The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

More RMM Tools In the Wild

Published: 2026-10-06

Last Updated: 2026-10-06 13:16:02 UTC

by Xavier Mertens (Version: 1)

It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary about ScreenConnect used in the wild (see following item). Today, I found another one.

Same scenario, it started with a phishing email that delivers a fake PDF invoice to the victim ...

Read the full entry: https://isc.sans.edu/diary/More+RMM+Tools+In+the+Wild/33400/

ScreenConnect Client (Ab)used by Attackers

Published: 2026-10-01

Last Updated: 2026-10-01 05:32:13 UTC

by Xavier Mertens (Version: 1)

Threat Actors do not always use top-notch techniques or very complex malware to perform their attacks. Sometimes, they just abuse of existing applications...

I received a very simple phishing email ...

Read the full entry: https://isc.sans.edu/diary/ScreenConnect+Client+Abused+by+Attackers/33388/

TTY Logs and the Data it Captures

Published: 2026-10-04

Last Updated: 2026-10-05 00:15:00 UTC

by Guy Bruneau (Version: 1)

For an experiment, I created a script that parses and send the TTY logs collected from actors or bots activity that run various commands after they successfully login the DShield sensor. Those TTY logs are sent daily at the end of each day to the DShield SIEM to be correlated with all the data.

The following ES|QL query provides a summary of all contab commands matching a TTYLog hash performed by different actors while logged in the sensor over a 90 day period ...

Read the full entry: https://isc.sans.edu/diary/TTY+Logs+and+the+Data+it+Captures/33396/

User Agent Strings Curiosities (2026.10.04)

https://isc.sans.edu/diary/User+Agent+Strings+Curiosities/33394/

YARA-X 1.21.0 Release (2026.10.03)

https://isc.sans.edu/diary/YARAX+1210+Release/33392/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

CVE-2026-104286 - Fortinet FortiMail Path Traversal Vulnerability

Product: Fortinet FortiMail

CVSS Score: 9.8

** KEV since 2026-10-01 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286

ISC Podcast: https://isc.sans.edu/podcastdetail/10122

NVD References: https://fortiguard.fortinet.com/psirt/FG-IR-26-175

CVE-2026-76504 - Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Product: Cisco Catalyst SD-WAN Manager

CVSS Score: 9.8

** KEV since 2026-09-30 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504

ISC Podcast: https://isc.sans.edu/podcastdetail/10118

NVD References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU

CVE-2026-86950 - Apple Multiple Products Out-of-Bounds Write Vulnerability

Product: Multiple Apple Products

CVSS Score: 0

** KEV since 2026-09-29 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86950

ISC Podcast: https://isc.sans.edu/podcastdetail/10114

CVE-2026-88779 - Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Product: Citrix NetScaler

CVSS Score: 0

** KEV since 2026-10-04 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779

ISC Podcast: https://isc.sans.edu/podcastdetail/10124

CVE-2026-102489 - Zammad GmbH Zammad Session Fixation Vulnerability

Product: Zammad

CVSS Score: 9.8

** KEV since 2026-10-02 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489

NVD References:

- https://csirt.divd.nl/CVE-2026-102489

- https://csirt.divd.nl/DIVD-2026-00015

CVE-2026-102490 - Zammad GmbH Zammad Improper Privilege Management Vulnerability

Product: Zammad

CVSS Score: 9.8

** KEV since 2026-10-02 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490

NVD References:

- https://csirt.divd.nl/CVE-2026-102490

- https://csirt.divd.nl/DIVD-2026-00015

CVE-2015-3246 - Red Hat Libuser Race Condition Vulnerability

Product: Red Hat Libuser

CVSS Score: 0** KEV since 2026-08-26 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3246

CVE-2026-64849 - MLflow Server-Side Request Forgery Vulnerability

Product: MLflow

CVSS Score: 0

** KEV since 2026-08-19 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849

CVE-2026-42018 - JFrog Artifactory Improper Authentication Vulnerability

Product: JFrog Artifactory

CVSS Score: 0

** KEV since 2026-09-11 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018

CVE-2026-90970 - GitLab AI Gateway has fixed a vulnerability that could have allowed an authenticated user to execute arbitrary commands via a crafted flow configuration.

