A vulnerability was determined in UTT HiPER 2610G up to 3.0.0-171107. This impacts the function strcpy of the file /goform/formConfigDnsFilterGlobal. Executing a manipulation of the argument GroupName can lead to buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 8.8 (HIGH)
Synacktiv analyzes recent Linux LPE vulnerabilities (Crackarmor, Copy Fail, Dirty Frag) and demonstrates that traditional defense-in-depth hardening—restrictive setuid binary permissions and kernel module allowlisting—effectively mitigates exploitation chains before patches are available. The article provides practical implementation guidance using dpkg-statoverride and /proc/sys/kernel/modules_disabled to shift from default-allow to default-block posture.
Exodus Intelligence disclosed a use-after-free vulnerability (CVE-2026-23111) in the Linux kernel's nftables subsystem affecting the pipapo set implementation. The flaw exists in the nft_map_catchall_activate() function which incorrectly skips deactivated catchall elements during abort processing, leaving reference counters in an inconsistent state. This enables local privilege escalation from unprivileged user to root on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS; the vulnerability was patched upstream on 5 February 2026.
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. CVSSv3.1 9.3 (CRITICAL)
A vulnerability was detected in Tenda CX12L 16.03.53.12. The impacted element is the function setSchedWifi of the file /goform/openSchedWifi of the component Wi-Fi Schedule Configuration Endpoint. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used. CVSSv3.1 8.8 (HIGH)
A security vulnerability has been detected in Tenda CX12L 16.03.53.12. The affected element is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set of the component Wi-Fi Configuration Endpoint. Such manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. CVSSv3.1 8.8 (HIGH)
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations. CVSSv3.1 8.0 (HIGH)
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations. CVSSv3.1 8.0 (HIGH)
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations. CVSSv3.1 8.0 (HIGH)
A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote. CVSSv3.1 9.8 (CRITICAL)
A vulnerability was found in Tenda HG7HG9 and HG10 300001138_en_xpon. Affected by this issue is the function asp_voip_OtherSet of the file /boaform/voip_other_set of the component Web Management Interface. Performing a manipulation of the argument funckey_transfer results in stack-based buffer overflow. The attack is possible to be carried out remotely. CVSSv3.1 8.8 (HIGH)
Kaspersky researchers tracked interconnected hacktivist groups (4BID, Hakerskii Kit, C.A.S., Goffee) exploiting Microsoft Exchange ProxyShell vulnerabilities across Kazakhstan, UAE, Syria, and Egypt. The attackers deployed a sophisticated toolkit including fd.aspx web shells, legitimate RMM tools (AnyDesk, Panorama9, Dev Tunnels), multiple C2 frameworks (Sliver, Havoc, Mythic, AdaptixC2), a previously undocumented BlackSalt backdoor, and EDR killers using BYOVD techniques. Attack scripts showed signs of AI generation with Ukrainian comments, indicating evolving operational tradecraft beyond traditional political motivation.
WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation. CVSSv3.1 9.8 (CRITICAL)
WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by accessing the ups.php endpoint. Attackers can upload PHP files through the file upload form in the plugin directory to execute arbitrary code on the server. CVSSv3.1 9.8 (CRITICAL)
WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-content/themes/seotheme/mar.php to execute system commands and upload additional files for persistent access. CVSSv3.1 9.8 (CRITICAL)
WinRAR path-traversal vulnerability CVE-2025-8088 (CVSS 8.4), patched in July 2025, continues to be actively exploited by multiple Russia-aligned threat actors including SHADOW-EARTH-066 (UAC-0226) and Earth Dahu (Gamaredon) against Ukrainian targets through April 2026. The flaw exploits NTFS Alternate Data Streams to silently write files outside extraction directories, enabling initial access via email-delivered RAR archives with decoy documents. SHADOW-EARTH-066 has evolved from basic Excel macro droppers with plaintext Telegram exfiltration to sophisticated WinRAR exploit chains delivering an updated GIFTEDCROOK information stealer with in-memory DLL loading, dual-layer RC4 encryption, Chrome App-Bound Encryption bypass, and dedicated C&C infrastructure.
clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation. CVSSv3.1 8.4 (HIGH)
A security vulnerability has been detected in JingDong JD Cloud Box AX6600 4.5.3.r4546. The impacted element is the function set_macfilter of the file /sbin/jdcweb_rpc. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH)
The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is due to the use of `unserialize()` without an `allowed_classes` restriction in the `IdsToCollection::get_ids_from_string()` function, which processes attacker-controlled post meta values without proper validation. This makes it possible for authenticated attackers with Contributor-level access and above to inject a serial CVSSv3.1 8.8 (HIGH)
MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata without basename normalization or path validation. An attacker who controls a filename returned by a remote cloud storage API can include traversal sequences ../ in the filename to cause downloaded conten CVSSv3.1 8.1 (HIGH)
OpenXDMoD is an open framework for collecting and analyzing HPC metrics. An SQL injection vulnerability exists in Open XDMoD versions prior to 10.0.3 that allows an unauthenticated remote attacker to execute arbitrary SQL statements. Exploitation requires no authentication or user interaction and can result in complete compromise of the underlying database. All deployments of Open XDMoD prior to 10.0.3 are impacted. This issue was discovered on 2023-08-03 and patched on 2023- CVSSv3.1 9.8 (CRITICAL) · EPSS 76th percentile
OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Starting in version 9.5.0 and prior to version 11.0.3, an attacker can remotely execute arbitrary system commands on the web server hosting Open XDMoD with the privileges of the web server process. This could allow an attacker to read or modify application data, alter system configuration, or disrupt service availability. All deployments of Open XDMoD versions 9.5.0 through 11.0.2 (inclusive) are impacte CVSSv3.1 9.8 (CRITICAL) · EPSS 14th percentile
Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of `guardrails-ai` (0.10.1) to PyPI. Aany user who installed `guardrails-ai==0.10.1` from PyPI on May 11, 2026 may be affected. Security researchers identified the malicious package within approximately 2 hours of publication, and PyPI quarantined the repository. Based on our telemetry, Guardrails AI maintainers have CVSSv3.1 9.6 (CRITICAL)
A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands. CVSSv3.1 6.0 (MEDIUM) · EPSS 95th percentile
An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). This issue uniquely affects version 17.4.0; earlier software releases are not exposed. CVSSv3.1 6.0 (MEDIUM) · EPSS 95th percentile