The CyberSec Intelligence team presents the daily analysis of cybersecurity threats and vulnerabilities identified globally. Today’s information covers actively exploited security breaches, critical severity flaws in consumer devices, and a synthesis of the most important events from the specialized press.
Actively Exploited Vulnerabilities
- CVE-2026-104935 (Ivanti Connect Secure): Spoofing-based authentication bypass vulnerability that allows an unauthenticated remote attacker to execute arbitrary commands. Details in the NVD source.
- CVE-2026-96951 (Microsoft Windows): A command injection in Windows Shell that allows an unauthorized attacker to bypass a security feature over the network. Details in the NVD source.
- CVE-2015-5477 (ISC BIND): Data processing flaw that allows remote attackers to cause a Denial of Service (DoS) state by sending TKEY queries. Details in the NVD source.
- CVE-2016-3081 (Apache Struts): Command injection vulnerability that allows remote attackers to execute arbitrary code via the “method:” prefix when the Dynamic Method Invocation option is active. Details in the NVD source.
- CVE-2023-22894 (Strapi): Plaintext storage of sensitive information that allows users with administrative panel access to discover details about other users. This breach can be chained with CVE-2023-22621 for remote code execution (RCE). Details in the NVD source.
- CVE-2021-3199 (ONLYOFFICE Docs): Path traversal vulnerability in ONLYOFFICE Docs Server when using JWT, via the “/..” sequence in an image upload parameter, potentially leading to remote code execution (RCE). Details in the NVD source.
- CVE-2015-3306 (ProFTPD): Inadequate access control that allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Details in the NVD source.
New Critical Vulnerabilities
- CVE-2026-108804 (TRENDnet TEW-751DR, TEW-752DRU, TEW733GR): Command injection in the fwrite function of the pigwidgeon.cgi component due to service argument manipulation. The attack can be launched remotely, and the exploit is public. The product is EoL since 2011. Details in the NVD source.
- CVE-2026-108892 (Linksys E1700): Stack-based buffer overflow in the ssid1MACFilter function, exploitable remotely. The exploit is public, and the vendor has not responded to the notification. Details in the NVD source.
- CVE-2026-108894 (Linksys E1700): Command injection in the addStaticRoute function via manipulation of arguments related to network settings. Allows remote exploitation, and the exploit is public. Details in the NVD source.
- CVE-2026-108896 (Linksys E1700): Command injection in the setLinksysIpv6 function via the _6rd_prefix/_6rd_prefix_len arguments. Allows remote attacks and has a public exploit available. Details in the NVD source.
- CVE-2026-108914 (Edimax BR-6208AC): Buffer overflow in formWlSiteSurvey via the ifname argument. The product is no longer supported, and the exploit is public. Details in the NVD source.
- CVE-2026-109321 (Grav Login OAuth plugin): Deterministic generation of user credentials with unsalted MD5 hash, allowing remote attackers to take administrative control of accounts. Details in the NVD source.
- CVE-2026-108918 (Edimax BR-6208AC): Command injection in formWlanMP via the readE2P parameter, on EoL devices. The exploit is public. Details in the NVD source.
- CVE-2026-87744 (Quarkus REST Data Panache): Allows unauthenticated attackers to bypass security controls on generated endpoints when @MethodProperties is used without explicit redeclaration of roles. Details in the NVD source.
- CVE-2026-108929 (Netcore NR268): Argument injection in DDNSset.cgi via the Hostname argument, exploitable remotely. Details in the NVD source.
- CVE-2026-109566 (Rapyd Admin): Predefined credentials for the admin@laravel account with the password admin, created during installation and recreated at each rpd:make run, offering global super-admin access. Details in the NVD source.
- CVE-2026-82101 (IBM DataStage on Cloud Pak for Data): Path traversal vulnerability that allows an authenticated attacker to cause a Denial of Service (DoS) state. Details in the NVD source.
- CVE-2026-82110 (IBM DataStage on Cloud Pak for Data): Allows arbitrary code execution by an authenticated remote attacker due to improper path validation during a path traversal. Details in the NVD source.
From the Security Press
- Docker Hub Flaw: A critical, two-year-old vulnerability in Docker Hub has been fixed, which allowed a user to perform push, pull, or delete actions on another user’s images during the process of converting a personal account to an organization account. Reported in The Hacker News.
- Ivanti Connect Secure Zero-Days: Attackers chained three zero-day vulnerabilities to gain root access without authentication. Ivanti released patches for only two of them, with the third currently remaining unpatched. Reported in The Hacker News.
- SAP Cloud SDK for Python: A critical vulnerability with a CVSS score of 10 allows sending OAuth2 client credentials to an attacker-controlled server in multi-tenant applications on the SAP Business Technology Platform (BTP). Reported in The Hacker News.
- LG Smart TVs webOS: Three vulnerabilities in webOS can be chained to grant root access on the local network, without user interaction or entering a PIN code (tested on models 32LQ636BPSA and 27TQ600SW). Reported in The Hacker News.
- Progress Software MarkLogic Server: Two of the 31 newly reported vulnerabilities could allow a delegated management account to take full administrative control of the database server. Patches are included in versions 11.3.7 and 12.1.0. Reported in The Hacker News.
- GitLab Community & Enterprise Edition: Patch for a critical vulnerability (CVSS 10.0) that allows unauthenticated users to execute arbitrary code via a malicious regular expression in CI/CD. Reported in The Hacker News.
- SonicWall SMA 1000 (CVE-2026-102255): A critical, pre-authenticated Server-Side Request Forgery (SSRF) vulnerability was the target of over 130 exploitation attempts immediately after the patch release. Reported in The Hacker News.
- Weekly Recap: The report covers zero-day vulnerabilities in helpdesk platforms, rogue certificates, the arrest of a ShinyHunters group member, and malware designed to trick AI systems. Reported in The Hacker News.
What We Recommend
- Urgent Patching (Patch Management): Immediately update production servers running GitLab, IBM DataStage, and active security products. Prioritize Ivanti Connect Secure devices, actively monitoring connection logs to detect exploitation attempts.
- Decommissioning EoL (End-of-Life) Equipment: Network equipment from TRENDnet, Linksys, and Edimax that is no longer supported must be replaced urgently, as exploits for them are public and will not be patched by the manufacturers.
- Strict Network Segmentation: Isolate IoT devices and smart systems (such as LG TVs) in dedicated VLANs, prohibiting their direct communication with network segments containing sensitive corporate data.
- Access Monitoring and Auditing: Closely monitor activities on web servers and administrative panels to detect the use of default credentials, insecure configurations of OAuth plugins, or unusual path traversal activities.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