Product: GitLab AI Gateway

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90970

ISC Podcast: https://isc.sans.edu/podcastdetail/10122

NVD References: https://gitlab.com/gitlab-org/gitlab/-/work_items/628842

CVE-2026-102255 through CVE-2026-102258 - Multiple vulnerabilities in SonicWall SMA1000 Series Appliances Product: SonicWall SMA1000 Series Appliances CVSS Scores: 5.5 - 10.0 NVD: https://nvd.nist.gov/vuln/detail/cve-2026-102255

NVD: https://nvd.nist.gov/vuln/detail/cve-2026-102256

NVD: https://nvd.nist.gov/vuln/detail/cve-2026-102257

NVD: https://nvd.nist.gov/vuln/detail/cve-2026-102258 ISC Podcast: https://isc.sans.edu/podcastdetail/10126 References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

CVE-2026-57941 - Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

Product: Apache HTTP Server

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-57941

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57941

NVD References: https://httpd.apache.org/security/vulnerabilities_24.html

CVE-2026-56154 - Apache HTTP Server's mod_rewrite is vulnerable to Use After Free when using lookahead, impacting versions 2.4.0 through 2.4.68.

Product: Apache HTTP Server

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56154

NVD References: https://httpd.apache.org/security/vulnerabilities_24.html

CVE-2026-59797 - Apache HTTP Server is vulnerable to improper privilege management through mod_ssl, allowing attackers to bypass access controls via SSLRequire and file-related expressions.

Product: Apache HTTP Server

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59797

NVD References: https://httpd.apache.org/security/vulnerabilities_24.html

CVE-2026-77185 - Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 allow for authentication bypass in sshd-core due to a logic error in the implementation of "asynchronous authentication" for SSH servers.

Product: Apache MINA SSHD

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77185

NVD References: https://lists.apache.org/thread.html/t8pn812yq8ndokxyfxztg8tovov1284n

CVE-2026-94052 - Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 are vulnerable to a missing check in LdapPasswordAuthenticator in component sshd-ldap, allowing authentication checks to be bypassed.

Product: Apache MINA SSHD

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94052

NVD References: https://lists.apache.org/thread.html/qch5kdwwms13y6bylb7c6qqzq718wn24

CVE-2026-94053 - Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 are vulnerable to authentication bypass via LDAP injection in the sshd-ldap component.

Product: Apache MINA SSHD

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94053

NVD References: https://lists.apache.org/thread.html/cyrxkdzl3c70rrqs3klqphqz1hwm7p41

CVE-2026-88920 - Apache WSS4J is vulnerable to an authentication bypass in its DOM security processor, allowing unauthenticated attackers to forge authenticated SOAP messages using a crafted unsigned SAML sender-vouches assertion.

Product: Apache WSS4J

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-88920

NVD References: https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9

CVE-2026-87830 - The StAX streaming WS-SecurityPolicy validator allows for certain XPath expressions that can lead to missing signature or encryption in SOAP messages, necessitating an upgrade to versions 4.0.2, 3.0.6, or 2.4.4.

Product: Apache WSS4J

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-87830

NVD References: https://lists.apache.org/thread.html/lwlozb1x20d16f9dnyvoygc9rrhzq2vn

CVE-2026-89238 - WSS4J vulnerability allows attacker-controlled plaintext element decryption, leading to policy bypass; upgrade to secure versions 4.0.2, 3.0.6, or 2.4.4 advised.

Product: Apache WSS4J

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89238

NVD References: https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w

CVE-2026-91012 - "org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties) allows a manager-role user to write attacker-controlled content to any file the Karaf process can write."

