Overzicht van binnengekomen advisories.
2179 resultaten gevonden
A new malware family called SynkLoader is being distributed through phishing campaigns targeting Microsoft Teams users. The malware uses a fake lock screen to steal victim credentials. The campaign represents a previously unknown malware family, suggesting a new threat actor or toolset. Microsoft Teams is being exploited as a delivery vector, likely leveraging its widespread enterprise adoption. The attack methodology involves social engineering through Teams messages to lure users into interacting with the malicious payload. Credential theft via fake lock screens is a classic but effective technique adapted for the Teams platform. Organizations using Microsoft Teams should be vigilant about unsolicited messages and unexpected authentication prompts.
Bekijk origineel advisory →Check Point Research has disclosed a technique leveraging Microsoft Defender's legitimately signed boot-time remediation driver (BTR.sys) to perform arbitrary kernel-level file and registry operations on Windows systems. The technique affects Windows versions from Windows 7 through Windows 11 25H2. No software vulnerability is exploited and no external driver is required, making this a living-off-the-land attack using a trusted Microsoft-signed component. The driver, known as Boot Time Removal Tool (BTR.sys), can be weaponized to delete security software or other files at boot time. This represents a significant threat as it abuses a trusted, signed Microsoft component to bypass security controls.
Bekijk origineel advisory →CISA has issued a directive ordering U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in TrueConf Server, a self-hosted communications platform. The vulnerabilities are being actively exploited in the wild, prompting CISA to add them to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies are required to remediate the flaws within a specified deadline under Binding Operational Directive 22-01. TrueConf Server is used for self-hosted video conferencing and team messaging, making it a potentially high-value target. The active exploitation underscores the urgency for both federal and private sector organizations to apply available patches immediately.
Bekijk origineel advisory →Microsoft has patched a maximum-severity vulnerability in Entra ID, its identity and access management (IAM) platform. The vulnerability has been actively exploited in attacks. Entra ID is a critical cloud-based identity service used by enterprises worldwide. The flaw represents a significant risk given the central role Entra ID plays in authentication and authorization workflows. Microsoft has issued a patch and is warning customers to apply it immediately. The exploitation of this flaw in the wild elevates its urgency to the highest level. Organizations relying on Entra ID for access management should prioritize remediation. No further CVE identifier was extracted from the available content snippet.
Bekijk origineel advisory →Threat actors are exploiting FTP server banners as a covert channel to hide and deliver malicious commands. The campaign introduces two previously undocumented remote access trojans named E4del and PINHOLE. By abusing FTP banners, attackers can blend malicious activity within legitimate network traffic, making detection more difficult. This technique represents a novel delivery mechanism for malware distribution targeting Windows systems. The use of two distinct RATs suggests a sophisticated, multi-stage operation. The discovery highlights an emerging trend of abusing legitimate protocol features for command delivery.
Bekijk origineel advisory →Cisco has released security updates addressing nine vulnerabilities across its Crosswork platforms and Secure Workload Software, discovered as part of an ongoing internal security review. Five of the nine vulnerabilities carry a maximum CVSS score of 10.0, indicating critical severity. Four of the flaws affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning regardless of device configuration. The patches are part of a continued comprehensive internal audit of Cisco products. The vulnerabilities pose significant risk due to their critical scoring and broad impact across multiple Crosswork platform components. No specific CVE identifiers or exploitation details are provided in the article excerpt. Organizations using affected Cisco Crosswork and Secure Workload products are urged to apply the patches immediately. The breadth of affected products and the maximum CVSS scores highlight the severity of this security update round.
Bekijk origineel advisory →A critical security vulnerability in GitLab, tracked as CVE-2026-19478 with a CVSS score of 9.4, has come under active exploitation within days of its public disclosure. The flaw is a code injection vulnerability that allows unauthenticated attackers to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions. The exploitation activity was reported by watchTowr. The severity of the vulnerability is underscored by the fact that no authentication is required to exploit it, making it accessible to a wide range of threat actors. The rapid weaponization of this vulnerability highlights the ongoing challenge organizations face in patching critical flaws before attackers can leverage them. GitLab users and administrators are urged to apply available patches immediately to mitigate potential damage.
