THREAT OPS › Threat News

Threat Intelligence News

11690 reports from 110+ open cyber-threat-intelligence sources — APT activity, malware, vulnerabilities and campaigns, newest first.

[NVD] CVE-2026-82457 (HIGH 7.8) — su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec nvd · 2026-08-29
[NVD] CVE-2026-82456 (CRITICAL 10.0) — argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to creatnvd · 2026-08-29
[NVD] CVE-2026-82455 (HIGH 7.1) — RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory cannvd · 2026-08-29
[NVD] CVE-2026-82454 (CRITICAL 9.1) — The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwtnvd · 2026-08-29
[NVD] CVE-2026-82452 (CRITICAL 9.8) — rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessinnvd · 2026-08-29
[NVD] CVE-2026-82451 (MEDIUM 6.1) — Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Snvd · 2026-08-29
[NVD] CVE-2026-82450 (HIGH 8.8) — BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by emnvd · 2026-08-29
[NVD] CVE-2026-82449 (MEDIUM 5.3) — Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing acconvd · 2026-08-29
[NVD] CVE-2026-82448 (CRITICAL 9.8) — Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatchnvd · 2026-08-29
[NVD] CVE-2026-82447 (HIGH 8.8) — Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters onvd · 2026-08-29
[qilin] The Frame Group posted to leak siteransomware_live · 2026-08-29
[qilin] La Maison Des Travaux posted to leak siteransomware_live · 2026-08-29
[qilin] BLISS 1041 posted to leak siteransomware_live · 2026-08-29
[qilin] CareClinics posted to leak siteransomware_live · 2026-08-29
[m3rx] lindner-group.com posted to leak siteransomware_live · 2026-08-29
[incransom] wittmann posted to leak siteransomware_live · 2026-08-29
[Orova] ITC Properties Group Limited posted to leak siteransomware_live · 2026-08-29
[qilin] AUM Construction posted to leak siteransomware_live · 2026-08-29
[Orova] South Pacific Hotel Limited posted to leak siteransomware_live · 2026-08-29
[iah6477] swagelok posted to leak siteransomware_live · 2026-08-29
[iah6477] trc-companies posted to leak siteransomware_live · 2026-08-29
[NVD] CVE-2026-81342 (MEDIUM 4.7) — The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs.nvd · 2026-08-29
[NVD] CVE-2026-81200 (LOW 2.7) — The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by nvd · 2026-08-29
[NVD] CVE-2026-81026 (MEDIUM 4.8) — The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access tnvd · 2026-08-29
[NVD] CVE-2026-80488 (MEDIUM 4.1) — The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.nvd · 2026-08-29
[NVD] CVE-2026-80311 (MEDIUM 4.3) — The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonginvd · 2026-08-29
[NVD] CVE-2026-77786 (MEDIUM 4.9) — The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are nvd · 2026-08-29
[NVD] CVE-2026-77704 (LOW 2.7) — The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including nvd · 2026-08-29
[NVD] CVE-2026-77012 (CRITICAL 9.3) — The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary finvd · 2026-08-29
[NVD] CVE-2026-77010 (MEDIUM 6.5) — The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for nvd · 2026-08-29
[NVD] CVE-2026-77008 (MEDIUM 6.5) — The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secrenvd · 2026-08-29
[NVD] CVE-2026-77007 (HIGH 7.5) — The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to tnvd · 2026-08-29
[NVD] CVE-2026-76586 (HIGH 7.5) — The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment apnvd · 2026-08-29
[NVD] CVE-2026-76548 (HIGH 8.2) — The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, panvd · 2026-08-29
[NVD] CVE-2026-76547 (MEDIUM 6.6) — The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is nvd · 2026-08-29
[NVD] CVE-2026-76546 (MEDIUM 6.8) — The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrnvd · 2026-08-29
[NVD] CVE-2026-19430 (MEDIUM 5.3) — The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never nvd · 2026-08-29
[NVD] CVE-2026-18234 (MEDIUM 6.5) — The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitranvd · 2026-08-29
[NVD] CVE-2026-18233 (MEDIUM 6.5) — The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.nvd · 2026-08-29
[NVD] CVE-2026-17522 (MEDIUM 5.4) — The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters Wornvd · 2026-08-29
[NVD] CVE-2026-17520 (MEDIUM 4.8) — The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers andnvd · 2026-08-29
[NVD] CVE-2026-16947 (CRITICAL 9.1) — The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirectnvd · 2026-08-29
[NVD] CVE-2026-16600 (HIGH 7.7) — The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internvd · 2026-08-29
[NVD] CVE-2026-16259 (CRITICAL 9.8) — The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every insnvd · 2026-08-29
[NVD] CVE-2026-16061 (HIGH 8.6) — The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.nvd · 2026-08-29
TerminalFix campaign deploys a reverse tunnel through multistage intrusionmsstic · 2026-08-29
MLTracer: Syscall-Based Malicious Model Detection and Labeling, with Static-Scanner Evasion Taxonomybinarly · 2026-08-29
[ShadowByt3$] BayView Real Estate posted to leak siteransomware_live · 2026-08-29
[lynx] cutlercapital posted to leak siteransomware_live · 2026-08-29
[lockbit5] apatpa.com posted to leak siteransomware_live · 2026-08-29
[incransom] Oilquip Inc posted to leak siteransomware_live · 2026-08-29
[shinyhunters] McKesson Corporation posted to leak siteransomware_live · 2026-08-28
[Doommageddon] SITTNAK Lojistik A.Ş. posted to leak siteransomware_live · 2026-08-28