Product: Apache Karaf

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91012

NVD References: https://lists.apache.org/thread/op8trtz1qxkdwj2rjozhd9yt2yd6nhw4

CVE-2026-91048 - The jdbc shell command scope in Karaf allows authenticated shell users, including those with only the viewer role, to run jdbc commands leading to privilege escalation and potential remote code execution.

Product: Apache Karaf

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91048

NVD References: https://lists.apache.org/thread/ph3867mxh2tft75w0o1hpn10f5mbmw32

CVE-2026-96940 - Microsoft Exchange Server Elevation of Privilege Vulnerability

Product: Microsoft Exchange Server

CVSS Score: 8.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96940

ISC Podcast: https://isc.sans.edu/podcastdetail/10124

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940

CVE-2026-100758, CVE-2026-100760, CVE-2026-100762, CVE-2026-100763, CVE-2026-100770, CVE-2026-100775, CVE-2026-100778, CVE-2026-100781, CVE-2026-100786, CVE-2026-100787, CVE-2026-100788, CVE-2026-100794, CVE-2026-100800, CVE-2026-100804, CVE-2026-100810, CVE-2026-100811, CVE-2026-100818, CVE-2026-100819, CVE-2026-100828, CVE-2026-100829 - Multiple vulnerabilities in Mozilla Firefox, Thunderbird, and other related products

Product: Mozilla Firefox and Thunderbird

CVSS Scores: 9.1 - 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100758 (improper access control)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100760 (protection mechanism failure)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100762 (use-after-free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100763 (incorrect boundary conditions)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100770 (use-after-free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100775 (protection mechanism failure)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100778 (use-after-free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100781 (incorrect boundary conditions)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100786 (use-after-free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100787 (improper inout validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100788 (access of uninitialized pointer)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100794 (incorrect boundary conditions)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100800 (use-after-free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100804 (use-after-free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100810

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100811 (use-after-free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100818 (use-after-free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100819 (incorrect boundary conditions)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100828 (mitigation bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100829 (mitigation bypass)

NVD References:

- https://www.mozilla.org/security/advisories/mfsa2026-97/

- https://www.mozilla.org/security/advisories/mfsa2026-98/

- https://www.mozilla.org/security/advisories/mfsa2026-99/

- https://www.mozilla.org/security/advisories/mfsa2026-100/

- https://www.mozilla.org/security/advisories/mfsa2026-101/

- https://www.mozilla.org/security/advisories/mfsa2026-102/

- https://www.mozilla.org/security/advisories/mfsa2026-103/

CVE-2026-102095, CVE-2026-102102 through CVE-2026-102106, CVE-2026-102149 - Multiple vulnerabilities in Kiteworks Email Protection Gateway.

Product: Kiteworks Email Protection Gateway

CVSS Scores : 9.1 - 9.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102095 (server-side request forgery)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102102 (server-side request forgery)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102103 (server-side request forgery)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102104 (server-side request forgery)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102105 (server-side request forgery)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102106 (improper authentication)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102149 (missing authentication for critical function)

NVD References:

- https://github.com/kiteworks/security-advisories/security/advisories/GHSA-f252-4w8q-g74g

- https://github.com/kiteworks/security-advisories/security/advisories/GHSA-jxv9-v53f-c79m

- https://github.com/kiteworks/security-advisories/security/advisories/GHSA-p435-6c3j-4gh5

- https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mqw3-m87w-4fx4

- https://github.com/kiteworks/security-advisories/security/advisories/GHSA-hq47-4whq-9hgv

- https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wwv8-qhqg-4q76

- https://github.com/kiteworks/security-advisories/security/advisories/GHSA-c9w5-4frw-7wqq

CVE-2026-102115, CVE-2026-102147 - Vulnerabilities in Kiteworks Core

Product: Kiteworks Core

CVSS Scores: 9.3 - 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102115 (password reset bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102147 (cross-site scripting)

