VulnHub

Attackers are exploiting a serious vulnerability in the WooCommerce Wholesale Lead Capture plugin, which is used on over 6,000 WordPress sites. This flaw allows unauthorized users to upload files, including malicious PHP scripts, which can lead to remote code execution. The security firm Wordfence has reported blocking numerous attempts to exploit this vulnerability. Website owners using this plugin need to be vigilant, as the risk of unauthorized access and potential data breaches is high. It's essential for users to update their plugins promptly to mitigate this risk and protect their sites from malicious actors.

Digital Watchdog has reported several vulnerabilities affecting its VMAX DVR and NVR product lineups, which could allow attackers to gain full administrative control over these devices. This includes the ability to view live and recorded footage, modify configurations, and use the devices to access other parts of a network. All versions of the VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4 Recorder, and VG4 Recorder are impacted by these issues. Users are urged to update their firmware to mitigate risks, as these vulnerabilities could lead to severe breaches of security, especially in sectors like healthcare and government. The vulnerabilities range from authentication bypass to hard-coded credentials, highlighting significant security flaws that need immediate attention.

mySCADA Technologies has reported two serious vulnerabilities in their myPRO Manager software, affecting versions up to 2.1. The first vulnerability allows attackers to access privileged management functions without proper authentication, while the second lets unauthorized users send arbitrary SMS messages through a connected GSM modem. These security flaws could have severe implications for critical infrastructure sectors, including energy and transportation, as they expose systems to potential exploitation. Users are urged to upgrade to version 2.2, which addresses these issues. The vulnerabilities were disclosed to CISA, but there are currently no reports of active exploitation.

Schneider Electric has identified a vulnerability affecting its SCADAPack x70 series products, which include various Remote Terminal Units (RTUs) such as the SCADAPack 47x, 47xi, 47xd, 470R, and 57x. This vulnerability, classified under CVE-2026-81861, relates to insufficiently protected credentials that could allow unauthorized access to RTU configurations, potentially compromising sensitive information. Users of these devices are strongly urged to implement role-based access control as a primary mitigation strategy, replacing the legacy Secure Lock feature. Additionally, network segmentation and enabling the RTU firewall service are recommended to further protect against unauthorized access. This situation is particularly critical as these products are deployed globally across critical infrastructure sectors like manufacturing and energy.

A reflected cross-site scripting (XSS) vulnerability has been identified in the authentication redirect flow of Siemens Teamcenter, allowing attackers to inject malicious JavaScript into the sessions of authenticated users. This exploitation could enable unauthorized actions or data access within the affected user's Teamcenter session. The vulnerability, tracked as CVE-2026-58113, affects several versions of Teamcenter, including V2412, V2506, V2512, and V2606, prior to specific patch levels. Siemens recommends users update to the latest versions to mitigate this risk. It's crucial for organizations using Teamcenter to act quickly to protect their systems from potential exploitation.

Siemens has identified a vulnerability in its Mendix SAML module that could potentially allow attackers to hijack user accounts in certain single sign-on (SSO) configurations. This flaw, classified as CVE-2026-80465, affects multiple versions of the Mendix SAML module: those compatible with Mendix 10 and 11 versions prior to 4.2.3, and Mendix 9.24 versions before 3.6.27. The vulnerability arises from improper validation of SAML response signatures, which could be exploited by unauthenticated remote attackers. Siemens has released updates to address the issue and strongly recommends that users upgrade to the latest versions to mitigate risks. Given the high severity rating of 8.7 (CVSS), organizations using these affected versions should act promptly to secure their systems.

Siemens has identified multiple vulnerabilities affecting the Reyrolle 7SR5 device, specifically versions prior to 2.70. These vulnerabilities include issues like integer overflow, improper input validation, and insufficient authentication mechanisms, which could allow attackers to exploit the system in various ways, including unauthorized access and denial of service. Siemens urges users to upgrade to version 2.70 or later to mitigate these risks. The vulnerabilities have a high severity rating, with some classified as critical, emphasizing the potential impact on critical infrastructure sectors, particularly in energy. Users worldwide who rely on this device should take immediate action to secure their systems.

Wärtsilä FOS-Onboard, specifically version 5.07.0923.01, has been found to have critical vulnerabilities that could allow attackers to deliver unauthorized updates, execute code, or extract credentials. These vulnerabilities stem from hardcoded cryptographic keys in two components: the deployer-ng Update Controller and the robot testing framework. If exploited, these weaknesses could enable an attacker to impersonate a privileged client. Wärtsilä has stated that while these vulnerabilities are serious, they are not exploitable if the product is installed correctly. A security patch is available for users, who are advised to contact Wärtsilä for its installation. This situation raises concerns for critical infrastructure sectors, particularly in transportation systems worldwide, and emphasizes the need for organizations to implement strong cybersecurity measures.

Japan's Digital Agency has reported a significant data breach affecting approximately 240,000 individuals. Hackers took advantage of a vulnerability in a VPN product to gain access to sensitive personal information. This incident raises concerns about the security of governmental digital services and the potential misuse of the stolen data. The breach highlights the ongoing risks associated with VPN vulnerabilities, emphasizing the need for organizations to regularly update and secure their systems. Users affected by this breach should remain vigilant for any suspicious activity involving their personal information.

Homebrew, a popular package manager for macOS and Linux, released version 7.0.0 on Sunday, addressing eight security vulnerabilities in the process. The most critical issue involved a flaw that allowed unsigned removal metadata for casks—Homebrew's method for installing prebuilt applications—to execute commands with elevated privileges (sudo). To mitigate this risk, the development team removed the vulnerable recovery code and the related API accessors that could be exploited. This update is particularly important for developers who rely on Homebrew for managing their software installations, as it helps protect their systems from potential abuse. Users are encouraged to update to the latest version to safeguard against these vulnerabilities.

Telus has alerted its customers about a series of account breaches that took place over several months. Attackers managed to gain access to personal data and billing records by using stolen credentials. This breach raises significant concerns for affected subscribers, who may face identity theft or financial fraud as a result. Telus is urging its customers to update their passwords and monitor their accounts closely. The incident highlights the ongoing risks associated with credential theft and the importance of using strong, unique passwords for online accounts.

ConnectWise has addressed a serious vulnerability in its ScreenConnect software that could allow attackers to send and execute files without permission during an active remote session. This flaw has been exploited in worm-like attacks, posing a threat to organizations that rely on this remote access tool. The vulnerability emphasizes the need for users of ScreenConnect to update their software promptly to avoid potential exploitation. Companies using this service should ensure they apply the latest patches to protect their systems. The situation is a reminder of the importance of maintaining up-to-date security measures in remote access solutions.

GitLab has identified a serious vulnerability that allows unauthenticated attackers to read files from its server. This flaw poses a significant risk, especially for organizations running self-managed installations of GitLab. The company has urged all users to upgrade to the latest version immediately to protect against potential breaches. With attackers already probing the internet for systems that might be vulnerable, the urgency for an update is clear. If left unaddressed, this flaw could lead to unauthorized access to sensitive data, making timely remediation essential for affected users.

The Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, indicating they are being actively exploited. The vulnerabilities include CVE-2026-42016 and CVE-2026-42018, both affecting JFrog Artifactory, and CVE-2026-84869, which impacts ConnectWise ScreenConnect. These vulnerabilities can lead to unauthorized access and privilege escalation, posing significant risks to federal agencies and other organizations that use these products. CISA urges federal agencies to prioritize addressing these vulnerabilities rapidly as part of their security update strategies, while also encouraging all organizations to adopt similar practices to manage their exposure to cyber threats effectively.