VulnHub

ABB Protection and Control IED Manager PCM600 has been found to contain two vulnerabilities that could allow attackers to escalate privileges or overwrite files. Specifically, versions of PCM600 up to and including 2.14 are affected by CVE-2026-15952 and CVE-2026-15953. The first vulnerability allows local users with valid credentials to gain elevated privileges due to improper permission settings in the Scheduler Service. The second vulnerability concerns insufficient validation during the extraction of project archive files, enabling potential path traversal attacks. These vulnerabilities pose significant risks, particularly in critical infrastructure sectors like energy, where ABB's systems are widely deployed. Users are advised to take immediate action to mitigate these risks.

Johnson Controls has reported a vulnerability in its EasyIO Neo Series EC and CW Controllers that could allow attackers to access sensitive information. This issue affects multiple versions of the EC and CW Controllers, specifically versions V3.3b63, V3.3b62, V3.3b25, and V3.3b24. If exploited, this vulnerability could lead to further attacks on systems that utilize these devices, which are commonly used for building automation, including HVAC and lighting control. Users are urged to upgrade to the fixed firmware versions V3.3b64 for EC Controllers and V3.3b26 for CW Controllers as soon as possible. In the meantime, organizations should implement physical access controls and monitor network traffic to mitigate potential risks.

CISA has identified multiple vulnerabilities in its Malcolm product, which is used across critical infrastructure sectors like energy and water. The flaws include issues such as cross-site scripting, command injection, and improper authentication, potentially allowing attackers to execute arbitrary scripts, bypass authentication, and access sensitive internal data. The vulnerabilities affect versions of Malcolm prior to 26.06.0, and CISA urges users to upgrade to the latest version released in September 2026. The presence of these vulnerabilities poses a significant risk to organizations relying on Malcolm, as successful exploitation could lead to unauthorized access and manipulation of sensitive data or system configurations.

Security researchers have released a proof-of-concept for a newly identified vulnerability in Apple's CoreGraphics, tracked as CVE-2026-86950. This flaw can be triggered by a malicious PDF containing a specially crafted embedded font, which causes unpatched iPhones and Macs to crash. Apple has indicated that this vulnerability may have been exploited in targeted attacks against specific individuals. Users of iPhones and Macs need to be aware of this risk, especially if they frequently open PDF files from unknown sources. The situation underscores the importance of keeping devices updated to the latest software versions to mitigate such risks.

Recent findings from Microsoft's Security Research team reveal that attackers have exploited a serious vulnerability in the Zimbra Collaboration Suite (ZCS). The flaw, identified as CVE-2026-73570, allows for unauthenticated command injection, leading to remote code execution. This means that attackers can deploy web shells to access sensitive mailbox data. Organizations using ZCS should be particularly vigilant, as this vulnerability carries a high severity score of 8.9. The fact that attackers are taking advantage of this flaw emphasizes the importance of keeping software updated and applying patches promptly to safeguard against potential data breaches.

Cisco has issued a warning about a critical zero-day vulnerability affecting its Catalyst SD-WAN Manager, which is used by companies to oversee their SD-WAN networks. The flaw, identified as CVE-2026-76504, allows remote attackers to exploit the system's API without needing any login credentials, essentially granting them admin-level access. This poses a significant risk to organizations using this management software, as it could lead to unauthorized control and potential data breaches. Cisco has released patches to fix the issue, but there are no workarounds available for users who need immediate protection. Companies are urged to apply the fixes as soon as possible to mitigate the risk of exploitation.

Security firms have detected ongoing exploitation of two vulnerabilities in NetScaler, identified as CVE-2026-88771 and CVE-2026-88772. These vulnerabilities have been particularly targeted at government and financial organizations over the past few weeks. The active exploitation of these zero-day vulnerabilities poses significant risks, as attackers could potentially gain unauthorized access to sensitive data and systems. Organizations using affected NetScaler products need to take immediate action to safeguard their networks. It’s crucial for IT departments to stay vigilant and implement necessary security measures to mitigate these risks.

Recently, researchers uncovered a serious vulnerability in Citrix NetScaler ADC and Gateway, identified as CVE-2026-88772, which has a CVSS score of 9.5. This flaw, categorized as a memory overflow issue in the Datagram Transport Layer Security (DTLS) protocol, allows attackers to execute shellcode without prior authentication. The vulnerability is currently being exploited in the wild, putting organizations using affected versions of Citrix NetScaler at significant risk. Companies should prioritize applying the latest security patches to safeguard their systems, as failure to do so could lead to unauthorized access and potential data breaches.

