CVE-2026-124257 is a stored cross-site scripting (XSS) vulnerability in the BP Better Messages plugin by wordplus. The flaw allows improper neutralization of input during web page generation, affecting versions from initial release up to 3.2.1. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability. A fix is available in version 3.2.2.
CVE-2026-124250 is a reflected cross-site scripting (XSS) vulnerability in AyeCode Ltd's GeoDirectory plugin affecting versions prior to 2.8.203. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute malicious scripts in users' browsers. The vulnerability is rated high severity with a CVSS score of 7.1. A fix is available in version 2.8.203.
Multiple vulnerabilities in Beckhoff's TcRouter.sys driver expose IOCTL interfaces with insufficient access control, potentially allowing full compromise of affected devices. These flaws affect the x64 version of the product and have been assigned CVE identifiers CVE-2026-18767, CVE-2026-18768, and CVE-2026-18769. No CVSS score or patch information is currently available.
The Wpcdoor backdoor malware was distributed through a South Korean company's DVR management software (CMS). The attack involves DLL side-loading to install a first-stage downloader that retrieves a second-stage downloader, which then executes the Wpcdoor backdoor in memory. Wpcdoor exfiltrates sensitive system information including screenshots, clipboard contents, browser credentials, and cryptocurrency wallet extension data. It targets wallets such as MetaMask, Coinbase, and Phantom. The attacker group Larva-26013 continues to deploy Wpcdoor via multiple vectors beyond the initial DVR software compromise.
CVE-2026-112174 is a local privilege escalation vulnerability in Iperius Backup 8.8.3. It arises from insufficient separation between the GUI running with elevated privileges and local low-privilege users. When the backup service runs persistently with Administrator privileges, a local attacker can exploit native Windows dialogs to execute programs with SYSTEM or Administrator privileges, compromising the Windows system.
CVE-2026-124737 is a heap buffer overflow vulnerability in the BusyBox TFTP client used in Red Hat Enterprise Linux 6. The flaw occurs when the client requests a custom small block size but falls back to the default block size without resizing the allocated memory buffer upon receiving a standard response. A malicious TFTP server can exploit this by sending standard-sized packets, potentially leading to arbitrary code execution or denial of service by crashing the client application.
This security advisory from Red Hat addresses two vulnerabilities affecting Grafana and the klauspost/compress library. The first vulnerability (CVE-2026-88967) involves the Azure Monitor data source in Grafana potentially leaking its Azure access token. The second vulnerability (CVE-2026-116591) is a denial of service issue in the klauspost/compress zstd compression library triggered by crafted compressed input. Red Hat has released updates for Grafana in Red Hat Enterprise Linux 9 to fix these issues.
A URL associated with attacker activity was observed in the wild, linked to CVE-2021-41773 and CVE-2021-42013 vulnerabilities. The URL was seen 182 times on a single day and is related to the T1105 technique (Ingress Tool Transfer), indicating its use in attacker payload delivery or callbacks. The attacker infrastructure was identified in the US. This URL should be blocked and monitored in proxy, web, and WAF logs to detect potential exploitation attempts.
CVE-2026-18769 is a vulnerability in TcRouter.sys that allows a local low privileged attacker to move arbitrary physical memory content via exposed IOCTL function calls. This flaw can lead to a full compromise of affected devices.
Progressive Robot hMailServer 6.3.7's Windows installer has a vulnerability involving incorrect default permissions during installation in certain folder locations. When installed into a new program folder with permissive parent folder permissions (e.g., root of a drive), a local authenticated user can exploit a timing window before the installer hardens folder permissions. This allows the user to place malicious files in the Bin folder, which the installer then executes with administrator privileges, enabling code execution as the installing administrator. Installations under Program Files are not affected due to stricter default permissions.
A vulnerability in Progressive Robot hMailServer versions 6.3.6 and 6.3.7 involves inefficient algorithmic complexity in the JSON reader. This flaw allows a remote unauthenticated attacker to cause denial of service by holding mail delivery threads or REST API worker threads, making mail delivery, REST API, and webmail unavailable. The issue arises from the JSON reader's handling of member names in a hash set that can be manipulated to degrade performance significantly. The attack surface includes TLS-RPT reports mailed to a hosted domain's report mailbox, REST API requests without authentication, webmail routes, and the send API. The vulnerability has a CVSS score of 7.5 (high severity).
