VulnHub

AVEVA Pipeline Integrity Monitor has several vulnerabilities that could be exploited by attackers to gain unauthorized access to sensitive information or execute arbitrary code. The affected versions include those up to 2025_SP1_P1_build_7.1.9580.8513. If exploited, these vulnerabilities could allow attackers to decrypt sensitive project files, reverse engineer user passwords, and perform unauthorized read operations. AVEVA recommends that users of the affected software apply the 2025 SP1 P2 Security Update and migrate project files to mitigate these risks. This situation is particularly concerning as it affects critical infrastructure sectors and could have significant security implications for organizations worldwide.

A serious vulnerability has been identified in the Orthanc DICOM Server, affecting versions prior to 1.13.0. This flaw allows an authenticated remote attacker to exploit an integer overflow when the server decodes specially crafted PNG or JPEG images, potentially leading to a crash of the Orthanc process and causing a denial-of-service condition. The issue has been assigned CVE-2026-87020 and has a high severity score of 8.1 according to the CVSS metrics. Users of Orthanc DICOM Server worldwide, particularly in healthcare sectors, are at risk and are strongly urged to update to version 1.13.0 to mitigate the threat. No active exploitation of this vulnerability has been reported so far, but organizations should remain vigilant and take appropriate defensive measures.

ST Engineering iDirect has reported multiple vulnerabilities affecting its iQ-Series terminals, specifically the Evolution, 3315, and 9-Series models running versions 4.5.2.1 or earlier. These weaknesses could allow unauthorized access to sensitive device information and lead to denial-of-service conditions. Attackers could exploit these flaws to impersonate terminals on satellite networks, launch cross-site request forgery attacks, or escalate privileges due to inadequate authentication measures. Users are strongly advised to update their systems to version 4.5.3.0 or newer to mitigate these risks, while also implementing security best practices such as restricting access to management interfaces and monitoring for unusual activity.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has alerted that ransomware groups are actively exploiting a serious vulnerability in WatchGuard Firebox firewalls. This flaw was first identified as a point of concern in December 2023. Organizations using these firewalls are at risk of ransomware attacks, which can lead to significant data loss and operational disruption. It's crucial for affected users to address this vulnerability promptly to mitigate potential attacks. CISA's warning emphasizes the need for vigilance in cybersecurity practices, especially regarding known vulnerabilities that cybercriminals may exploit.

Recent reports indicate that several Chinese espionage groups are actively exploiting a series of zero-day vulnerabilities, targeting various organizations. These vulnerabilities are linked in a 'triple-link chain,' which makes them particularly dangerous as attackers can leverage multiple weaknesses simultaneously. Proofpoint has noted that the exploitation is ongoing and anticipates that the scope of these attacks will expand further. Organizations should be vigilant and assess their security measures to protect against these threats, as the risk of data breaches and espionage increases with such active exploitation. The situation underscores the need for enhanced monitoring and prompt patch management to safeguard sensitive information.

Recent research indicates that Chinese espionage groups are exploiting a series of three linked zero-day vulnerabilities, which significantly increases their effectiveness in cyberattacks. These vulnerabilities allow attackers to infiltrate systems undetected, posing a serious risk to various organizations, particularly in sectors that handle sensitive information. The exploitation of these zero-days can lead to unauthorized access to data and systems, making it crucial for companies to remain vigilant and proactive in their cybersecurity measures. Experts recommend that organizations review their security protocols and apply any available patches or updates to mitigate the risk. This situation serves as a reminder of the persistent and evolving nature of cyber threats, especially from state-sponsored groups.

Schneider Electric and Siemens have released important patches to address critical vulnerabilities in their industrial control systems. These updates come as part of the regular security maintenance from these companies, which also includes patches from AVEVA and Rockwell Automation. The vulnerabilities could potentially allow attackers to exploit system weaknesses, which is particularly concerning given the critical role these systems play in managing infrastructure and industrial operations. Organizations using affected products are urged to apply these patches promptly to safeguard their systems against potential attacks. Ensuring these updates are implemented can help prevent unauthorized access and maintain operational safety.

Hackers have successfully breached F5 BIG-IP APM devices, deploying a Linux rootkit that can intercept PHP file loading. This rootkit is particularly concerning because it can inject a fileless web shell directly into the device's memory, which means it doesn't leave malicious code on the disk, making detection more challenging. Organizations using F5 BIG-IP APM solutions could be at risk, as the attackers can exploit these vulnerabilities to gain unauthorized access. This situation emphasizes the need for heightened security measures and vigilance among companies that rely on these devices to protect sensitive data. Users should be aware of the potential for exploitation and take immediate action to secure their systems.

SAP has addressed a serious vulnerability in its kernel code that allows unauthenticated remote attackers to execute arbitrary commands, access sensitive information, and alter data. This flaw poses a significant risk to organizations using SAP systems, as it can lead to unauthorized access and data breaches. The issue is particularly concerning because it doesn't require authentication, making it easier for attackers to exploit. Companies should prioritize applying the latest patches to safeguard their systems against potential exploitation. The patching process is essential to maintain data integrity and protect sensitive information from malicious actors.

A vulnerability has been identified in the CareCam Pro IP Cameras, specifically affecting the ANJIA AJL33PC0801 model. This vulnerability, designated as CVE-2026-85083, arises from the use of hard-coded credentials for bootloader authentication. Attackers with physical access to the camera can exploit this weakness to gain privileged access, potentially allowing them to modify firmware and configurations, resulting in full control of the device. The issue has been noted as a medium severity threat with a CVSS score of 6.8. Users are advised to take precautions, as CareCam has not yet responded to the Cybersecurity and Infrastructure Security Agency (CISA) regarding remediation efforts.

The Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, indicating that these flaws are actively being exploited in the wild. The vulnerabilities include CVE-2026-75650 affecting Adobe Commerce and Magento, CVE-2026-81963 and CVE-2026-85880 impacting Microsoft Windows, and CVE-2026-86218 concerning N-able N-central. These vulnerabilities are particularly concerning for federal agencies, as they could allow attackers to gain total control over compromised systems. CISA's Binding Operational Directive 26-04 emphasizes the need for federal agencies to promptly address high-risk vulnerabilities, and while it specifically applies to federal entities, CISA encourages all organizations to adopt similar practices for managing and mitigating risks associated with these vulnerabilities.