Overzicht van binnengekomen advisories.
2186 resultaten gevonden
The JetFormBuilder Dynamic Blocks Form Builder plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 3.6.2. The flaw stems from the plugin failing to validate that a submitted form ID actually belongs to a JetFormBuilder form before parsing the referenced post content as a form schema and executing Advanced Validation server-side callbacks. This oversight allows unauthenticated remote attackers to exploit the plugin to create new administrator-level user accounts, effectively granting full site control. The vulnerability requires no authentication or special privileges to exploit, making it particularly dangerous for WordPress sites running the affected plugin versions. A patch has been released and is available via the WordPress plugin repository changeset 3575346.
Bekijk origineel advisory →Acronis has disclosed a high-severity local privilege escalation (LPE) vulnerability affecting its backup plugin for cPanel, WebHost Manager (WHM), and Plesk on Linux systems. The flaw is reported to be actively exploited in the wild, raising urgency for affected users to apply patches. The vulnerability allows local attackers to escalate privileges on Linux-based hosting environments. Acronis has issued a warning to users of the affected plugin to update immediately. The issue highlights ongoing risks in third-party backup and hosting management integrations. Hosting providers using Acronis backup solutions with cPanel or Plesk are particularly at risk. No specific CVE identifier was mentioned in the available content snippet.
Bekijk origineel advisory →A threat actor compromised the maintainer's website for the Admin Menu Editor Pro WordPress plugin and pushed malicious updates to over 200 customers. The tampered plugin versions created hidden user accounts, effectively backdooring more than 1,500 WordPress sites. This is a supply chain attack targeting WordPress plugin infrastructure. The attacker leveraged the legitimate update distribution mechanism to propagate the malicious code. Site administrators using the affected plugin versions are at risk of unauthorized administrative access. The attack highlights risks associated with third-party plugin ecosystems and the importance of verifying plugin integrity.
Bekijk origineel advisory →Cybersecurity researchers at Elastic Security Labs have uncovered a previously undocumented Brazilian banking malware operation known as KREMLIN, tracked under the activity cluster REF9334. Active since at least May 2025, the threat actor uses lures impersonating over a dozen Brazilian banks to distribute a malicious browser extension targeting Google Chrome and Microsoft Edge. The malware is designed to hijack browser sessions, steal credentials, and capture session tokens from victims. The toolkit represents a sophisticated threat to Brazilian banking customers and financial institutions. The operation highlights the continued evolution of browser-based credential theft techniques employed by Latin American cybercriminal groups.
Bekijk origineel advisory →Cybersecurity agencies from the United States, United Kingdom, and Netherlands have jointly detailed a Windows-based malware attributed to Iran's intelligence service. The malware is controlled through the Telegram messaging application, enabling covert command and control. It targets dissidents, journalists, and activists globally. Capabilities include copying emails and chat messages, taking screenshots, and activating the microphone to record audio. The operation represents a state-sponsored surveillance campaign against political opponents and civil society members. The use of a legitimate messaging platform like Telegram as a C2 channel helps evade traditional network detection. The joint advisory underscores the international concern over Iranian cyber espionage activities.
Bekijk origineel advisory →Cybersecurity researchers have uncovered a multi-platform malware campaign leveraging the MQTT protocol as a covert command-and-control communication channel. The malware family, dubbed BambooToken, targets both Windows and Linux systems. Active since at least February 2023, the campaign has been observed targeting organizations across Asia and South America. MQTT, typically used in IoT and lightweight messaging scenarios, is being abused to blend malicious traffic with legitimate network communications. The use of MQTT as a C2 channel represents an emerging evasion technique that may bypass traditional network security controls. The campaign's cross-platform capability indicates a sophisticated threat actor with resources to develop and maintain malware for multiple operating systems.
Bekijk origineel advisory →BambooToken is a previously unknown malware framework that has been active since at least 2023. It targets both Windows and Linux systems, using the Message Queuing Telemetry Transport (MQTT) protocol as its command-and-control communication channel. MQTT is typically used in IoT environments, making this an unconventional choice that may help evade traditional network detection tools. The malware represents a cross-platform threat capable of compromising a wide range of enterprise and server environments. Its use of a lightweight messaging protocol suggests the authors are attempting to blend malicious traffic with legitimate IoT or industrial communications. The framework's capabilities and full infection chain are still being investigated, but its dual-OS targeting and protocol abuse make it a notable and potentially high-impact threat.
Bekijk origineel advisory →Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress. The attack allows threat actors to upload a PHP backdoor to compromised WordPress sites. The plugin, designed for WooCommerce-based stores, contains a flaw being leveraged in the wild. This represents an active exploitation campaign targeting WordPress e-commerce installations. Site administrators using the affected plugin are at immediate risk of full site compromise. The backdoor upload capability could grant attackers persistent remote access and control over affected sites. WordPress and WooCommerce site owners are urged to patch or remove the vulnerable plugin immediately.
