Threat Intelligence Database

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected.

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

CVE-2026-82819 is a path traversal vulnerability in Cerberus FTP Server that allows an authenticated remote attacker to perform UNC path injection. By manipulating a parameter to supply a malicious SMB share path, the attacker can coerce authentication attempts from the server, leading to leakage of the Cerberus service account's Net-NTLMv2 hash. This vulnerability has been fixed in Cerberus FTP Server version 2026.3.0.

Accenture, Dragos, and the SANS Institute have launched a $10 million initiative called the Community Cyber Resilience Foundation to help under-resourced small US utilities defend their operational technology (OT) environments. The first phase targets up to 500 water, electric, and natural gas utilities with annual revenues under $100 million, providing free security tools, equipment, deployment assistance, and training. The initiative aims to address challenges faced by small utilities such as limited funding, workforce shortages, and aging technology. Participants receive the Dragos Platform and related services, with Accenture managing setup and support, and SANS providing ICS/OT security training. This effort builds on Dragos's existing Community Defense Program and responds to recent attacks on US water systems. The program is intended to improve cyber resilience in critical infrastructure sectors serving millions of Americans.

MediumNewsUnited States

CVE-2026-114040 is a path traversal vulnerability in DT42 BerryNet affecting versions 3.10.0, 3.10.1, and 3.10.2. The flaw exists in the DLModelManager.get_model_meta function within berrynet/dlmodelmgr.py, where manipulation of the 'label' argument allows remote attackers to perform path traversal. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1. The issue was publicly disclosed and an exploit is available, but the vendor has not yet responded or issued a patch.

CVE-2026-114039 is a medium severity SQL injection vulnerability in projectworlds Advanced Library Management System version 1.0. The flaw exists in the mysqli_query function within the report_search.php file, where manipulation of the dateto/datefrom parameters can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, but no known active exploitation has been reported. No patch or remediation information is currently provided.

CVE-2026-92824 is an out-of-bounds read vulnerability in libmodulemd used by Red Hat Enterprise Linux 10. The flaw occurs in the module stream v2 rpm-map emission path, where an inner loop incorrectly uses the count of digest algorithms instead of the number of checksums, leading to a potential crash and denial of service during YAML serialization of crafted metadata.

CVE-2026-92822 is a vulnerability in libmodulemd used by Red Hat Enterprise Linux 10. It involves uncontrolled recursion when parsing module metadata's xmd field, which can lead to stack exhaustion or excessive resource consumption. This results in a denial of service condition. The flaw arises because there is no limit on recursion depth or node count during YAML parsing. The vulnerability has a CVSS score of 6.2, indicating medium severity.

CVE-2026-92823 is a medium severity vulnerability in libmodulemd used by Red Hat Enterprise Linux 10. It involves improper handling of highly compressed YAML data when rpmio support is enabled. The flaw allows an attacker to supply a specially crafted compressed YAML file that triggers excessive CPU and memory consumption, leading to denial of service. There is no indication of impact on confidentiality or integrity. The vulnerability requires local access (AV:L) and no privileges (PR:N) or user interaction (UI:N) are needed. No patch or remediation status is provided in the available data.

This entry is a daily update from the SANS Internet Storm Center (ISC) Stormcast podcast dated October 21, 2026. It provides general information about the ISC handlers and links to educational content but does not describe any specific security threat or vulnerability.