Overview of incoming advisories.
1553 results found
Citrix heeft twee kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. CVE-2026-19489 betreft een memory overflow die optreedt wanneer de producten zijn geconfigureerd als SIP ALG binnen een Large Scale NAT (LSN) groep, wat kan leiden tot denial of service of onvoorspelbaar gedrag. CVE-2026-19490 stelt aanvallers in staat authenticatiemechanismen te omzeilen voor ongeautoriseerde toegang, waarbij de producten geconfigureerd moeten zijn als Gateway, AAA virtual server of SAML Identity Provider. Er is Proof of Concept code beschikbaar voor CVE-2026-19490. Het NCSC acht het zeer waarschijnlijk dat op korte termijn actief misbruik zal plaatsvinden van CVE-2026-19490. Organisaties worden geadviseerd de beschikbare patches zo snel mogelijk toe te passen.
View original advisory →Cybersecurity researchers at Huntress have identified worm-like activity abusing ConnectWise ScreenConnect to distribute malicious VBScript payloads to newly connected systems. Three unrelated incidents were discovered, each using different initial access methods: a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake application. The attack chain consists of four stages delivered via Visual Basic Script. Once a rogue ScreenConnect client is established, it spreads the malicious payload to other hosts that connect to the compromised instance. This lateral movement capability makes the threat particularly dangerous in enterprise environments where ScreenConnect is widely used for remote management. The activity highlights the ongoing abuse of legitimate remote access tools by threat actors.
View original advisory →N-able has patched a critical pre-authentication remote code execution vulnerability in N-central versions prior to 2026.3.1.14. The flaw allows an unauthenticated attacker to remotely execute arbitrary code on affected systems. All on-premises installations running vulnerable versions are affected. On-premises customers are strongly advised to upgrade immediately to N-central 2026.3 HF4. Hosted N-central (NCOD) instances have already been patched automatically. Active exploitation attempts have been observed in the wild. N-able recommends investigating Indicators of Compromise (IoCs) as a precautionary measure.
View original advisory →Hackers are actively exploiting a chain of two recently disclosed vulnerabilities in MikroTik RouterOS to gain control of affected devices. The attack targets routers with SSH services exposed to the internet. The vulnerability chain allows attackers to hijack the routers remotely. MikroTik is a widely used networking equipment vendor, making this a significant threat to network infrastructure globally. Organizations using MikroTik routers with internet-facing SSH are at risk. The exploitation of chained vulnerabilities increases the severity of the threat. Users are advised to apply patches and restrict SSH access to mitigate risk.
View original advisory →ConnectWise has disclosed a new vulnerability affecting its ScreenConnect remote access software. The flaw does not yet have a patch available, though ConnectWise has shared temporary mitigation measures for affected users. A patch is planned for release later in the week. ScreenConnect is widely used in enterprise environments for remote support and access, making vulnerabilities in it high-impact targets. The lack of an immediate patch increases the risk window for exploitation. Organizations using ScreenConnect are advised to apply the temporary mitigations as soon as possible. This follows a pattern of prior high-severity vulnerabilities in ScreenConnect that were actively exploited by threat actors. The article serves as an early warning advisory for administrators to act before a formal fix is released.
View original advisory →N-able has released its fourth hotfix in five weeks for its N-central remote monitoring and management (RMM) platform to address an unauthenticated remote code execution (RCE) vulnerability. Every on-premises N-central build below version 2026.3.1.14 is affected, including those updated to Hotfix 3 just a day prior. The vulnerability is serious enough that N-able's incident notice states it has been exploited in the wild, although the release notes describe exploitation as unconfirmed. The rapid succession of hotfixes indicates the complexity and severity of fully remediating the underlying flaw. RMM platforms like N-central are high-value targets as they provide broad access to managed endpoints across many organizations. Administrators are urged to apply Hotfix 4 immediately to all affected on-premises deployments.