Bekijk origineel advisory →CISA has issued a warning that ransomware gangs are actively exploiting a critical remote code execution (RCE) vulnerability in VMware vCenter Server. The flaw was patched by VMware in July but continues to be targeted by threat actors. CISA's alert indicates that exploitation has escalated beyond initial attackers to include ransomware groups, significantly raising the threat level. Organizations running VMware vCenter are urged to apply the patch immediately if they have not already done so. The vulnerability allows attackers to execute arbitrary code remotely, potentially giving them full control over affected systems. This type of critical infrastructure exposure is particularly dangerous as vCenter manages virtualized environments at enterprise scale.
Bekijk origineel advisory →CISA issued an advisory for CareCam CM2507 IP cameras running firmware v251211.1507, disclosing seven vulnerabilities. The flaws include missing authentication for live video streaming (CVE-2026-88259), empty password on the ONVIF management service (CVE-2026-84398), an unprotected remote debugging activation mechanism (CVE-2026-84400), arbitrary code execution via unverified removable media scripts (CVE-2026-81305), an unauthenticated physical debug interface exposing the bootloader (CVE-2026-85478), weak password hashing for the root account (CVE-2026-85497), and cleartext storage of wireless credentials (CVE-2026-81321). CVSS v4.0 scores range from 2.3 to 9.3, with two vulnerabilities rated CRITICAL. CareCam has not responded to CISA coordination attempts, leaving no vendor patch available. Users are advised to isolate devices behind firewalls, minimize network exposure, and use VPNs for remote access. No public exploitation has been reported at the time of publication.
Bekijk origineel advisory →Siemens Reyrolle 7SR5 protective relay devices running firmware versions prior to V2.70 are affected by 14 vulnerabilities spanning a wide range of weakness types. The highest severity vulnerability (CVE-2026-62645) carries a CVSS v3 score of 9.8 CRITICAL and allows unauthenticated remote attackers to bypass authentication by calculating session IDs exposed through the web interface. Additional critical issues include insufficient entropy in session ID generation, authentication bypass via alternate paths, out-of-bounds writes causing denial-of-service, and resource exhaustion from unthrottled HTTP requests. Physical access vulnerabilities allow arbitrary unsigned code execution via a maintenance boot mode and memory corruption during firmware update mode. The Cesanta Mongoose Web Server v7.14 component contributes several integer overflow, pointer offset, and delimiter neutralization flaws. The device is deployed worldwide in the Energy critical infrastructure sector. Siemens has released V2.70 to address all vulnerabilities and recommends immediate update. CISA republished this advisory from Siemens ProductCERT SSA-142885 on 2026-09-15.
Bekijk origineel advisory →CISA issued an advisory for Wärtsilä FOS-Onboard version 5.07.0923.01, disclosing two critical vulnerabilities (CVE-2026-78225 and CVE-2026-81855) involving hard-coded cryptographic keys (CWE-321). CVE-2026-78225 affects the deployer-ng Update Controller component with a hardcoded server key, while CVE-2026-81855 affects the robot testing framework with a hardcoded client authentication key. Both vulnerabilities carry CRITICAL CVSS scores (9.0 and 9.1 respectively for CVSS 3.1). Successful exploitation could allow attackers to deliver unauthorized updates, execute code, or extract credentials to impersonate privileged clients. The affected product is deployed worldwide in the Transportation Systems critical infrastructure sector, with Wärtsilä headquartered in Finland. Wärtsilä states vulnerabilities are not exploitable when installed as recommended and has developed a security patch available via direct contact. The vulnerabilities were reported by Cydome Security Ltd. No known public exploitation has been reported at the time of publication.
Bekijk origineel advisory →CISA has issued an advisory for mySCADA myPRO Manager versions 2.1 and below, identifying two critical vulnerabilities. CVE-2026-73807 (CVSS 9.8 Critical) involves missing authorization in the command API, allowing unauthenticated attackers to access privileged management functions. CVE-2026-82567 (CVSS 6.3 Medium) exposes an unauthenticated HTTP endpoint enabling arbitrary SMS messages to be sent via a connected GSM modem. Both vulnerabilities require no authentication and are remotely exploitable. Affected sectors include Critical Manufacturing, Energy, Food and Agriculture, Transportation, and Water/Wastewater systems deployed worldwide. The vendor mySCADA Technologies has released version 2.2 as a fix. No known public exploitation has been reported. Shirshak Secnora OÜ reported these vulnerabilities to CISA.