Progressive Robot hMailServer versions 6.3.3 through 6.3.7 have a vulnerability in the web services listener related to how failed CardDAV, CalDAV, or Autodiscover sign-ins from trusted proxies are counted. The listener counts failed sign-ins against the proxy's IP address rather than the actual client, potentially causing the proxy's address to be auto-banned from the server's mail listeners. This can result in denial of service for legitimate mail clients behind the proxy. The listener is off by default and uses HTTP Basic authentication over HTTPS for these services. The auto-ban feature is enabled by default, and no patch or fixed versions are explicitly stated.
CVE-2026-126624 is a vulnerability in the Windows installer of Progressive Robot hMailServer 6.3.7 that allows a local authenticated user to execute code with elevated privileges. The issue arises when the installer installs or upgrades into a program folder where non-administrative users already have write permissions. Although version 6.3.7 hardened folder permissions for the program folder, Bin, and ControlPanel to restrict changes to administrators only, it does not change ownership or permissions of existing files or folders that other accounts control. This allows an attacker to place or maintain malicious binaries or scripts that run with elevated rights during installation or service execution. The default installation under Program Files is not affected.
Progressive Robot hMailServer versions 6.0.0-B1 through 6.3.7 on Windows improperly handle TLS file names by passing them as Latin-1 bytes to OpenSSL, which interprets them as UTF-8. This mismatch allows a local attacker with file creation permissions to substitute TLS-related files, enabling unauthorized client certificate acceptance, interception and modification of stored messages, exposure of ACME client private keys, or denial of TLS port startup. The vulnerability requires non-default configurations such as non-ASCII file names and enabled client certificates. Linux builds are not affected.
CVE-2026-18768 is a vulnerability in TcRouter.sys that allows a local low privileged attacker to access arbitrary physical memory or define its mapping through exposed IOCTL function calls. This flaw can lead to a full compromise of affected devices. The vulnerability has a high severity score of 7.8 and does not require user interaction for exploitation.
Progressive Robot hMailServer versions 6.0.0-B1 through 6.2.18 have an SQL injection vulnerability in their database layer when using MySQL/MariaDB or PostgreSQL. This flaw allows remote attackers to alter SQL statements executed by the server, potentially leading to full compromise of the database contents and integrity. The vulnerability arises from improper parameter handling, enabling injection via message recipient addresses and certain message metadata. SQL Server and SQL Server Compact are not affected due to proper parameter binding.
A vulnerability in hMailServer versions 6.2.0 through 6.3.3 using MySQL or MariaDB databases allows an attacker to bypass the auto-ban mechanism after repeated failed login attempts. This occurs because the server's auto-ban feature fails to save IP ranges when usernames contain certain UTF-8 characters outside the Basic Multilingual Plane, preventing bans from being enforced. As a result, an unauthenticated remote attacker can continue guessing passwords from a single IP address without being banned. The issue affects authentication methods using SASL PLAIN and plain-text authentication under certain configurations. Failed attempts to save bans are logged as errors. The CVSS score is 5.3 (medium severity).
Progressive Robot hMailServer 6.3.7 on Windows has incorrect default permissions in its installer when installing into pre-existing folders writable by non-administrators. This flaw allows a local authenticated user to execute code with administrator privileges during setup or upgrade by placing malicious libraries in the Bin folder before permissions are hardened. The default installation under Program Files is not affected.
hMailServer versions 6.3.4 through 6.3.7, when configured with a MySQL or MariaDB database using TlsMode=verify-full but without specifying a TlsCaFile, do not properly verify the database server's certificate issuer or name for connections treated as local by MariaDB Connector/C. This allows a local attacker who can impersonate the database server to intercept database credentials and manipulate traffic between hMailServer and the database. The issue arises because MariaDB Connector/C versions 3.4.1 and later accept any valid self-signed certificate without proper verification in these local connection scenarios. The default configuration is not affected as TlsMode defaults to prefer, which does not enforce certificate verification.