The CyberSec Intelligence team presents the daily analysis of recently reported security vulnerabilities. Continuous monitoring and applying patches are essential for protecting your organization’s digital infrastructure.
Actively Exploited Vulnerabilities
- CVE-2026-102764 (BeyondTrust Remote Support): Authentication bypass via spoofing, allowing a remote attacker to perform file operations on the device. Additional details on NVD.
- CVE-2025-61624 (Fortinet Multiple Products): A path traversal vulnerability in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that allows authenticated users with read-write privileges to modify or delete files via specific CLI commands. Additional details on NVD.
- CVE-2026-21589 (Atlassian Multiple Products): Unauthorized exposure of files or directories in the web application root, affecting platforms such as Bitbucket, Confluence, and Jira Data Center. Additional details on NVD.
- CVE-2026-105134 și CVE-2026-105133 (Ahsay AhsayCBS): Command injection and improper authentication that can be chained to execute arbitrary commands at the operating system level. Additional details on NVD (105134) și NVD (105133).
- CVE-2026-76519 (Cisco Secure Email Gateway): A path traversal vulnerability that allows an unauthenticated external attacker to write arbitrary files to the underlying operating system. Additional details on NVD.
- CVE-2026-0322 (Palo Alto Networks PAN-OS): Code injection that allows an authenticated attacker, with network access, to execute code with root privileges on the firewall. Additional details on NVD.
- CVE-2026-104935 (Ivanti Connect Secure): Spoofing vulnerability that allows an unauthenticated remote attacker to execute arbitrary commands. Additional details on NVD.
- CVE-2026-96951 (Microsoft Windows): Command injection in the Windows Shell module that facilitates the bypass of security elements over the network. Additional details on NVD.
New Critical Vulnerabilities
- CVE-2026-110957 (Wavlink WL-WN530BE2-A): OS command injection in api.cgi via manipulation of the REMOTE_ADDR argument, classified with maximum severity (CVSS 10). Additional details on NVD.
- CVE-2026-111281 (Jooan IP Cameras): Remote code execution with root privileges (CVSS 9.8) via hardcoded credentials in the jooandiag daemon. Additional details on NVD.
- CVE-2026-111643 (Misaka Danmu Server): Authentication bypass vulnerability (CVSS 9.8) allowing attackers to modify server configurations and obtain administrative privileges. Additional details on NVD.
- CVE-2026-111690 (Simple Admin Core): Use of a hardcoded default secret key (Auth.AccessSecret) to generate forged administrator JWT tokens (CVSS 9.8). Additional details on NVD.
- CVE-2026-111693 (DataBuff ai-apm-web): Presence of default administrative credentials that can be used to take control of protected routes (CVSS 9.8). Additional details on NVD.
- CVE-2026-111704 (LangChat): Absence of the Sa-Token authentication interceptor exposes REST controllers and allows reading plain text passwords or extracting LLM API keys (CVSS 9.8). Additional details on NVD.
- CVE-2026-110653 (WordPress LatePoint Plugin): OTP verification bypass through a race condition defect, allowing brute-forcing of the 6-digit code and accessing customer accounts (CVSS 9.1). Additional details on NVD.
- CVE-2026-104736 (WordPress LearnPress Plugin): Unsafe input deserialization in the ‘checkout-email’ parameter opens the way for PHP Object Injection (CVSS 9.8). Additional details on NVD.
From the Security Press
- CVE-2026-99999 (Linux Kernel): Dubbed “PwnEscape”, this critical vulnerability in the kernel’s network subsystem allows guest virtual machines to read from the host system’s physical memory. Source: The Hacker News.
- Fără CVE (Next.js): Publication of emergency patches resolving two critical Remote Code Execution vulnerabilities in React Server components and the SVG processing library. Source: The Hacker News.
- Fără CVE (Drupal): Remediation of a critical vulnerability in the Field UI module which, combined with certain contributed modules, provides an unauthenticated RCE pathway. Source: The Hacker News.
- CVE-2026-105740 (Langflow): A critical Path Traversal RCE vulnerability actively targeted in thousands of automated attacks recorded by honeypot networks. Source: The Hacker News.
What We Recommend
- Prioritizing KEV Patches: Immediately apply updates for devices mentioned in the CISA KEV catalog (Fortinet, Palo Alto Networks, Atlassian, BeyondTrust, Ivanti), prioritizing systems directly exposed to the internet.
- Disabling Default Credentials: Check all IoT devices, IP cameras, and internal applications to ensure that configuration passwords or secrets (such as those in Jooan, Simple Admin, or DataBuff) have been modified.
- CMS Extensions Audit: If you run WordPress or Drupal sites, conduct a rigorous inventory of active plugins (such as LatePoint or LearnPress) and urgently update them to secure versions.
- Network Log Monitoring: Configure log analysis systems (SIEM) to detect anomalies specific to Path Traversal attempts or unusual API queries.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
