Overview of incoming advisories.
2186 results found
CISA has published an ICS advisory regarding a critical Missing Authorization vulnerability (CVE-2026-18965) affecting all versions of the PayRange API. The flaw allows remote attackers, authenticated or unauthenticated, to disclose sensitive device information, cause denial of service, or alter displayed images on devices. The vulnerability carries a CVSS v3.1 score of 8.8 (HIGH) and a CVSS v4.0 score of 8.7 (HIGH). All versions of PayRange API are affected, with deployment in the United States and Canada, primarily in the Commercial Facilities critical infrastructure sector. PayRange has not responded to CISA's requests to work on mitigation. Users are advised to contact PayRange support and follow CISA's recommended defensive practices, including minimizing network exposure and using VPNs for remote access. No known public exploitation has been reported at this time. The vulnerability was reported by Tahi Wilton Geary.
View original advisory →CISA published advisory ICSA-26-237-01 regarding a high-severity vulnerability in Rently Smart Home versions 20.1.0 and prior. The flaw, tracked as CVE-2026-75960, involves insufficiently protected credentials (CWE-522), allowing an attacker to retrieve pins including the Master Pin and override standard user permissions. The vulnerability carries a CVSS v3.1 score of 8.1 (HIGH) and a CVSS v4.0 score of 8.7 (HIGH). Affected critical infrastructure sectors include Commercial Facilities, Communications, and Information Technology, with deployment in the United States and India. Rently has patched the vulnerability as of late June 2026 with no user action required. The vulnerability was reported to CISA by Berk Dusunur. No known public exploitation has been reported at this time. Users are advised to minimize network exposure and use VPNs for remote access as additional precautions.
View original advisory →CISA issued an advisory for FURUNO FA-50 Class B AIS Transponder affecting all versions, with two critical/high vulnerabilities. CVE-2026-59769 involves Use of Hard-coded Credentials (CVSS 9.1), allowing attackers with credential knowledge and in-vessel network access to alter device settings. CVE-2026-67578 involves Missing Authentication for Critical Function (CVSS 7.5), enabling configuration changes without authentication. Production of the FA-50 ended in October 2020 and no software patches will be provided. Mitigations include isolating devices from the internet, physically securing vessels, and using VPNs for remote access. The vulnerabilities affect the Transportation Systems critical infrastructure sector and are deployed worldwide. Souvik Kandar reported the vulnerabilities, coordinated through JPCERT/CC and CISA. No known public exploitation has been reported at this time.
View original advisory →CISA published an ICS advisory for the Ebyte NE2-D11 gateway device running firmware FW-9167-0-11, disclosing 11 vulnerabilities with a maximum CVSS v3 score of 9.8 (Critical). The vulnerabilities span missing authentication, cleartext transmission, insufficiently protected credentials, client-side authentication bypass, session hijacking via GET parameters, CSRF, brute-force susceptibility, clickjacking, missing authorization, and cleartext MQTT traffic. Successful exploitation could allow unauthenticated remote attackers to gain administrative access, disclose sensitive information, modify device configuration, hijack authenticated sessions, and disrupt device operation. The affected product is deployed worldwide in Critical Manufacturing and Energy sectors. Ebyte acknowledged the vulnerabilities and indicated a patch was under development but has not responded to subsequent coordination requests, leaving no vendor patch available. CISA recommends network isolation, firewall segmentation, and VPN usage as mitigations. The vulnerabilities were reported by researcher Jithin Nambiar.
View original advisory →Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a critical missing authentication vulnerability (CVE-2026-58115) in the Node-RED HTTP interface. An unauthenticated remote attacker can exploit this flaw to create malicious flows and execute arbitrary code on the underlying server with maximum privileges. The vulnerability received a CVSS v3.1 base score of 10.0 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Affected versions are SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) running versions prior to V4.3.4.1. The vulnerability affects critical infrastructure sectors including Chemical, Critical Manufacturing, Energy, and Transportation Systems worldwide. Siemens has released version V4.3.4.1 as a fix, and interim mitigations include hardening the Node-RED installation or uninstalling Node-RED entirely. The vulnerability was reported by Siemens ProductCERT to CISA.
View original advisory →The Mirage2FA campaign has been active from 2024 to 2026, targeting Microsoft 365 accounts across thousands of companies in the US and EU. The campaign leverages a commercial phishing-as-a-service (PhaaS) toolkit that abuses legitimate Microsoft 365 login flows to bypass two-factor authentication. According to ANY.RUN research, approximately 4,500 companies have been affected, with 48% of targeted email addresses potentially compromised. The majority of affected organizations are US-based. Mirage2FA represents a significant threat due to its ability to circumvent MFA protections, a security control widely relied upon by enterprises. The commercial nature of the toolkit suggests it is being offered to multiple threat actors, amplifying its reach and impact.