NVD References:

- https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q76w-qv9j-q639

- https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xgh2-fgj6-w93r

CVE-2026-8065, CVE-2026-8066 - Vulnerabilities in Hitachi Energy RTU500 end-of-life versions

Product: Hitachi Energy RTU500 EoL versions

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-8065 (authentication bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-8066 (directory traversal)

NVD Reference: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&DocumentPartId=&Action=Launch

CVE-2026-82824, CVE-2026-82825, CVE-2026-82827, CVE-2026-82829 - Multiple vulnerabilities in Hitachi Coding Software Suite through 3.3.0.

Product: Hitachi Coding Software Suite

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82824 (path traversal)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82825 (missing authentication for critical function)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82827 (hard-coded cryptographic key)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82829 (hidden functionality)

NVD Reference: https://www.hitachi-ies.com/common/documents/vulnerability/hcss/Hitachi_Coding_Software_Suite_Public_statement_20260925_EN.pdf

CVE-2026-77177 - Open GenAI Stack (aka ogx-ai) 2026-06-11 allows code execution through prompt injection, enabling server-side expression evaluation without sanitization in Meta AI backend for WhatsApp and other products.

Product: Meta Open GenAI Stack

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77177

CVE-2026-84436 - IBM Guardium Data Protection 12.2 is vulnerable to command injection in certificate export, enabling a CLI user to execute arbitrary commands with root privileges.

Product: IBM Guardium Data Protection

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-84436

NVD References: https://www.ibm.com/support/pages/node/7288040

CVE-2026-76721 through CVE-2026-76725 - Multiple vulnerabilities in HPE Networking Instant ON

Product: HPE Networking Instant ON

CVSS Scores: 9.6 - 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76721 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76722 (uncontrolled format string)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76723 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76724 (command injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76725 (authentication bypass)

NVD References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05150en_us&docLocale=en_US

CVE-2026-103040 - Deserialization of untrusted data vulnerabilities in LightLLM through 1.2.0

Product: LightLLM

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103040

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103041

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103395

NVD References:

- https://github.com/ModelTC/LightLLM/issues/1597

- https://github.com/ModelTC/LightLLM/issues/1596

- https://github.com/ModelTC/LightLLM/issues/1610

CVE-2026-103110 - Pexip Infinity before version 38.2 allows remote attackers to execute code as an unprivileged user.

Product: Pexip Infinity

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103110

NVD References: https://docs.pexip.com/admin/security_bulletins.htm

CVE-2026-102427 - Joomla Extension - ordasoft.com - is vulnerable to unauthenticated remote code execution via a file upload path that lacks proper extension validation.

Product: Ordasoft Joomla_Cck

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102427

NVD References: https://www.ordasoft.com/

CVE-2026-101127 - Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 allows attackers to execute cross-site scripting by storing malicious file names.

Product: Balbooa Forms

CVSS Score: 9.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-101127

NVD References: https://www.balbooa.com/

CVE-2026-102425 - Joomla Extension - balbooa.com - is vulnerable to unauthenticated remote code execution through field shortcode injection in Balbooa Forms < 2.4.3.4.

Product: Balbooa Forms

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102425

NVD References: https://www.balbooa.com/

CVE-2026-76570 - Joomla Extension - JCTables 1.21.1 by joomcode.com is susceptible to unauthenticated SQL injection due to lack of input validation and authentication checks, allowing attackers to manipulate read and write queries.

Product: Joomcode Jc Tables

CVSS Score: 9.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76570

NVD References:

- https://www.joomcode.com/

- https://www.vulncheck.com/blog/jctables-unauthenticated-sql-rw-to-rce

CVE-2025-41753 - BACnet File Object's object name vulnerability allows unauthenticated remote attackers to read or overwrite arbitrary files on the device, potentially leading to full system compromise.