Bekijk origineel advisory →Microsoft disclosed a maximum-severity vulnerability in Microsoft Entra ID (formerly Azure Active Directory), tracked as CVE-2026-69836 with a CVSS score of 10.0. The flaw allows remote code execution on the cloud-based identity and access management service. Microsoft confirmed the vulnerability has been actively exploited in the wild. Despite active exploitation, Microsoft stated that no customer action is required to remediate the issue. The vulnerability affects a widely used enterprise identity platform, making it a critical risk for organizations relying on Microsoft's cloud identity services.
Bekijk origineel advisory →Zimbra Collaboration Suite (ZCS) contains a critical OS command injection vulnerability tracked as CVE-2026-73570. An unauthenticated attacker can exploit this flaw by sending specially crafted SMTP requests, potentially resulting in arbitrary operating system command execution as the Zimbra user. The vulnerability requires no authentication, making it especially dangerous in internet-exposed deployments. CISA has flagged this under BOD 26-04, which prioritizes security updates based on risk. Zimbra has released a patch in version 10.1.20 to address the issue. Organizations are urged to apply the patch immediately and review Zimbra Security Advisories for further guidance. Forensics triage requirements have also been outlined by CISA for affected systems. The vulnerability is listed in the NVD and carries a high criticality rating.
Bekijk origineel advisory →A critical deserialization of untrusted data vulnerability has been identified in Microsoft Entra ID, formerly known as Azure Active Directory. The vulnerability allows an unauthorized attacker to execute arbitrary code over a network without authentication. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. The flaw is tracked as CVE-2026-69836 and is documented in both the Microsoft Security Response Center and the NVD. Organizations using Microsoft Entra ID are urged to apply available security patches immediately. Forensic triage requirements have also been outlined by CISA as part of the BOD 26-04 implementation guidance. The vulnerability poses a significant risk to identity and access management infrastructure relying on Microsoft cloud services.
Bekijk origineel advisory →CVE-2026-62675 affects Omnigent, an open-source AI agent framework for orchestrating coding agents, in versions prior to 0.3.0. The vulnerability exists in the multipart POST /v1/sessions endpoint, where the validate_agent_bundle function in bundles.py fails to reject arbitrary dotted Python paths in the tools callable field. The tool dispatch module resolves and invokes the specified callable, allowing an authenticated user to specify subprocess.check_output or similar dangerous functions. This enables arbitrary local command execution with the permissions of the runner process. Exploitation can expose sensitive data including environment variables, credentials, workspace files, and internal services. The flaw requires only authenticated user access, not administrator privileges, lowering the barrier for exploitation. The issue has been patched in Omnigent version 0.3.0 via input validation on the callable path.
Bekijk origineel advisory →CVE-2026-77810 describes a vulnerability in the AWS Athena Federated Query Neptune connector where an authorized user could gain unauthorized access to Lambda function properties supplying compute for the connector. This represents a privilege escalation/information disclosure risk within the AWS cloud environment. The flaw affects the aws-athena-query-federation component and could expose sensitive configuration or credential data stored in Lambda properties. AWS has issued a security bulletin (2026-087) addressing this issue. The remediation requires upgrading to aws-athena-query-federation version v2026.30.1 or later. A GitHub security advisory (GHSA-v7c2-5wfg-qg44) has also been published alongside the fix release.
Bekijk origineel advisory →CVE-2026-48751 affects Incus, a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots fail to enforce the restricted.containers.lowlevel=block security setting. This bypass allows attackers to abuse low-level hooks such as raw.lxc and raw.qemu to achieve arbitrary command execution on the Incus server. The vulnerability poses a significant risk in multi-tenant or restricted environments where low-level container access is explicitly blocked. Version 7.2.0 resolves the issue with a patch. Users are advised to upgrade immediately to mitigate the risk.
Bekijk origineel advisory →Paperclip versions before 0.3.1 are vulnerable to remote code execution via DNS rebinding attacks when running in the default local_trusted mode. The vulnerability stems from a failure to validate Host headers, allowing attackers to bypass security controls. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, leverages DNS rebinding to make authenticated API requests. These requests can then execute arbitrary commands through Paperclip's process adapter. The attack targets developers running Paperclip in local development environments. The fix was introduced in version 0.3.1. This type of attack is particularly dangerous as it exploits the trusted local environment assumption. Developers should upgrade to version 0.3.1 or later immediately to mitigate the risk.
