Threat Intelligence Database

CVE-2026-76661 is a high-severity vulnerability in Hewlett Packard Enterprise's HPE NonStop QIOMON component. It involves improper input validation that leads to an out-of-bounds write, potentially corrupting buffer data. The vulnerability has a CVSS score of 7.6, indicating significant impact on integrity and availability. No specific affected versions or patch information are provided.

CVE-2026-76660 is a high-severity vulnerability in Hewlett Packard Enterprise's HPE NonStop CIPSAM product. It involves improper input validation leading to an out-of-bounds write that can corrupt buffer data. This vulnerability can impact confidentiality, integrity, and availability of the affected system.

CVE-2026-76066 is an authorization bypass vulnerability in crestalnetwork's IntentKit up to version 2.6.3. The flaw allows unauthenticated or public callers in various contexts (WEB, API, TWITTER, TELEGRAM) to execute owner-only state-changing tools without approval. This occurs because the executor validates tool calls against the full tool registry instead of the restricted per-request tool advertisement, enabling unauthorized execution of sensitive capabilities such as wallet transfer and memory-write.

CVE-2026-76659 is a high-severity vulnerability in the finger daemon component of Hewlett Packard Enterprise's HPE NonStop TCP/IP UTILITIES. The flaw involves missing authentication for a critical function, allowing an unauthenticated remote attacker to cause a denial of service. No data confidentiality or integrity impact is reported. No affected versions or patch information are provided.

Ellucian WebAdvisor 3.2 has an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to send crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint. This flaw enables server-side request forgery (SSRF), disclosure of NTLMv2 hashes via attacker-controlled SMB shares, and arbitrary file reading from the Windows host through an out-of-band error channel. WebAdvisor reached end-of-support in June 2022, and users are advised to migrate to Colleague Self-Service.

CVE-2026-76656 is a medium severity vulnerability in Hewlett Packard Enterprise's HPE NonStop TCP/IP UTILITIES. It involves missing authentication for a critical function, specifically when the traceroute command is executed under certain conditions. This flaw could allow an unauthenticated remote attacker to cause a denial of service. No information about affected versions or available patches is provided.

MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.

CVE-2026-73799 is a high-severity stack-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop SNMP Trap Multiplexer. This flaw may lead to memory corruption, potentially causing denial of service. No specific affected versions or patch information are provided.

Panchan is a peer-to-peer crypto mining worm first identified in 2022 that propagates by stealing SSH keys and using a rootkit to maintain persistence. It targets insecure internet-facing servers, especially those with exposed SSH services lacking proper access controls. The worm uses a Discord channel as its command-and-control server and can pivot to other hosts by leveraging stolen SSH credentials. Indicators of compromise include repeated failed SSH login attempts, unusual resource usage, hidden directories with high-entropy names, and network traffic to Discord. Mitigations include implementing egress and ingress filtering, access control lists, multi-factor authentication for SSH, disabling root login, using SSH key management solutions like HashiCorp Vault, and deploying firewalls and intrusion detection/prevention systems. Monitoring via SIEM solutions is recommended for scalable detection. Systems with strong security controls are not vulnerable to this worm.

CVE-2026-0993 is a buffer overflow vulnerability in the SODOLA SL902-SWTGW124AS firmware versions up to 200.2.12. It arises from improper size checking of an input boundary value in the Content-Type header of a crafted POST request. Exploitation causes the device to become fully unresponsive, resulting in denial of service by disrupting management access and traffic forwarding during recovery.