Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
CVE-2026-115993 is a stored cross-site scripting (XSS) vulnerability in the Notes field of the Checklists feature in Cervantes version v1.3-beta. This flaw allows an attacker to inject malicious scripts that execute in another user's browser with elevated privileges. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. No patch or remediation information is currently available, and there are no known exploits in the wild.
CVE-2026-105445 is a critical vulnerability in Docker Hub's account-to-organization conversion feature that allows an authenticated attacker to reassign a personal access token (PAT) they control to another user without requiring token rotation or revocation. This enables the attacker to use the unchanged PAT to authenticate as the recipient user and perform actions such as pulling, pushing, or deleting images within the token's scope, including organization repositories.
CVE-2026-94450 is a high-severity vulnerability in AWS s2n-quic versions 1.88.0 and earlier. It involves improper validation of the Destination Connection ID length, which can allow an unauthenticated remote attacker to cause a denial of service by shutting down a server endpoint with a single crafted UDP datagram. This affects only server endpoints configured to send Retry packets. The issue is fixed in version 1.89.0 and later.
CVE-2026-86830 is a high-severity vulnerability in AWS IAM Identity Center's Temporary Elevated Access Management (TEAM) solution prior to version 1.5.1. It involves incorrect privilege assignment that could allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests. This could lead to unintended temporary elevated access to AWS accounts managed through TEAM. The issue is fixed in version 1.5.1 and later.
CVE-2026-11400 is an untrusted search path vulnerability in the GlobalDatabasePlugin of the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL. This flaw allows a remote authenticated low-privilege user to escalate privileges to those of another Amazon RDS user, including the highly privileged rds_superuser role, by creating a crafted function that executes upon connection through the affected wrapper. The issue affects versions from 3.0.0 up to but not including 4.0.1. AWS has released version 4.0.1 to remediate this vulnerability.
CVE-2026-97406 is a vulnerability in the Xerj Console API version 1.0.0-rc.11 where bearer tokens can bypass the passkey-only authentication requirement. This allows unauthorized users to invoke the API-token creation endpoint and mint persistent successor credentials without proper authentication.
A vulnerability in the A2A server component of Amazon Strands Agents SDK for Python before 1.43.0 and TypeScript before 1.5.0 allows an authenticated remote user to access other tenants' conversation history and modify model behavior by exploiting improper isolation of conversation state between callers.
CVE-2026-115417 is a high-severity vulnerability in the AWS aws-c-mqtt library before version 0.16.2. It involves memory allocation with an excessive size value in the MQTT 3.1.1 compatibility adapter, which could allow a remote attacker to cause a denial of service (DoS) of the client application. The issue is fixed in aws-c-mqtt version 0.16.2 and later. Users should upgrade to these versions or to an AWS Common Runtime or AWS IoT Device SDK release that includes the fix.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
The URL chinamobile.com was observed as an attacker callback or command-and-control (C2) endpoint in the wild between 2026-07-20 and 2026-08-11. This activity was detected by OffSeq Mirage honeypot sensors 32 times and involved the use of the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified in France. Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
Cloudflare has introduced a post-quantum (PQ) GeoKey Manager that restricts decryption keys to be unwrapped only within designated geographic regions. This system uses hybrid post-quantum cryptography (ML-KEM-768 plus X25519) to protect keys, ensuring that regional root keys never leave their authorized regions and are stored only in volatile kernel memory on authorized edge servers. The GeoKey Manager supports data sovereignty by enforcing geographic boundaries on key usage, preventing decryption outside the chosen region. It is currently in closed beta with general availability planned for Q1 2027.
A Microsoft 365 API credential for ConnectWise Cloud Backup (formerly SkyKick) was compromised and used by an attacker to access hundreds of customer M365 environments. The attacker obtained Microsoft Graph access tokens and moved through tenants in an automated fashion. In at least one case, the ConnectWise Cloud Management MS Teams application was elevated to Global Administrator, allowing the attacker to add credentials to other applications, including security tools. The campaign started with password spraying against law firms, followed by role assignments in about 50 tenants, and widespread credential abuse across nearly 1,000 Entra tenants. A second wave targeted 16 tenants in sensitive sectors such as policy, national security, trade, and critical minerals. No official patch or remediation guidance is currently available.