View original advisory →Unit 42 from Palo Alto Networks published a comprehensive state-of-the-art report on AI-enabled malware as of August 2026. The report covers the evolution of AI-authored malicious code, ranging from brand abuse tactics to agentic execution frameworks. It examines how threat actors are leveraging AI tools to generate, obfuscate, and deploy malware at scale. The research highlights how existing behavioral detection systems and endpoint analytics can identify and stop AI-generated code before it executes. The article represents a significant industry analysis of the intersection between generative AI capabilities and malware development, signaling a notable shift in the threat landscape.
View original advisory →Attackers are actively exploiting critical vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin. The flaws allow unauthenticated attackers to bypass authentication and sign in as any WordPress user, including administrators. CVE-2026-61979 carries a CVSS score of 8.1 and is classified as an unauthenticated privilege escalation vulnerability. The vulnerabilities were disclosed by Patchstack. Active exploitation attempts have been observed in the wild, making this a high-priority patching concern for WordPress site administrators using this plugin. The flaws are particularly dangerous as they require no prior authentication to exploit, lowering the barrier for attackers significantly.
View original advisory →CISA has added CVE-2026-21962, a maximum-severity vulnerability (CVSS 10.0) affecting Oracle HTTP Server and Oracle WebLogic Server, to its Known Exploited Vulnerabilities catalog. The flaw allows unauthenticated attackers with network access via HTTP to access critical data. Active exploitation has been confirmed in the wild. The vulnerability requires no authentication, making it especially dangerous for internet-facing deployments. Organizations using Oracle WebLogic or Oracle HTTP Server are urged to apply patches immediately per CISA's guidance.
View original advisory →CVE-2026-60004 is a code injection vulnerability in Gitea, a self-hosted Git service. An attacker with repository write access can exploit the diffpatch API endpoint by sending a malicious patch that plants an executable Git hook. This allows the attacker to execute arbitrary shell commands as the Gitea service account, potentially leading to full server compromise. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog under BOD 26-04, which mandates prioritizing security updates based on risk. Federal agencies are required to remediate this vulnerability per BOD 26-04 directives. Forensics triage requirements are also outlined in CISA's implementation guidance. The issue is tracked at NVD and has a dedicated GitHub security advisory.
View original advisory →GitPython versions before 3.1.59 contain a vulnerability where the --separate-git-dir option is omitted from the unsafe_git_clone_options list. This oversight allows attackers to pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() methods, redirecting repository metadata to an attacker-controlled filesystem path. The flaw enables arbitrary directory creation outside the intended clone destination, and could potentially lead to hook execution if the attacker can place malicious git hooks in the redirected directory. The vulnerability is a path traversal-class issue affecting Python projects that use GitPython for git operations. A fix was introduced in GitPython version 3.1.59, and users are advised to upgrade immediately. The issue has been documented in the official GitHub security advisory and tracked by VulnCheck.
View original advisory →CVE-2026-18798 is a double free vulnerability (CWE-415) in the OpenSSL QUIC stack affecting QUIC server implementations. The flaw occurs in port_default_packet_handler() where a QRX (QUIC record layer RX) object is freed twice when port_bind_channel() fails during initial packet processing. This leads to heap corruption and typically results in termination of the QUIC server process, causing Denial of Service. The vulnerability can be triggered with relatively low effort by sending a malformed INITIAL packet with a DCID (destination connection ID) shorter than 8 bytes. While heap corruption is confirmed, remote code execution is considered highly improbable based on current analysis. The FIPS module is not affected as the QUIC implementation resides outside the OpenSSL FIPS module boundary. Patches have been issued via multiple commits to the OpenSSL repository.
View original advisory →GitPython versions before 3.1.59 contain a vulnerability where the library fails to disable merge_includes when parsing .gitmodules files. This allows attackers to craft malicious .gitmodules files containing [include] directives that point to arbitrary local files. When repo.submodules is accessed, GitConfigParser raises a MissingSectionHeaderError that embeds the first line of the targeted file verbatim in the exception message, causing unintended local file content disclosure. The vulnerability can be exploited to expose sensitive files on the host system. A fix is available by upgrading to GitPython 3.1.59 or later. The issue has been documented in both the GitHub Security Advisory and VulnCheck advisories. It is classified as a high-severity information disclosure vulnerability affecting applications that use GitPython to process potentially untrusted repositories.