[Doommageddon] Akpera Gayrimenkul Yatırım A.Ş. posted to leak siteransomware_live · 2026-08-28
[shinyhunters] Elekta AB posted to leak siteransomware_live · 2026-08-28
[shinyhunters] Jack Henry & Associates posted to leak siteransomware_live · 2026-08-28
[GHSA] GHSA-g5xc-5w98-jfvm (medium) — MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsetsgithub_advisories · 2026-08-28
[GHSA] GHSA-ffg3-p8fm-mjx2 (high) — RestrictedPython guard hooks can be shadowed via positional-only argumentsgithub_advisories · 2026-08-28
[GHSA] GHSA-c857-9x2m-cvh2 (medium) — org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)github_advisories · 2026-08-28
[GHSA] GHSA-5rqc-86vf-g8r2 (medium) — org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Outputgithub_advisories · 2026-08-28
[GHSA] GHSA-xvr9-35cr-46v9 (medium) — org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Contextgithub_advisories · 2026-08-28
[GHSA] GHSA-qxvw-fvwx-5cp7 (medium) — org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentialsgithub_advisories · 2026-08-28
[GHSA] GHSA-g9jj-cgmh-9f38 (medium) — MariaDB has cleartext password disclosure to a MITM on the initial-handshakegithub_advisories · 2026-08-28
[GHSA] GHSA-j5g3-42wp-gqm3 (high) — Snipe-IT has an Improper Privilege Management issuegithub_advisories · 2026-08-28
[GHSA] GHSA-5v29-34h8-v68r (high) — MapFish Print has XXE that allows reading arbitrary files of certain typesgithub_advisories · 2026-08-28
[GHSA] GHSA-fp46-6vfw-gc9c (low) — free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKAgithub_advisories · 2026-08-28
[GHSA] GHSA-334q-h5g3-fpxv (high) — free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPIgithub_advisories · 2026-08-28
[GHSA] GHSA-56wq-x3wv-3ff4 (high) — SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object readgithub_advisories · 2026-08-28
[NVD] CVE-2026-81533 (HIGH 7.1) — An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enanvd · 2026-08-28
[NVD] CVE-2026-81532 (HIGH 8.8) — A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnvd · 2026-08-28
[GHSA] GHSA-hgpf-8634-g44c (medium) — SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table bucketsgithub_advisories · 2026-08-28
[GHSA] GHSA-j769-9gv9-65gr (medium) — Graylog token revocation endpoint allows authenticated users to delete other users’ access tokensgithub_advisories · 2026-08-28
[GHSA] GHSA-gqr6-r77p-c2pj (high) — Fortigate syslog message parser can be exploited to modify or delete fields from the original messagegithub_advisories · 2026-08-28
[GHSA] GHSA-mrpp-v6pg-p54x (high) — klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupplygithub_advisories · 2026-08-28
[GHSA] GHSA-42r5-vhpq-m858 (medium) — MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentialsgithub_advisories · 2026-08-28
Perturbation Probing: A New Diagnostic for the Fragility of LLM Safetyunit42 · 2026-08-28
Berlin Refuses to Pay Hackers Who Stole Data From the City's State Networkthehackernews · 2026-08-28
Fwd: [Freeipmi-announce] FreeIPMI 1.6.19 Releasedoss_sec · 2026-08-28
Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)oss_sec · 2026-08-28
[CVE-2026-8715] HashiCorp Vault Secrets Operator 1.3.0-1.4.1: tenant-controlled secretIDPath leaks operator ServiceAccount token (path to cluster-admin)oss_sec · 2026-08-28
Friday Squid Blogging: Truckload of Squid Spills in Rhode Islandschneier · 2026-08-28
NSD 4.15.1 security releaseoss_sec · 2026-08-28
[qilin] Alter Consultores Legales posted to leak siteransomware_live · 2026-08-28
Dovecot Security Advisory 3/2026oss_sec · 2026-08-28
Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerablethehackernews · 2026-08-28
[GHSA] GHSA-p378-jp5r-gpgw (medium) — arc has unauthenticated cluster node admission when `cluster.shared_secret` is unsetgithub_advisories · 2026-08-28
[GHSA] GHSA-x626-fcwx-f5pc (high) — Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instancesgithub_advisories · 2026-08-28
[GHSA] GHSA-v358-wf77-39xv (high) — klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splitsgithub_advisories · 2026-08-28
[GHSA] GHSA-xrjc-c68j-hp7w (low) — PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URIgithub_advisories · 2026-08-28
[GHSA] GHSA-f2xf-7x3g-4272 (medium) — PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interactiongithub_advisories · 2026-08-28
[NVD] CVE-2026-56100 (HIGH 8.1) — SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed nvd · 2026-08-28
Introducing BOMHort: Kubernetes-Native SBOM Visualization & Governance at Scale Joins the OpenSSF Sandboxopenssf_blog · 2026-08-28
[GHSA] GHSA-73p9-6hrp-8qhr (medium) — AIIR verification and policy gates could report success without enforcing the control (fail-open)github_advisories · 2026-08-28
[GHSA] GHSA-hr6j-w4mw-g9mj (high) — alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire servergithub_advisories · 2026-08-28
[GHSA] GHSA-9x44-4gxf-8c25 (critical) — Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Namegithub_advisories · 2026-08-28
[GHSA] GHSA-w23p-wrp7-ch38 (critical) — Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)github_advisories · 2026-08-28
[GHSA] GHSA-f97c-ph8j-8vff (high) — Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalationgithub_advisories · 2026-08-28
[GHSA] GHSA-79cw-hfcc-7mw9 (high) — Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashesgithub_advisories · 2026-08-28
[GHSA] GHSA-h854-c3m3-mh5v (high) — Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypassgithub_advisories · 2026-08-28
[GHSA] GHSA-cqhc-2h57-wpxf (high) — MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`github_advisories · 2026-08-28