The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was scheduled.
Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service operation active since 2022 and highly prolific by 2025 with over 1,000 victims. It uses a flexible platform enabling affiliates to customize attacks targeting local files, network shares, and virtual machine infrastructure, including ESXi hosts. Initial access is commonly gained via phishing, stolen credentials, vulnerable internet-facing systems, and remote management tools. The group employs a double-extortion model, encrypting data and threatening to publish stolen information on their blog and WikiLeaksV2 platform. Notable incidents include the 2024 Synnovis attack impacting UK healthcare services. Qilin is linked to other threat groups and has spawned derivative operations, some maintaining affiliate status while operating independent leak sites.
CVE-2026-58256 is a critical code injection vulnerability in JeromeDevome's GRR resource management application. Before version 4.5.0, an administrator could inject malicious PHP code via LDAP connector configuration parameters, leading to remote code execution. Exploitation requires the administrator to connect to an attacker-controlled LDAP server and submit crafted input. The vulnerability is fixed in version 4.5.0.
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output `uid`/`gid` injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.
A vulnerability in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to execute arbitrary code with SYSTEM privileges by supplying a signed executable through a forged IPC response that loads a malicious DLL from a user-writable temporary directory.
CVE-2026-93865 is a critical vulnerability in the Fireware OS FireCluster synchronization daemon. It allows a remote, unauthenticated attacker to perform privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when clustering is enabled. This flaw is due to missing authentication in the synchronization daemon.
An XPath injection vulnerability exists in WatchGuard Fireware OS's SSH authentication process. This flaw allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting specially crafted requests. The vulnerability has a high severity rating with a CVSS score of 8.7. No affected versions or patch information are provided in the available data.
An improper access control vulnerability exists in the IPC communication between TeamViewer Full Client or Host versions prior to 15.83 and the Remote Management Monitoring component prior to 26.10.1. This flaw allows a local authenticated attacker with low privileges to execute scripts with SYSTEM or root privileges.
CVE-2026-90465 is a critical vulnerability in the FireCluster Sync processing component where missing authentication allows an attacker on the cluster interconnect to execute privileged firewall management actions as root. This can be exploited by a compromised cluster peer or an on-path network attacker sending specially crafted requests.
CVE-2026-90442 is a stack-based buffer overflow vulnerability in the Fireware OS certd process. It allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request. The vulnerability has a high severity score of 8.6. No patch or remediation information is currently provided.
A vulnerability in TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker. This leads to the Monitoring service executing arbitrary code with SYSTEM privileges, resulting in local privilege escalation.
A vulnerability in WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with read-only Device Monitor privileges and management CLI access to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. The written content is limited to numeric values.
A DLL loading vulnerability exists in the TeamViewer Remote Management Monitoring installer for Windows versions prior to 26.10.1. This flaw allows a local authenticated user with low privileges to execute arbitrary code with elevated privileges, but requires user interaction to exploit.
A vulnerability in TeamViewer Full Client and Host prior to version 15.82 for Windows allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. This occurs due to improper access control in the installer staging directory during the installation of Advanced Asset Management. An attacker can exploit this by placing a crafted installer options file that the installer processes during service activation.
A race condition vulnerability exists in the installation process of TeamViewer Remote Management - Patch Management for Windows versions prior to 26.9.1. This flaw allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in a temporary directory that is insufficiently protected during Patch Management activation.
A NULL pointer dereference vulnerability exists in the management interface of WatchGuard Fireware OS. This flaw allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Exploiting this vulnerability repeatedly can terminate all active administrator sessions and ongoing management operations, potentially preventing management of the device. Importantly, traffic processing by the device is not affected.
CVE-2026-102813 is a vulnerability in the password-recovery functionality of the TP-Link RE305 V3 device. An unauthenticated attacker on the local network can trigger generation of an administrator password-reset verification code via a verification-code interface. This interface lacks effective attempt counters or lockout mechanisms and uses a predictable verification-code generation process, allowing brute-force or code prediction attacks. Successful exploitation enables the attacker to reset the administrator password and gain privileged device management access. A fix is available in version 1.1.8 Build 20260921 Rel. 42853.
CVE-2026-16491 is a missing authorization vulnerability in Grafana Enterprise's RBAC service. It causes the system to ignore the requested folder when verifying folder administrator status for deleted dashboard listings. As a result, users with dashboard permission-management rights on any folder could be mistakenly treated as administrators of all folders, potentially exposing deleted dashboard items from folders where they lack administrative access. The issue affects multiple versions of Grafana Enterprise 13.0.0 through 13.1.1. A fix requires proper permission checks on the specified folder, its ancestors, or a wildcard scope.