Bekijk origineel advisory →CVE-2026-77264 describes a critical authentication bypass vulnerability in the Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress, affecting versions up to and including 4.8.6. The vulnerability exists in the handle_email_otp_return() function, which incorrectly returns the secret magic login token directly in the HTTP response to a publicly accessible OTP request, instead of delivering it exclusively to the user's email. This design flaw allows unauthenticated attackers to capture the token and use it to log in as any registered user on the site, including administrators, as long as they know the target's email address. The attack requires no prior authentication and can lead to full site compromise. Site owners using the affected plugin versions are urged to update immediately to a patched version.
Bekijk origineel advisory →CVE-2026-54457 affects TensorZero, an open-source LLMOps platform, prior to version 2026.6.0. The vulnerability exists in the /internal/object_storage endpoint, which accepts a caller-supplied JSON storage_path parameter that can override the object storage configuration. Attackers can exploit the filesystem storage type to read arbitrary files from the gateway filesystem, including sensitive credential files. The s3_compatible storage type can be abused to trigger server-side request forgery (SSRF) against internal or cloud metadata endpoints such as AWS IMDS. Exploitation depends on whether the gateway is deployed with or without authentication, making the attack surface variable. The vulnerability combines arbitrary file read and SSRF primitives, posing significant risk in cloud-hosted deployments. A fix was released in version 2026.6.0. Patches and advisories are available via the official GitHub repository.
Bekijk origineel advisory →CVE-2026-77236 is a vulnerability in FreeRTOS-Kernel versions prior to 11.3.1 involving missing minimum size validation in secure context allocation. The flaw may allow local users to corrupt secure-world heap metadata through an out-of-bounds write triggered by supplying an undersized stack size parameter. This affects the secure context allocation mechanism, potentially impacting systems relying on FreeRTOS TrustZone or secure-world isolation. The vulnerability is classified as a local privilege or integrity issue, as it requires local access to exploit. AWS has published a security bulletin acknowledging the issue. The fix is available in FreeRTOS-Kernel version 11.3.1 and later. Users and organizations using affected versions are strongly advised to upgrade immediately to remediate the risk.
Bekijk origineel advisory →CVE-2026-48752 affects Incus, a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be leveraged to read or create/write arbitrary files on the host system. This path traversal-style vulnerability could potentially lead to arbitrary command execution on the host. The vulnerability is exploitable via malicious container images or instance backups. Version 7.2.0 has been released to patch the issue. Users are advised to upgrade to version 7.2.0 or later to mitigate the risk. The severity is high given the potential for host-level compromise from within a container context.
Bekijk origineel advisory →CVE-2026-62940 affects Incus, a system container and virtual machine manager, in versions prior to 7.3.0. The vulnerability exists in the instance migration process between cluster members, where user-supplied configuration overrides are applied without enforcing project restriction policies. Security-critical configuration keys such as `security.privileged` and `raw.lxc` can be manipulated by restricted project users during migration. This allows an attacker to escalate privileges to a privileged container and subsequently escape to the underlying host system. The flaw represents a container escape vulnerability with significant impact on multi-tenant cluster environments. Version 7.3.0 of Incus addresses and patches this issue. Users running Incus in clustered configurations with restricted project users are at elevated risk.
Bekijk origineel advisory →Combodo iTop, a web-based IT service management tool, contains a vulnerability prior to version 3.2.3 where inline images accessible without authentication are protected only by a weak 24-bit pseudo-random secret. This weak randomness could allow an attacker to brute-force or predict the secret and gain unauthorized access to inline images. The vulnerability affects all versions of iTop prior to 3.2.3. The issue has been patched in version 3.2.3. The fix is available via a commit on the official GitHub repository. No authentication is required to exploit this vulnerability, increasing its risk surface. Organizations using iTop for IT service management should upgrade to version 3.2.3 immediately. The vulnerability is tracked as CVE-2026-27490 and has a GitHub Security Advisory associated with it.
Bekijk origineel advisory →