View original advisory →Cybersecurity researchers from Check Point Research have analyzed JSCeal, a sophisticated malware compiled as V8 JavaScript (JSC). The malware is capable of credential harvesting, surveillance, and traffic interception. JSCeal is notably able to bypass Google authentication by stealing session cookies, effectively circumventing multi-factor authentication protections. The payloads are protected using javascript-obfuscator with multiple advanced obfuscation techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers. This makes analysis and detection significantly more challenging. The malware represents a growing trend of sophisticated browser-targeting threats that can undermine modern authentication mechanisms.
View original advisory →N-able has issued an emergency hotfix addressing a maximum-severity remote code execution (RCE) vulnerability in its N-central remote monitoring and management (RMM) platform. The flaw carries a critical severity rating and is being actively exploited in ongoing attacks. N-central is widely used by managed service providers (MSPs) to monitor and manage client endpoints, making this vulnerability particularly impactful. The emergency patch was released outside of the normal update cycle due to the severity and active exploitation. Organizations using N-central are urged to apply the hotfix immediately. RMM platforms are high-value targets for threat actors as they provide broad access to managed environments. The vulnerability could allow unauthenticated remote attackers to execute arbitrary code on affected systems. Details about the specific CVE identifier and technical exploitation method were not fully disclosed in the article snippet.
View original advisory →A vulnerability was identified in the sfturing hosp_order application up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. The flaw exists in the orderRecordsService.cancelOrder function within OrderController.java, specifically in the Order Cancellation component. Manipulation of the ID argument enables an attacker to bypass authorization controls remotely. A public exploit is already available, increasing the risk of active exploitation. The product uses a rolling release model, so no specific version information is disclosed for affected or patched releases. The project maintainer was notified via an issue report but has not yet responded. This represents an actively exploitable, unpatched authorization bypass in a hospital order management system. The lack of vendor response and public exploit availability significantly elevates the risk level.
View original advisory →commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension. The vulnerability arises from a failure to deduplicate footnote definitions, allowing attackers to craft malicious documents with duplicate footnote definitions and references. This causes quadratic output expansion, leading to excessive memory and CPU consumption. The attack can exhaust server resources, effectively causing a denial of service. The vulnerability affects the PHP League's commonmark library and has been assigned CVE-2026-86435. A fix is available in version 2.8.4 and later. Users are advised to upgrade to the patched version to mitigate the risk.
View original advisory →A command injection vulnerability was identified in multiple Advantech WISE-6610 series devices running firmware version 1.2.1_20251110. The flaw exists in the basicstation_apply function within the Basic Station Certificate-Deletion Handler component, where manipulation of the 'act' argument enables command injection. The vulnerability can be exploited remotely and a public exploit has been disclosed. Affected models include WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, their EL variants, and WISE-6610P-DEA, WISE-6610P-DNA, and WISE-6610P-DTA. The vendor responded promptly and released a patched firmware version 1.2.4_20260821. Users are advised to upgrade immediately to mitigate the risk.
View original advisory →league/commonmark versions >= 2.0.0 and < 2.8.4 contain a denial of service vulnerability in the UniqueSlugNormalizer::normalize() function. The flaw causes an O(K^2) time complexity when K headings collapse to the same base slug due to restarting the numeric-suffix search from 1 on every collision. The vulnerability is triggered when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered. An unauthenticated attacker can craft a small Markdown document with many headings sharing the same base slug (e.g., empty ATX headings, identical text, or punctuation-only headings) to consume excessive CPU. The issue is patched in version 2.9.0. This is a remotely exploitable, low-complexity attack requiring no authentication or special privileges.
View original advisory →A stack-based buffer overflow vulnerability has been identified in the D-Link DIR-822A router (firmware version A_101). The vulnerability resides in the strcpy function within the udhcpcd/serverpacket.c file of the udhcpcd component, related to TR-111 Option 125 parsing. An attacker can exploit this vulnerability remotely without requiring physical access to the device. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability has been assigned CVE-2026-86296 and is tracked on NVD and VulDB. D-Link home/SMB routers are the affected products, posing a risk to network infrastructure. Users are advised to monitor for patches from D-Link and apply mitigations promptly.