Product: BACnet

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-41753

NVD References: https://www.certvde.com/en/advisories/VDE-2025-102/

CVE-2026-103244 - The ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL and take over the application.

Product: ground-station

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103244

NVD References: https://github.com/sgoudelis/ground-station/security/advisories/GHSA-3mqj-q84c-crjq

CVE-2026-79898 - Fortra BoKS Manager is vulnerable to command injection in crlserver, allowing an authenticated user to execute shell commands as root.

Product: Fortra BoKS Manager

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-79898

NVD References: https://www.fortra.com/security/advisories/product-security/fi-2026-015

CVE-2026-12627 - Fortra's Core Privileged Access Manager (BoKS) is vulnerable to a stack-based buffer overflow in boks_autoregisterd, allowing a remote attacker to trigger memory corruption.

Product: Fortra Core Privileged Access Manager

CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-12627

NVD References: https://www.fortra.com/security/advisories/product-security/fi-2026-017

CVE-2026-96658 - Foreman is vulnerable to remote code execution by authenticated attackers with low-level permissions due to flaws in the safemode sandbox within the templating engine.

Product: Foreman

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96658

CVE-2026-84154 - GEOVIA Geospatial Data Manager is vulnerable to code injection from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x, enabling server-side code execution by attackers.

Product: Dassault Systèmes GEOVIA Geospatial Data Manager

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-84154

NVD References: https://www.3ds.com/trust-center/security/security-advisories/cve-2026-84154

CVE-2026-82973 - psyb0t/docker-mailbox before 0.4.13 is vulnerable to injection of additional IMAP commands by a remote unauthenticated attacker when bearer-token authentication is not configured.

Product: psyb0t docker-mailbox

CVSS Score: 9.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82973

CVE-2026-100240 - Mediawiki - TemplateSandbox Extension before version 1.46.1, 1.45.5, and 1.43.10 allows unauthorized access to functionality not restricted by ACLs.

Product: Mediawiki

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100240

NVD References: https://gerrit.wikimedia.org/r/q/Iaf9f6e2280798af5516197257ddc0264b9ad9fb7

CVE-2026-100291 - Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4 allows unauthorized access to sensitive device operations due to lack of authentication enforcement on ONVIF service endpoints.

Product: Anjvision YSSD‑RTMP‑H5

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100291

NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05

CVE-2026-96587 - The Viidure Android application stores plaintext cloud storage credentials in its code, granting unrestricted access to vital platform storage.

Product: Viidure Android application

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96587

NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-07

Multiple vulnerabilities in Google Chrome

Product: Google Chrome

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95277 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95284 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95299 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95310 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95311 (free of memory not on the heap)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95313 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95325 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95329 (out of bounds write)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95331 (out of bounds write)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95339 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95347 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95356 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95357 (out of bounds write)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102304 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102306 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102308 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102309 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102316 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102331 (heap-based buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103626 (incorrect authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103628 (out of bounds write)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103630 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95281 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95283 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95318 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95349 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95350 (buffer overflow)

NVD References:

- https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html

- https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html

- https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html

CVE-2026-63713, CVE-2026-68068, CVE-2026-68954, CVE-2026-70356, CVE-2026-71379, CVE-2026-72507, CVE-2026-72510 - Multiple vulnerabilities in Toptech TMS7 and TopHAT

Product: Toptech TMS7 and TopHAT

CVSS Scores: 9.0 - 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63713 (SQL injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68068 (SQL injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68954 (SQL injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70356 (unrestricted upload of file with dangerous type)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-71379 (files or directories accessible to external parties)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72507 (SQL injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72510 (SQL injection)

NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02

CVE-2026-103044 - Mediawiki - EasyTimeline extension is vulnerable to XML injection, allowing attackers to manipulate XML data within Wikimedia Foundation's platform.

Product: The Wikimedia Foundation Mediawiki - EasyTimeline extension

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103044

CVE-2026-86131 - WatchGuard Fireware OS is vulnerable to code injection in the BOVPN Over TLS client configuration, allowing remote VPN server control for arbitrary root commands execution.