Cybersecurity experts have reported that attackers are exploiting a zero-day vulnerability in Citrix NetScaler, identified as CVE-2026-88772. This vulnerability allows hackers to deploy custom web shells and tunneling malware, which can lead to root access on affected systems. Once inside, attackers can steal credentials and move laterally across internal networks, posing a significant risk to organizations that rely on Citrix products. This incident is particularly concerning given the potential for widespread credential theft and internal network compromise. Organizations using Citrix NetScaler should take immediate action to assess their security posture and apply any available patches or mitigations.

The Lantronix G520 Series Cellular Gateway has been found to have serious vulnerabilities that could allow attackers to execute arbitrary code with root privileges. Specifically, versions 2.6.0.4R6_stable are affected by two major issues: one involving improper handling of update metadata that could enable cross-site scripting (CVE-2026-84409), and another related to the acceptance of unauthorized software packages, undermining package authenticity (CVE-2026-91191). These vulnerabilities pose risks to critical infrastructure sectors, including transportation, energy, and water systems, and could be exploited by malicious actors to gain control over devices. Lantronix has released a patch, version 2.6.0.7R6, to address these issues, and users are strongly advised to update their devices promptly to mitigate risks.

Toptech Systems has identified a series of serious vulnerabilities affecting its TMS7 and TopHAT software, both at version 7.6.3. These vulnerabilities could let attackers access sensitive data or run arbitrary code on the servers. Notable issues include the ability for unauthenticated users to export database tables, upload malicious files, and execute SQL injection attacks that could compromise database integrity. Toptech issued a security advisory on July 20, 2026, and has addressed these vulnerabilities in the software's latest version, 7.8. Users are encouraged to update their systems to mitigate the risks associated with these vulnerabilities.

The Viidure Dashcam Android Application is facing serious security vulnerabilities that could allow attackers to access sensitive user data and critical system files. Two main issues have been identified: one involves a misconfigured cloud storage backend that permits unrestricted public access to sensitive records and live footage, while the other reveals hard-coded credentials embedded in the application, granting full access to critical storage. Affected users are running versions of the app prior to 3.3.1.260403. Despite the severity of these vulnerabilities, Viidure has not provided any fixes and did not respond to CISA's attempts to coordinate on these issues. Users are advised to contact Viidure support for more information and to take defensive measures to secure their systems.

Anjvision's YSSD-RTMP-H5 firmware version 3.3.2.4 has several serious vulnerabilities that could allow attackers to gain unauthorized access, execute commands, or take control of the devices. These flaws stem from issues like improper authentication, hardcoded credentials, and insufficient cryptographic protections. Notably, the firmware lacks a planned fix, and Anjvision has not engaged with CISA to address these vulnerabilities. Users of affected devices are encouraged to reach out to Anjvision for support, but without a patch, the risk remains high. The potential for exploitation is significant, affecting devices deployed globally across commercial facilities.

A command injection vulnerability has been discovered in the firmware of various VIVOTEK camera models, allowing attackers to execute commands remotely, potentially gaining root access. This affects multiple models across the V, C, and S Series, as well as some dome and bullet cameras. The vulnerability, identified as CVE-2026-22755, has a critical severity rating of 10 on the CVSS scale, indicating a serious risk to users. VIVOTEK has released updated firmware to address this issue, and users are strongly urged to download and install the latest version to protect their devices. Without prompt action, these cameras could be fully compromised, posing risks to security systems in various sectors including government, transportation, and commercial facilities.

A vulnerability has been identified in the Baicells Nova 430H eNodeB (model pBS3101SH) that could allow attackers to disrupt service by sending malformed messages to the device. This issue affects all versions up to BaiBLQ_3.0.12 and could lead to a denial-of-service condition, temporarily shutting down network connectivity. The vulnerability, designated as CVE-2026-96274, is particularly concerning as it can be exploited by any unauthenticated device within radio range. Baicells Technologies has not planned a fix for this vulnerability and has not collaborated with CISA on mitigation efforts. Users are advised to contact Baicells customer support for more information on how to protect their systems from potential exploitation.