View original advisory →CVE-2026-55532 affects PraisonAI, a multi-agent teams system, in versions prior to 4.6.58. The vulnerability exists in the MCP HTTP Stream _validate_origin function, which uses a startswith() check to validate request origins against an allowlist. An attacker can craft a malicious origin such as localhost.attacker.com that satisfies the localhost allowlist check due to the flawed string prefix matching. This allows cross-origin requests to be sent without CORS preflight by using Content-Type: text/plain, enabling unauthenticated access to the tools/call API endpoint without an API key. Successful exploitation can lead to unauthorized file writes that persist malicious agent instructions, potentially compromising the integrity of AI agent behavior. The vulnerability has been patched in PraisonAI version 4.6.58.
View original advisory →A heap out-of-bounds read vulnerability exists in OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12. The flaw is in the TypedDeepImageChannel<T>::row() API, which can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin. The root cause is a conflict between two coordinate models in ImfDeepImageChannel: at(x, y) uses absolute coordinates while row(r) is documented as 0-based logical access. For non-zero dataWindow.min values, row(0) points outside the _sampleListPointers allocation, causing a heap out-of-bounds read and potential crash. Under a controlled heap layout, this could lead to information disclosure. The vulnerability affects the EXR image format library widely used in the motion picture industry. Fixes are available in versions 3.3.13 and 3.4.13.
View original advisory →CVE-2026-55585 affects the QWED open-source AI verification package prior to version 5.1.2. The vulnerability stems from passing caller-controlled math expressions directly to SymPy's parse_expr() function without restricted namespaces, enabling arbitrary Python code execution via eval(). Two attack vectors exist: POST /verify/math and POST /verify/batch, both reachable with any valid tenant API key. The default-enabled signup endpoint allows anyone to self-register and obtain an API key, making the vulnerability unauthenticated in practice. Exploitation can lead to file read/write, OS command execution, service termination, and cross-tenant compromise in shared deployments. The issue is fixed in QWED version 5.1.2.
View original advisory →Grav CMS versions before 2.0.16 contain a symlink following vulnerability in the Scheduler Job::createLockFile() function. Local attackers can exploit this by pre-creating symlinks at predictable lock file paths within the world-writable temp directory. When a scheduled job runs, it follows the symlink and overwrites the target file with a job ID string. The attacker can point the symlink to any file writable by the web server process, enabling arbitrary file overwrite. This vulnerability requires local access but can have significant impact on system integrity. The issue has been patched in Grav CMS version 2.0.16. Multiple advisories have been published including on GitHub Security Advisories and VulnCheck.
View original advisory →Crater Invoice through version 6.0.6 contains a critical path traversal vulnerability in its self-update API. Authenticated company owners can exploit this flaw by supplying crafted ZIP archives containing ../ sequences to the unzip endpoint. The vulnerability stems from unsanitized ZIP entry names being passed directly to PHP's ZipArchive::extractTo() function. This allows attackers to write arbitrary files outside the intended extraction directory, including PHP files into web-accessible public directories. Successful exploitation results in remote code execution (RCE) on the server. The vulnerability requires authentication as a company owner, slightly limiting the attack surface but still posing a severe risk in multi-tenant or compromised credential scenarios. Public proof-of-concept and advisories are available, increasing exploitation risk.
View original advisory →A heap out-of-bounds write vulnerability exists in OpenEXR, the reference implementation for the EXR image format used widely in the motion picture industry. The flaw affects versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 on 32-bit/ILP32 builds. A specially crafted tiled EXR file with a small 40x40 dataWindow but an oversized 65537x65537 tile size can trigger the vulnerability through the TiledRgbaInputFile RGBA API. On ILP32 systems, the Array2D tile-conversion buffer size calculation overflows, causing allocation of a much smaller heap buffer than required. Tile decode operations then write past the allocated buffer boundary, resulting in heap memory corruption. The vulnerability has been patched in versions 3.2.11, 3.3.13, and 3.4.14. Exploitation requires an attacker to supply a maliciously crafted EXR file to a vulnerable application running on a 32-bit/ILP32 platform.
View original advisory →CVE-2026-79664 affects Ech0 versions before 4.7.3, where access tokens created with the never-expire option cannot be properly revoked. Three separate revocation mechanisms all fail: the logout function panics on a nil ExpiresAt field, RevokeToken skips revocation when remainTTL is zero, and the admin delete function does not blacklist the JWT ID (JTI). As a result, stolen tokens remain cryptographically valid indefinitely unless the JWT secret is rotated. This allows attackers who obtain a never-expire token to maintain persistent authenticated access to the system. The vulnerability is classified as high severity due to the potential for perpetual unauthorized access. A fix is available in Ech0 version 4.7.3 and later.
View original advisory →