The CyberSec Intelligence security team presents the daily security bulletin for October 13, 2026. It includes an analysis of currently actively exploited vulnerabilities, newly reported critical breaches, and the most important news from the specialized press.
Actively exploited vulnerabilities
- CVE-2015-5477 (ISC BIND): A data processing error allows remote attackers to cause Denial of Service (DoS) via TKEY queries. Source: NVD.
- CVE-2016-3081 (Apache Struts): Command injection vulnerability that allows remote arbitrary code execution via method:prefix when Dynamic Method Invocation is enabled. Source: NVD.
- CVE-2023-22894 (Strapi): Cleartext storage of sensitive information allows users with access to the admin panel to discover user details. It can be chained with CVE-2023-22621 for RCE. The product may be at End of Life (EoL). Source: NVD.
- CVE-2021-3199 (ONLYOFFICE Docs): Path traversal vulnerability via image upload parameter when JWT is used, allowing remote code execution. Source: NVD.
- CVE-2015-3306 (ProFTPD): Improper access control allowing attackers to read and write to arbitrary files via site cpfr and site cpto commands. Source: NVD.
New critical vulnerabilities
- CVE-2026-108540 (OpenSpug Spug up to 3.4.0/4.0.1): OS command injection in /exec/transfer (File Transfer component). CVSS 9.9. Source: NVD.
- CVE-2026-108576 (TOZED X300 up to 6.01.3): OS command injection in the process_ping function via the Host argument. CVSS 10. Source: NVD.
- CVE-2026-108753 (Agnaistic agnai up to 1.0.555): Hardcoded credentials in docker-compose file, allowing administrator authentication or JWT token forging. CVSS 9.4. Source: NVD.
- CVE-2026-108860 (BotSharp up to 5.2.0): Authentication bypass using a hardcoded JWT key in appsettings.json. CVSS 9.1. Source: NVD.
- CVE-2026-108804 (TRENDnet TEW-751DR, TEW-752DRU, TEW733GR): OS command injection in pigwidgeon.cgi. The product is End of Life (EoL) since 2011. CVSS 10. Source: NVD.
- CVE-2026-108892, CVE-2026-108893, CVE-2026-108894, CVE-2026-108895, CVE-2026-108896 (Linksys E1700): Multiple critical buffer overflow and command injection vulnerabilities in various router functions. CVSS 9.9 – 10. Sources: CVE-2026-108892, CVE-2026-108893, CVE-2026-108894, CVE-2026-108895, CVE-2026-108896.
- CVE-2026-108907 (Netcore NR268 1.7.121109): Faulty authentication in the CGI Execution component, allowing remote access. CVSS 10. Source: NVD.
- CVE-2026-108914 (Edimax BR-6208AC 1.32): Buffer overflow in formWlSiteSurvey. The equipment is no longer supported. CVSS 9.9. Source: NVD.
From the security press
- SonicWall SMA 1000 targeted by attacks (CVE-2026-102255): The critical pre-authentication SSRF vulnerability (CVSS 10.0) recorded at least 135 exploitation attempts immediately after the patch release. Source: The Hacker News.
- WordPress Bricksforge Plugin (CVE-2026-85097): Attackers are actively exploiting a maximum severity vulnerability (CVSS 10.0) that allows arbitrary PHP code execution on vulnerable sites. Source: The Hacker News.
- The week in security: Recent reports show that attackers test and exploit new vulnerabilities within just hours of their public disclosure, leaving organizations very little time for remediation. Source: The Hacker News.
What we recommend
- Patch management (Patch Management): Immediately apply updates for exposed software platforms (SonicWall, ONLYOFFICE, Strapi) to block active exploitation attempts.
- Management of end-of-life equipment (EoL/EoS): Identify and replace old routers from TRENDnet, Linksys, and Edimax that no longer benefit from technical support and patches.
- Regular asset inventory: Maintain a complete list of all network equipment and applications to react quickly to the publication of new CVEs.
- Continuous traffic monitoring: Implement strict firewall rules and monitor logs to detect abnormal behavior or command injections early.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
