VulnHub

A serious security flaw has been discovered in Check Point's SmartConsole, allowing attackers to bypass authentication. This vulnerability, identified as CVE-2026-16232, has a high severity rating of 9.3 and affects both the Check Point Security Management Server and Multi-Domain Security Management Server (MDS). Researchers have found that this vulnerability is currently being exploited in the wild, which raises significant concerns for organizations using these systems. Companies should take immediate action to secure their environments as the flaw can enable unauthorized access, potentially leading to data breaches or system compromises. It's crucial for affected users to stay updated on this issue and apply any necessary patches as they become available.

Gitea has addressed a serious remote code execution (RCE) vulnerability that could allow users with write access to repositories to execute shell commands. This flaw, identified as CVE-2026-60004, has a high severity score of 9.8 and affects Gitea versions from 1.17 up to, but not including, 1.27.1. Essentially, an attacker could manipulate patch content to create a Git hook that runs commands as the Gitea service account. The vulnerability poses a significant risk to self-hosted Git users, as it could lead to unauthorized access and control over systems running Gitea. Users are strongly advised to update to version 1.27.1 to mitigate this risk.

OpenWrt has released version 24.10.8 to address a serious vulnerability in its DHCPv6 service, identified as CVE-2026-53921. This flaw has a CVSS score of 9.8, indicating a high level of risk, as it allows unauthenticated attackers to exploit a stack overflow in the odhcpd component. If attackers can reach the DHCPv6 server, they could potentially execute code with root privileges. This vulnerability affects users running OpenWrt versions that include the vulnerable DHCPv6 stack, which is enabled by default in many configurations. Users are strongly advised to update their systems to maintain security and prevent unauthorized access.

Siemens has issued a warning regarding vulnerabilities in the Mendix Runtime, specifically related to the documentation on access rules for the System.User entity. Developers may unintentionally set overly permissive access rules due to inadequate guidance, which can lead to unauthorized access to sensitive user data or privilege escalation in applications. A notable misconfiguration involves the anonymous user role, which could allow access to all stored records without explicit permissions. Siemens is urging Mendix developers to review their access configurations in light of this issue. This vulnerability affects all versions of Siemens Mendix Runtime and has been assigned the CVE identifier CVE-2026-7891, with a critical severity rating of 9.1 on the CVSS scale.

MikroTik has disclosed a significant vulnerability affecting all versions of its RouterOS and Cloud Hosted Router software, identified as CVE-2026-16347. This flaw allows attackers to bypass safeguards against excessive login attempts, making it easier for them to guess passwords and gain unauthorized access to systems. Users worldwide are at risk, particularly in sectors like information technology and commercial facilities. Currently, no fix is available, prompting MikroTik to advise users to implement several mitigations, such as using strong VPNs, restricting access from untrusted networks, and employing long, complex passwords. The vulnerability underscores the need for organizations to bolster their security measures to protect against potential breaches.

Siemens has identified a vulnerability in its SIMATIC S7-PLCSIM Advanced software that could lead to a denial of service (DoS) condition. This issue arises from the software's inability to manage high-volume multicast network traffic, which can deplete available memory resources and make the application inaccessible. Although no project data is lost during this downtime, the affected application needs to be manually restarted. The vulnerability, tracked as CVE-2026-54429, impacts all versions of the SIMATIC S7-PLCSIM Advanced software and can be exploited by an unauthenticated attacker on the local network. Siemens is currently working on fixes and recommends users take specific countermeasures to mitigate the risk until updates are available.

Siemens has issued a warning about a serious vulnerability affecting its Desigo CC product family, which includes versions V7, V8, and V9 prior to 9.0.1. This vulnerability, identified as CVE-2025-15467, can be exploited by remote attackers to trigger a stack-based buffer overflow, potentially leading to denial of service or even remote code execution. The risk arises when parsing certain CMS messages with maliciously crafted parameters. Siemens has released updates for some affected versions and is advising users to upgrade to the latest versions. For those unable to update immediately, Siemens suggests implementing additional security measures to mitigate the risk. This vulnerability is particularly concerning given the critical infrastructure sectors affected, as these systems are essential for operations worldwide.