View original advisory →A vulnerability has been identified in the light0011 CMS affecting the file App/Home/Model/UserModel.class.php within the Cookie Helper component. The flaw allows an attacker to manipulate the Username argument, leading to improper authentication. The attack can be executed remotely, and a public exploit is already available, increasing the risk of active exploitation. The affected product uses a rolling release model, so no specific version information is disclosed. The project maintainer was notified via an issue report but has not yet responded. The vulnerability is tracked as CVE-2026-86306 and is referenced in both the NVD and VulDB databases.
View original advisory →A security vulnerability has been identified in sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. The vulnerability resides in the updateOrderSta1/updateOrderdiseaseInfo functions within the OrderController.java file of the Order Handler component. Manipulation of the userID/id arguments allows an attacker to bypass authorization controls. The vulnerability can be exploited remotely, and a public exploit has already been disclosed. The project uses a rolling release strategy, making it difficult to specify exact affected or patched versions. The vendor was notified via a GitHub issue report but has not responded. This poses a risk to healthcare order management systems using this software.
View original advisory →A vulnerability has been identified in SourceCodester Syllabus-Aligned Learning Management & Examination System version 1.0. The flaw resides in the file db.php, where improper handling leads to hard-coded credentials being exposed. This vulnerability can be exploited remotely by attackers without requiring physical access to the system. The exploit has been publicly disclosed and is available for use, increasing the risk of active exploitation. Hard-coded credentials typically allow unauthorized access to backend systems, including databases. The issue is classified as a high-severity vulnerability due to its remote exploitability and public exploit availability. Organizations using this LMS platform are advised to apply patches or mitigations immediately. The vulnerability was reported via VulDB and is tracked under CVE-2026-86276.
View original advisory →A server-side request forgery (SSRF) vulnerability has been identified in projeto-siga siga up to version 11.1.1. The vulnerability exists in the function DownloadExterno.getUrl within the file ExUtilController.java, part of the HTML-to-PDF Endpoint component. An attacker can manipulate the 'html' argument to trigger SSRF attacks remotely. A public exploit is already available, increasing the risk of active exploitation. The project maintainers were notified via an issue report but have not yet responded or released a patch. The vulnerability is remotely exploitable and poses a significant risk to deployments of the affected software.
View original advisory →A critical command injection vulnerability has been discovered in D-Link DIR-895L firmware version A1_102b07. The flaw exists in the sendACK function within the udhcpcd/serverpacket.c file of the udhcpcd component. An attacker can manipulate the Hostname argument to inject arbitrary commands. The vulnerability is remotely exploitable without physical access to the device. A public exploit has already been released, increasing the risk of active exploitation. The affected component is the DHCP client daemon (udhcpcd), which handles network configuration. This type of vulnerability in home/small business routers poses significant risks to network security. D-Link has been referenced in the advisory, suggesting a vendor patch or advisory may be forthcoming. The issue is tracked under CVE-2026-86295 and has been documented across multiple vulnerability databases including VulDB and NVD.
View original advisory →A vulnerability identified as CVE-2026-86277 has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System version 1.0. The vulnerability resides in the file delete_exam.php, where manipulation of the ID argument leads to an authorization bypass (IDOR/Broken Access Control). The flaw allows remote attackers to bypass access controls and potentially delete exam records without proper authorization. The exploit has been publicly disclosed and is available for use, increasing the risk of active exploitation. The vulnerability is remotely exploitable, requiring no physical access. It has been categorized as an Insecure Direct Object Reference (IDOR) issue. No patch or mitigation has been noted in the article. Users of the affected system are at risk until a fix is applied.
View original advisory →