (medium severity). No patch or remediation information is provided in the available data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper access control vulnerability. This flaw allows an unauthenticated remote attacker to potentially cause a denial of service. The vulnerability does not impact confidentiality but can affect system availability. No public exploits or known active exploitation have been reported. The CVSS v3.1 base score is 6.5, indicating a medium severity level.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper privilege management vulnerability. This flaw allows a high privileged attacker with local access to potentially elevate their privileges further. The vulnerability has a CVSS score of 6.3, indicating a medium severity impact. No public exploits or known active exploitation have been reported. No patch or remediation information is currently provided.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper privilege management vulnerability. This flaw could allow a high privileged attacker with remote access to elevate their privileges. The vulnerability has a CVSS score of 6.7, indicating a medium severity level. No public exploits or known in-the-wild exploitation have been reported. Patch or remediation information is not provided in the available data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service. The vulnerability does not impact confidentiality or integrity. No public exploits or known active exploitation have been reported. The CVSS v3.1 base score is 4.9 (medium severity).
Eaton easyE4 devices use a static nonce during authentication, which allows an unauthenticated attacker who can capture authentication traffic to replay valid authentication exchanges. This replay attack could lead to unauthorized access to the device.
An OS command injection vulnerability in a CoreTec product allows authenticated users with certain roles to execute arbitrary system commands. The flaw is in the configuration daemon's time synchronization handler, which unsafely concatenates user input when setting the system time-zone. This can lead to full control over the affected device. The vulnerability has a high severity score of 7.7 and requires authentication with limited privileges. No patch or remediation details are currently provided.
Eaton easySoft does not properly validate TLS certificates presented by easyE4 devices, allowing a network-adjacent attacker to potentially perform man-in-the-middle attacks. This vulnerability could enable interception or modification of communications between easySoft and easyE4 devices.
Eaton easyE4 devices implement an insufficiently strong password policy. This weakness allows an attacker who obtains password hashes, potentially via related vulnerabilities such as CVE-2026-41020, to conduct offline password-guessing attacks and possibly recover user credentials. The vulnerability is rated high severity with a CVSS score of 7.5.
A vulnerability in github.com/eclipse-keypont/crypto11/v2 versions from 2.0.0-rc3 through 2.0.0-rc8 allows an attacker to compromise the confidentiality of shared secrets. The ML-KEM key-pair lookup functions do not verify that the public key matches the private key, enabling an attacker who can open an unauthenticated session and plant a public key object with victim identifiers to receive shared secrets intended for the victim. Versions prior to 2.0.0-rc3 and after 2.0.0-rc8, as well as v1 module paths, are not affected.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability allows an unauthenticated remote attacker to potentially perform SSRF attacks against the server.
The PuMuKIT application has an Unrestricted Upload of File with Dangerous Type vulnerability that allows unauthenticated users to upload any file type to the server. This upload can occur in any directory where the web server user has write permissions, potentially enabling file deletion as well. The vulnerability is rated high severity with a CVSS score of 8.8.
Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1 contain a vulnerability where the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands executed on remote agent hosts. An attacker able to modify the API response can inject shell metacharacters, causing arbitrary command execution on the agent host when the operator deploys or attaches an agent. This issue is fixed in version 3.9.2.