Bekijk origineel advisory →CISA has published an ICS advisory (ICSA-26-258-01) disclosing six vulnerabilities affecting Digital Watchdog VMAX DVR and NVR product lineups, including VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4 Recorder, and VG4 Recorder (all versions). The vulnerabilities include authentication bypass (CVE-2026-68953), hard-coded credentials enabling root FTP access (CVE-2026-66890, CVE-2026-68950), missing authentication for critical functions allowing root command execution (CVE-2026-68070), missing authorization on state-changing CGIs (CVE-2026-66887), and predictable PRNG seeds leading to guessable session tokens (CVE-2026-66372). The highest CVSS v3.1 score is 9.6 (CRITICAL). Successful exploitation could grant full administrative control, allow viewing of live and recorded surveillance, alter configurations, and use devices as network pivot points. Affected sectors include Commercial Facilities, Government Services, Healthcare, and Transportation. Digital Watchdog has released updated firmware as mitigation. No known active public exploitation has been reported at this time.
Bekijk origineel advisory →Sysdig researchers highlight a case where a skilled human threat actor exploited a remote code execution (RCE) vulnerability in a Marimo notebook to pivot to an SSH bastion host in just eight seconds. The findings underscore that while AI is lowering the barrier for attackers and accelerating exploitation timelines, human operators remain highly capable of rapid post-exploitation movement. The incident demonstrates the speed at which attackers can escalate access after gaining an initial foothold in cloud environments. This research serves as a warning to organizations running Marimo notebooks or similar interactive computing environments about the risks of unpatched RCE vulnerabilities. The case highlights the need for robust lateral movement detection and network segmentation in cloud infrastructures.
Bekijk origineel advisory →A mass-scanning campaign has been identified targeting internet-exposed Vite development servers. Attackers are exploiting a flaw in Vite to extract sensitive cloud credentials and configuration data. The campaign specifically targets Amazon Web Services (AWS) and Microsoft Azure instances. Infrastructure state files are also being siphoned as part of the attack. The operation is automated and designed to scan broadly for exposed Vite dev servers. F5 Labs researchers disclosed the details of this campaign. The attack highlights risks of exposing development servers to the public internet.
Bekijk origineel advisory →A critical vulnerability in LiteSpeed Web Server Enterprise allows a low-privilege hosting account user to escalate privileges and gain root access on a shared hosting server. The flaw was disclosed in a cPanel advisory published on September 14, 2026. Shared hosting environments are particularly at risk since multiple customers share the same physical machine. An attacker exploiting this vulnerability could access, modify, or compromise other customers' websites and the underlying server infrastructure. The severity is high given the potential for cross-tenant compromise and full server takeover from a low-privilege starting point.
Bekijk origineel advisory →CVE-2026-57112 affects PraisonAI multi-agent system versions praisonaiagents 0.6.0 to 1.6.59 and PraisonAI 3.10.0 to 4.6.59. The vulnerability exists in ToolsMCPServer.run_sse() which mounts SseServerTransport on legacy /sse and /messages/ endpoints without Host, Origin, or authentication enforcement. An attacker can exploit this via DNS rebinding against a local or internal SSE server to supply malicious Host and Origin headers. This allows enumeration of registered tools and invocation of them with the server user's privileges. The flaw is isolated to the legacy SSE wrapper, as the Streamable HTTP transport correctly rejects hostile Origins. Remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59. Users should upgrade immediately to the patched versions to mitigate the risk of unauthorized tool invocation.
Bekijk origineel advisory →CVE-2026-45048 affects OpenAM (Open Access Management) versions prior to 16.1.1. The vulnerability exists in the SessionRequestHandler component of the session management endpoint, which fails to enforce ownership or privilege checks. A low-privileged authenticated user who knows a target identity identifier can query and retrieve another user's active session credentials, including those belonging to higher-privileged accounts. This allows the attacker to hijack privileged sessions, potentially leading to full account takeover or privilege escalation. The vulnerability only affects deployments using stateful session storage. The issue has been patched in OpenAM version 16.1.1, with fixes available via the official GitHub repository.
Bekijk origineel advisory →Polyaxon versions through 2.16.4 are vulnerable to server-side template injection (SSTI) due to the use of an unsandboxed Jinja2 templating environment during server-side run preparation. Authenticated users can submit malicious Jinja2 payloads in operation specification fields such as queue, namespace, conditions, presets, or dependencies to achieve arbitrary code execution. The vulnerability is exploited in the context of the scheduler process, which can expose sensitive information including database credentials and service tokens. The flaw originates in the engine.py and sections.py files within the Polyaxon CLI codebase. This issue requires authentication but does not require elevated privileges, making it accessible to any registered user. Successful exploitation could lead to full system compromise, data exfiltration, and lateral movement within the infrastructure. The vulnerability has been documented by VulnCheck and reported via the Polyaxon GitHub issue tracker.
Bekijk origineel advisory →