Product: WatchGuard Fireware OS

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86131

NVD References: https://psirt.watchguard.com/CVE-2026-86131

CVE-2026-86102 - WatchGuard AP is susceptible to OS command injection, enabling a network attacker to run arbitrary shell commands on the OS.

Product: WatchGuard AP

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86102

ISC Podcast: https://isc.sans.edu/podcastdetail/10118

CVE-2026-92173 - Meta Horizon OS prior to v74.0.0.878.1682 allows an arbitrary application to impersonate com.oculus.vrshell and other key-signed packages via a vulnerable PendingIntent in MediaSyncJobReceiver.

Product: Meta Horizon OS

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92173

CVE-2026-103248 - n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode allowing attackers to manipulate table data.

Product: n8n

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103248

NVD References: https://github.com/n8n-io/n8n/security/advisories/GHSA-xrqg-3xcp-h45x

CVE-2026-103255 - n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 are vulnerable to a path traversal issue in the Supabase node, allowing attackers to access and modify data through the administrative serviceRole key.

Product: n8n

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103255

NVD References: https://github.com/n8n-io/n8n/security/advisories/GHSA-rqch-9jrh-cr8w

CVE-2026-103264 - Fleet versions before 4.87.0 have an authentication bypass vulnerability allowing unauthenticated attackers to impersonate iOS/iPadOS hosts and perform unauthorized actions on devices.

Product: Fleet

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103264

NVD References: https://github.com/fleetdm/fleet/security/advisories/GHSA-vrc8-2wcx-327f

CVE-2026-96659 - Foreman allows authenticated low-level users to disclose sensitive data and potentially execute arbitrary commands by exploiting a vulnerability in template preview endpoints.

Product: Foreman

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96659

CVE-2026-103922 - Capacitor's Android and iOS WebView navigation guard vulnerability allows an attacker to fetch and return a malicious URL response, leading to potential same-origin storage access.

Product: Capacitor

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103922

CVE-2026-104056 - Authlib version 1.7.2 and below is vulnerable to cache poisoning, allowing an attacker to replace endpoint values with their own.

Product: Authlib

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104056

CVE-2026-51886 - Langflow-ai langflow v1.9.3 is affected by a code injection vulnerability allowing an authenticated attacker to execute arbitrary Python code.

Product: Langflow-ai

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-51886

CVE-2026-86345 - 389-ds-base is vulnerable to an on-path attacker injecting a crafted LDAP message during StartTLS negotiation, causing authentication attempts to be incorrectly treated as successful.

Product: Red Hat 389-ds-base

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86345

NVD References: https://access.redhat.com/security/cve/CVE-2026-86345

CVE-2026-103648 - Image-downloader 4.3.0 is vulnerable to path traversal, allowing an attacker to write downloaded response data outside of the destination directory.

Product: image-downloader

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103648

CVE-2026-51898 - sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.

Product: sinaptik-ai pandas-ai

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-51898

CVE-2026-84411 - RouterOS web management service in affected versions contains an integer underflow vulnerability that allows unauthenticated network attackers to execute arbitrary code or cause denial of service with a single crafted request.

Product: Mikrotik RouterOS

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-84411

ISC Podcast: https://isc.sans.edu/podcastdetail/10116

Linux Kernel Vulnerabilities

On July 19th and 20th, the Linux kernel project released patches for 432 different vulnerabilities. Many, if not all, of these vulnerabilities were discovered and fixed using AI tools. @Risk will not enumerate these vulnerabilities individually. Linux distributions will include these patches in future kernel updates. The Linux kernel team does not prioritize patches, and takes a quite liberal approach as to what it considers a vulnerability. For more details regarding the Linux kernel’s policy on assigning CVEs see: http://www.kroah.com/log/blog/2026/02/16/linux-cve-assignment-process/