VulnHub

Johnson Controls has reported a vulnerability in its EasyIO Neo Series EC and CW Controllers that could allow attackers to intercept sensitive information, such as credentials and session data, transmitted in cleartext over the network. The affected versions include EC Controllers V3.3b62 and V3.3b63, and CW Controllers V3.3b24 and V3.3b25. This issue is significant because it impacts critical infrastructure sectors like manufacturing, government services, and energy systems, where secure data transmission is essential. Users are urged to upgrade to fixed firmware versions, which include improvements like disabling HTTP communication by default. Until updates can be applied, Johnson Controls recommends several mitigations, such as enforcing HTTPS/TLS and isolating devices on a secured network.

Cisco has released a patch for a serious zero-day vulnerability found in its Catalyst SD-WAN appliances. This flaw could allow remote attackers to gain administrative access to affected devices without needing any authentication. The vulnerability poses a significant risk, as it can be exploited to take control of network infrastructure. Users of Cisco's SD-WAN products should prioritize applying the patch to safeguard their systems. The disclosure of this vulnerability emphasizes the need for organizations to remain vigilant about software updates and security practices.

Anjvision's YSSD-RTMP-H5 firmware version 3.3.2.4 has several serious vulnerabilities that could allow attackers to gain unauthorized access, execute commands, or take control of the devices. These flaws stem from issues like improper authentication, hardcoded credentials, and insufficient cryptographic protections. Notably, the firmware lacks a planned fix, and Anjvision has not engaged with CISA to address these vulnerabilities. Users of affected devices are encouraged to reach out to Anjvision for support, but without a patch, the risk remains high. The potential for exploitation is significant, affecting devices deployed globally across commercial facilities.

The Lantronix G520 Series Cellular Gateway has been found to have serious vulnerabilities that could allow attackers to execute arbitrary code with root privileges. Specifically, versions 2.6.0.4R6_stable are affected by two major issues: one involving improper handling of update metadata that could enable cross-site scripting (CVE-2026-84409), and another related to the acceptance of unauthorized software packages, undermining package authenticity (CVE-2026-91191). These vulnerabilities pose risks to critical infrastructure sectors, including transportation, energy, and water systems, and could be exploited by malicious actors to gain control over devices. Lantronix has released a patch, version 2.6.0.7R6, to address these issues, and users are strongly advised to update their devices promptly to mitigate risks.

Kiteworks, an American tech company, recently addressed a significant security vulnerability that prompted them to advise customers to temporarily shut down their systems. The company has now released a patch to fix the flaw, allowing affected customer systems to come back online safely. This vulnerability could have exposed sensitive information, making the patching process crucial for maintaining data security. Users of Kiteworks' services were directly impacted, and the swift action taken by the company is essential to protect their clients from potential exploitation. Companies should ensure they apply the update promptly to mitigate any risks associated with this vulnerability.

A recently discovered zero-day vulnerability in the TDengine time-series database poses a significant risk to various sectors, including industrial, IoT, energy, and automotive. This flaw allows attackers to crash operational technology (OT) servers with just a single packet, potentially disrupting critical systems. Organizations utilizing TDengine need to be aware of this issue, as it could lead to severe operational disruptions and safety concerns. The vulnerability underscores the importance of timely updates and monitoring in environments where downtime can have serious consequences. As of now, there is no specific patch or remediation mentioned, making it crucial for affected users to take immediate steps to secure their systems.

The Cybersecurity and Infrastructure Security Agency (CISA) has instructed U.S. federal agencies to address two serious vulnerabilities in Citrix NetScaler products. These flaws could allow attackers to exploit the systems, leading to unauthorized access and potential data breaches. CISA's directive comes after evidence surfaced that these vulnerabilities are actively being targeted in the wild. Agencies are urged to implement patches by the upcoming Wednesday to secure their systems. This incident emphasizes the ongoing risks associated with critical infrastructure and the need for timely updates to protect sensitive government data.

A serious vulnerability in Roundcube Webmail, identified as CVE-2026-48842, is currently being exploited by attackers. This SQL injection flaw, which has a CVSS score of 8.1, allows unauthorized access to databases on unpatched webmail servers. The Canadian Centre for Cyber Security has issued a warning about this active exploitation, emphasizing the urgency for users to secure their systems. Organizations running Roundcube Webmail should take immediate action to protect their data and prevent potential breaches, especially since the patch for this vulnerability was released four months ago. Failure to apply this update could lead to significant data compromise.

Security researchers have identified two serious unpatched vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that can allow attackers to execute remote code. These zero-day flaws are currently being exploited in the wild, raising concerns among IT administrators. Citrix has not yet acknowledged the vulnerabilities or provided a fix, leading some organizations to proactively take their appliances offline to prevent potential attacks. The situation is urgent as these vulnerabilities could expose sensitive data and systems to unauthorized access. Companies using affected Citrix products should monitor for updates and consider temporary mitigation strategies until a patch is released.

CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting the urgent need for federal agencies to address them due to active exploitation. The first vulnerability, CVE-2026-65660, affects Microsoft SharePoint and allows for code injection, potentially giving attackers control over affected systems. The second, CVE-2026-67279, pertains to Mikrotik RouterOS and involves improper enforcement of behavioral workflows. These vulnerabilities pose significant risks, especially to federal agencies, which are now required to prioritize patching them. While the directive primarily targets federal agencies, CISA encourages all organizations to adopt similar practices to manage vulnerabilities effectively.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that they are being actively exploited. The first, CVE-2026-5430, affects multiple WSO2 products, presenting a path traversal vulnerability that could allow unauthorized access to sensitive files. The second, CVE-2026-71362, involves incorrect authorization in Adobe Commerce and Magento, which could enable attackers to gain unauthorized control over user accounts. These vulnerabilities pose significant risks, particularly to federal agencies, which are required to prioritize fixing high-risk vulnerabilities as per CISA's Binding Operational Directive 26-04. While the directive primarily targets federal agencies, CISA urges all organizations to adopt similar practices to enhance their security posture against these threats.

A security issue has been discovered with GitLab's email feature for filing issues. Each user is assigned a private email address that, if obtained by someone else, can be used to push code and run Continuous Integration (CI) jobs in the user's name. This means that anyone with access to this email address can submit changes to any branch the user can push to, including the main branch. This vulnerability poses a significant risk as it allows unauthorized code submissions and could lead to malicious alterations in projects. GitLab users need to be aware of this issue to safeguard their accounts and projects from potential exploitation.

The FBI and CISA have issued a fact sheet aimed at critical infrastructure operators to address the risks associated with working with third-party industrial control system (ICS) integrators. These integrators can inadvertently introduce security vulnerabilities, particularly if they are given excessive access to systems or if they operate outside U.S. jurisdiction. A recent incident involved foreign cyber actors gaining access to a U.S. industrial automation company, potentially compromising sensitive customer data and schematics. The agencies emphasize the importance of applying the principle of least privilege and conducting thorough risk assessments when engaging third-party services. Operators are encouraged to implement strict cybersecurity measures in contracts and maintain independent operational capabilities to mitigate risks in case of integrator compromise.