Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via the Ringtone upload function. CVSSv3.1 9.9 (CRITICAL) · EPSS 55th percentile
Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials. This issue affects Panel: before v2.3.24. CVSSv3.1 9.8 (CRITICAL) · EPSS 48th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Panel allows Command Line Execution through SQL Injection. This issue affects Panel: before v2.3.24. CVSSv3.1 8.8 (HIGH) · EPSS 46th percentile
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_set_path_size() If smb2_compound_op() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() before retrying it as the reference of @cfile was already dropped by previous call. This fixes the following KASAN splat when running fstests generic/013 against Windows Server 2022: CIFS: Attempting to mount //w22-fs0/scratch CVSSv3.1 9.8 (CRITICAL)
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() mwifiex_get_priv_by_id() returns the priv pointer corresponding to the bss_num and bss_type, but without checking if the priv is actually currently in use. Unused priv pointers do not have a wiphy attached to them which can lead to NULL pointer dereferences further down the callstack. Fix this by returning only used priv pointers which ha CVSSv3.1 8.8 (HIGH)
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_rename_path() If smb2_set_path_attr() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() again as the reference of @cfile was already dropped by previous smb2_compound_op() call. CVSSv3.1 9.8 (CRITICAL)
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1) No skb created yet 2) header_size == 0 (no SHAMPO header) 3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the last page fragment of a SHAMPO header page) a new skb is formed with a page that is NOT a SHAMPO header page (it is a regular data page). Further down in the same function (mlx5e_handle_rx_cqe_mp CVSSv3.1 9.8 (CRITICAL)
Elastic Security Labs published a detailed technical analysis of DPRK-attributed Python-based malware campaigns targeting high-security networks through social engineering lures disguised as job interview coding challenges. The malware uses obfuscated Python modules (Pyperclip, Pyrebase) with Base64 and ROT13 encoding to establish C2 communication, execute arbitrary commands, and maintain persistence across Windows, macOS, and Linux platforms. The analysis connects this activity to prior campaigns including VMConnect, CovertCatch, and KandyKorn, demonstrating DPRK's evolving operational tradecraft.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2. CVSSv3.1 9.3 (CRITICAL)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Store Finder: from n/a through < 6.9.8. CVSSv3.1 9.3 (CRITICAL)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Store Finder: from n/a through <= 6.9.7. CVSSv3.1 9.3 (CRITICAL)
Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network. CVSSv3.1 8.1 (HIGH) · EPSS 50th percentile
An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network. CVSSv3.1 9.8 (CRITICAL) · EPSS 53th percentile
A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build container can be overridden using the `spec.source.secrets.secret.destinationDir` attribute of the `BuildConfig` definition. An attacker running code in a privileged container could escalate CVSSv3.1 9.1 (CRITICAL) · EPSS 82th percentile
A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process. During the build initialization step, the git-clone container is run with a privileged security context, allowing unrestricted access to the node. An attacker with developer-level access can provide a crafted .gitconfig file containing commands executed during the cloning process, leading to arbitrary command execution on the worker no CVSSv3.1 9.9 (CRITICAL) · EPSS 56th percentile
Impacket 0.12.0 released with significant enhancements to credential access and lateral movement capabilities. Notable additions include MS-GKDI Group Key Distribution Protocol implementation, Kerberoasting without pre-authentication support, S4U2self abuse primitives, LAPS password extraction, and new DACL/ownership manipulation tools (dacledit.py, owneredit.py). Multiple bug fixes and performance improvements across SMB, LDAP, Kerberos, and NTLM relay functionality.
Improper Control of Generation of Code ('Code Injection') vulnerability in SFS Consulting ww.Winsure allows Code Injection. This issue affects ww.Winsure: before 4.6.2. CVSSv3.1 9.8 (CRITICAL) · EPSS 49th percentile
Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection. This issue affects ww.Winsure: before 4.6.2. CVSSv3.1 9.8 (CRITICAL) · EPSS 44th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting InsureE GL allows SQL Injection. This issue affects InsureE GL: before 4.6.2. CVSSv3.1 9.8 (CRITICAL) · EPSS 44th percentile
Use of Hard-coded Credentials vulnerability in TNB Mobile Solutions Cockpit Software allows Read Sensitive Strings Within an Executable. This issue affects Cockpit Software: before v2.13. CVSSv3.1 9.8 (CRITICAL)
In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure that nfsd4_fattr_args.context is zeroed out If nfsd4_encode_fattr4 ends up doing a "goto out" before we get to checking for the security label, then args.context will be set to uninitialized junk on the stack, which we'll then try to free. Initialize it early. CVSSv3.1 9.8 (CRITICAL)
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix potential UAF in nfsd4_cb_getattr_release Once we drop the delegation reference, the fields embedded in it are no longer safe to access. Do that last. CVSSv3.1 9.8 (CRITICAL)
In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inode_setsecctx hook Marek Gresko reports that the root user on an NFS client is able to change the security labels on files on an NFS filesystem that is exported with root squashing enabled. The end of the kerneldoc comment for __vfs_setxattr_noperm() states: * This function requires the caller to lock the inode's i_mutex before it * is executed. It al CVSSv3.1 9.8 (CRITICAL)
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease It is not safe to dereference fl->c.flc_owner without first confirming fl->fl_lmops is the expected manager. nfsd4_deleg_getattr_conflict() tests fl_lmops but largely ignores the result and assumes that flc_owner is an nfs4_delegation anyway. This is wrong. With this patch we restore the "!= &nfsd_lease_mng_ops" case to behave as it CVSSv3.1 9.8 (CRITICAL)
Elastic Security Labs publishes comprehensive research on Windows kernel Event Tracing for Windows (ETW) as a superior telemetry source for endpoint detection, demonstrating how to enumerate, reverse-engineer, and correlate kernel ETW events across legacy and modern provider types. The research includes a Ghidra script that automatically maps kernel API calls to their corresponding ETW events, unmasking previously opaque security-relevant events like KERNEL_AUDIT_API_OPENPROCESS and KERNEL_AUDIT_API_SETCONTEXTTHREAD.