Multiple vulnerabilities in Plex Media Server version 1.43.2 and earlier are actively exploited in the wild to achieve remote code execution. Attackers chain four CVEs to deploy the XMRig cryptominer and a proxy tool named myawesomeproxy. Exploitation attempts began on October 17, 2026, with malicious payloads downloaded from known IP addresses. The proxy software may enable threat actors to use residential IPs to access corporate VPNs and email systems. Public proof-of-concept exploit code is available via the plex2shell project. No official patch or remediation information is currently provided.
In October 2026, Citrix NetScaler ADC appliances running affected 14.1 builds were compromised through a chain of two vulnerabilities: CVE-2026-88771 and CVE-2026-88779. Attackers achieved root code execution by exploiting a pre-authentication log-poisoning/RCE vulnerability and a SAML-parsing crash. The intrusion involved deploying PHP web shells, modifying system shells, creating cron jobs, and establishing boot hooks for persistence. Additional tools included TCP session managers, HTTP tunnels, and reverse agents for command-and-control. Attackers used a Go-based reconnaissance tool to map internal infrastructure and synchronized implants across appliance pairs to maintain persistence. The campaign exfiltrated NetScaler configurations, historical data, and key material, evolving from initial access to a persistent internal reconnaissance platform.
CVE-2026-102764 is a critical authentication bypass vulnerability in BeyondTrust Remote Support versions 26.2.3 and earlier. It enables unauthenticated remote attackers to perform arbitrary file operations without user interaction. Exploitation in the wild has been confirmed, involving deployment of web shells and tunneling tools, root privilege escalation, credential vault extraction attempts, persistence mechanisms, and log deletion. The threat actor ARMORY CASTLE, linked to PRC-nexus espionage, is attributed to these attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities list. Emergency patching and thorough compromise investigations are required, as patching alone does not remove attacker persistence.
A DLL side-loading vulnerability (CVE-2026-110936) in Siemens Software Center version 3.5.8.7 is actively exploited by attackers distributing a genuine signed application with malicious DLLs via unofficial channels. The vulnerable software loads attacker-supplied DLLs without validation, enabling code execution. The attack uses ClickFix social engineering to trick users into running commands. Version 4.0.9.8 patches the vulnerability with automatic updates applied on restart. No official Siemens systems or distribution channels were compromised during this campaign.
The Gentlemen is a ransomware-as-a-service (RaaS) operation active since mid-2025, targeting Windows, Linux, NAS, and BSD systems. It uses a double-extortion approach by encrypting files with ChaCha20 encryption and exfiltrating data. The ransomware kills security processes via vulnerable drivers and spreads laterally using PsExec. A breach in May 2026 exposed internal communications and affiliate details. The group mainly targets organizations in the United States and Europe across various sectors including manufacturing, technology, healthcare, professional services, and retail.
CVE-2026-0257 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS affecting GlobalProtect portal and gateway components. Exploitation allows unauthorized attackers to establish VPN connections without valid credentials. Ransomware groups such as Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra actively exploit this flaw to gain initial network access. Post-exploitation activities include bypassing multi-factor authentication, internal reconnaissance, lateral movement via RDP and SMB, credential harvesting, and ransomware deployment. Attackers also pivot to virtualization infrastructure by accessing vCenter management appliances, disabling ESXi hypervisor security controls, and performing offline credential dumping from domain controller virtual disks. Multiple industries have been impacted. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.
BlueHammer (CVE-2026-33825) is a local privilege escalation chain targeting Windows Defender Antimalware Platform versions before 4.18.26030.3011. It requires initial code execution as a standard user and uses a series of legitimate Windows mechanisms to escalate privileges to NT AUTHORITY\SYSTEM. The exploit freezes the MsMpEng.exe process via CloudFilter manipulation and stages malicious update files. Laboratory tests demonstrated successful privilege escalation, recovery of domain-admin credentials from LSASS, and lateral movement using pass-the-hash techniques to compromise domain controllers. Exploitability depends on runtime factors such as pending signature updates, Defender state, filter drivers, VSS, and CloudFilter reachability. No known exploits are reported in the wild, and no patch information is provided.