ABB has confirmed a vulnerability in its KNX Update Tool that affects classic KNX devices, which do not support the newer KNX Secure standard. This vulnerability, identified as CVE-2026-12705, allows an attacker with physical access to the device's bus to potentially render it unusable or alter its behavior by tampering with the firmware. ABB has stated that there are no software updates available to address this issue due to the inherent security limitations of legacy KNX devices. Users are advised to limit physical access to these devices and avoid using them for sensitive applications, as there are no plans for corrective measures from ABB. This incident highlights ongoing security challenges with older industrial protocols.

A vulnerability in the igloohome Smart Lock Mobile Application has been discovered, affecting version 3.2.3 and earlier. This flaw, identified as CVE-2026-16581, allows unauthorized access to backend services due to sensitive information being included in the application's source code. As a result, attackers could exploit this weakness to access functionality that should be protected by authentication measures. igloohome has addressed the issue by enhancing access controls to prevent unauthorized requests. Users are advised to ensure they are using the latest version of the app to mitigate risks.

JetBrains has addressed a significant security vulnerability in its TeamCity software, identified as CVE-2026-63077, which has a CVSS score of 9.8. This flaw allows unauthenticated attackers to execute arbitrary code on affected on-premise servers, posing a serious risk to organizations using TeamCity. All versions of TeamCity On-Premises are vulnerable, which means that a wide range of users could be impacted if they do not take immediate action. The potential for server takeover highlights the importance of applying security updates promptly to safeguard systems. JetBrains has released patches to mitigate this vulnerability, urging users to update their installations as soon as possible.

JetBrains has addressed a significant security vulnerability (CVE-2026-63077) in its TeamCity On-Premises software that could allow attackers to execute code without authentication. This flaw affects users who host TeamCity servers themselves, making it crucial for administrators to act swiftly. JetBrains is urging these users to upgrade their installations immediately to protect against potential exploitation. For those unable to upgrade right away, the company has provided a security patch plugin as a temporary fix. Given TeamCity's popularity as a continuous integration and delivery tool, the urgency of this update is clear, as unpatched systems could become prime targets for cyberattacks.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added vulnerabilities associated with Arista VeloCloud Orchestrator and Fortinet's FortiOS to its Known Exploited Vulnerabilities catalog. The specific vulnerability for Arista is identified as CVE-2025-68686. This inclusion indicates that these flaws are being actively exploited, posing a significant risk to users of these products. Organizations using Arista's VeloCloud Orchestrator or Fortinet's FortiOS should take immediate action to address these vulnerabilities to safeguard their systems from potential attacks. The urgency of this update emphasizes the need for timely patching and monitoring of network security.

JetBrains has alerted users of on-premise TeamCity versions about a serious security vulnerability that could allow attackers to execute arbitrary commands on affected systems without needing to log in. This flaw, identified as CVE-2026-63077, has a high severity score of 9.8, indicating the potential for significant damage if exploited. It impacts all versions of TeamCity On-Premises, prompting JetBrains to recommend that users immediately update to the latest versions, 2025.11.7 or 2026.1.3, to safeguard their installations. TeamCity Cloud users are not affected, as the vulnerability has already been patched in that environment. This issue stresses the importance of timely software updates to prevent unauthorized access and control over systems.

A serious security flaw has been discovered in the on-premises version of Arista's VeloCloud Orchestrator, identified as CVE-2026-16812, which carries a maximum CVSS score of 10.0. This vulnerability is a command injection issue that could allow attackers to execute arbitrary code on affected systems. As it is actively being exploited in the wild, organizations using this software need to be particularly vigilant. The flaw affects on-premises deployments of the VeloCloud Orchestrator, which is used for managing network services. The implications of this vulnerability are significant, as it could lead to unauthorized access and control over critical network functions if left unaddressed.