Threat Intelligence Database

CVE-2026-82819 is a path traversal vulnerability in Cerberus FTP Server that allows an authenticated remote attacker to perform UNC path injection. By manipulating a parameter to supply a malicious SMB share path, the attacker can coerce authentication attempts from the server, leading to leakage of the Cerberus service account's Net-NTLMv2 hash. This vulnerability has been fixed in Cerberus FTP Server version 2026.3.0.

Accenture, Dragos, and the SANS Institute have launched a $10 million initiative called the Community Cyber Resilience Foundation to help under-resourced small US utilities defend their operational technology (OT) environments. The first phase targets up to 500 water, electric, and natural gas utilities with annual revenues under $100 million, providing free security tools, equipment, deployment assistance, and training. The initiative aims to address challenges faced by small utilities such as limited funding, workforce shortages, and aging technology. Participants receive the Dragos Platform and related services, with Accenture managing setup and support, and SANS providing ICS/OT security training. This effort builds on Dragos's existing Community Defense Program and responds to recent attacks on US water systems. The program is intended to improve cyber resilience in critical infrastructure sectors serving millions of Americans.

MediumNewsUnited States

CVE-2026-114040 is a path traversal vulnerability in DT42 BerryNet affecting versions 3.10.0, 3.10.1, and 3.10.2. The flaw exists in the DLModelManager.get_model_meta function within berrynet/dlmodelmgr.py, where manipulation of the 'label' argument allows remote attackers to perform path traversal. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1. The issue was publicly disclosed and an exploit is available, but the vendor has not yet responded or issued a patch.

CVE-2026-114039 is a medium severity SQL injection vulnerability in projectworlds Advanced Library Management System version 1.0. The flaw exists in the mysqli_query function within the report_search.php file, where manipulation of the dateto/datefrom parameters can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, but no known active exploitation has been reported. No patch or remediation information is currently provided.

CVE-2026-92824 is an out-of-bounds read vulnerability in libmodulemd used by Red Hat Enterprise Linux 10. The flaw occurs in the module stream v2 rpm-map emission path, where an inner loop incorrectly uses the count of digest algorithms instead of the number of checksums, leading to a potential crash and denial of service during YAML serialization of crafted metadata.

CVE-2026-92822 is a vulnerability in libmodulemd used by Red Hat Enterprise Linux 10. It involves uncontrolled recursion when parsing module metadata's xmd field, which can lead to stack exhaustion or excessive resource consumption. This results in a denial of service condition. The flaw arises because there is no limit on recursion depth or node count during YAML parsing. The vulnerability has a CVSS score of 6.2, indicating medium severity.

CVE-2026-92823 is a medium severity vulnerability in libmodulemd used by Red Hat Enterprise Linux 10. It involves improper handling of highly compressed YAML data when rpmio support is enabled. The flaw allows an attacker to supply a specially crafted compressed YAML file that triggers excessive CPU and memory consumption, leading to denial of service. There is no indication of impact on confidentiality or integrity. The vulnerability requires local access (AV:L) and no privileges (PR:N) or user interaction (UI:N) are needed. No patch or remediation status is provided in the available data.

This entry is a daily update from the SANS Internet Storm Center (ISC) Stormcast podcast dated October 21, 2026. It provides general information about the ISC handlers and links to educational content but does not describe any specific security threat or vulnerability.

The Duplicator and Duplicator Pro WordPress plugins are vulnerable to PHP Object Injection via deserialization of untrusted data in versions up to 1.5.17 and 4.6.10 respectively. This vulnerability allows unauthenticated attackers to store malicious serialized objects in public site content, which are later deserialized during migration or import operations performed by an administrator. Exploitation can lead to remote code execution or file deletion, including critical files like wp-config.php, potentially resulting in site takeover. The vulnerability requires an administrator to perform a migration action after the malicious payload is stored.

CVE-2026-113744 is a critical stack-based buffer overflow vulnerability in the Tenda AC19 router firmware version 16.03.10.07. The flaw exists in the formSetFirewallCfg function of the httpd Web Management Service component, triggered by manipulation of the firewallEn argument. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed, increasing the risk of exploitation.