VulnHub

A serious vulnerability has been discovered in the Ghostscript interpreter, identified as CVE-2026-39919. This flaw allows attackers to exploit a heap buffer overflow, which could lead to remote code execution if they upload specially crafted PDF files. This vulnerability poses a significant risk to any servers running the Ghostscript software, as it could enable unauthorized access and control. Organizations using Ghostscript need to be particularly vigilant, as the potential for exploitation could result in severe data breaches or system compromises. It's crucial for users to stay updated on this issue to protect their systems from potential attacks.

A newly discovered vulnerability, identified as CVE-2026-104935, affects Ivanti Connect Secure, a widely used VPN solution. This zero-day exploit allows attackers to execute code remotely without authentication, ultimately granting them root access even on systems that have been fully patched. This poses a significant risk to organizations relying on Ivanti's VPN for secure remote access, as it could lead to unauthorized control over sensitive networks. Companies utilizing this software should take immediate action to secure their systems and monitor for any signs of exploitation. The implications of such a vulnerability underscore the importance of maintaining vigilance in cybersecurity practices.

Docker has revealed a serious vulnerability in Docker Hub, identified as CVE-2026-105445. This flaw allowed attackers to impersonate other users by exploiting a personal access token (PAT), which could lead to unauthorized access to container repositories. As a result, attackers could potentially tamper with images stored in these repositories, posing significant risks to users who rely on Docker Hub for their container management. The incident underscores the need for all Docker Hub users to review their security practices, especially regarding the management of access tokens. Docker has urged users to take steps to secure their accounts and monitor their repositories for any unauthorized changes.

A serious security vulnerability in SonicWall Secure Mobile Access (SMA) 1000 appliances has been exploited by attackers shortly after it was made public. This flaw, identified as CVE-2026-102255, has a maximum severity score of 10.0 and involves pre-authenticated server-side request forgery (SSRF), which could enable remote attackers to manipulate the appliance into making unauthorized requests. SonicWall users are at risk, as the vulnerability has already seen 135 exploitation attempts. This situation underscores the urgency for affected organizations to act quickly to secure their systems and protect sensitive data from potential breaches.

A serious security vulnerability has been discovered in the Bricksforge plugin for WordPress, identified as CVE-2026-85097, which has a maximum severity score of 10.0. This flaw allows unauthenticated attackers to upload and run arbitrary PHP code on affected WordPress sites, leading to remote code execution (RCE). According to Patchstack, the exploit is currently being actively used in the wild, putting numerous WordPress installations at risk. Website owners using the Bricksforge plugin should take immediate action to secure their sites against this threat, as the vulnerability could lead to significant data breaches or site compromises. It's crucial for users to stay updated with security patches and monitor their systems for any unusual activity.

Researchers have released a working exploit for a serious flaw in AnyDesk's Linux software that allows attackers to execute code remotely and gain root access without any user authentication. This vulnerability was patched in version 8.0.3 in June 2023, but the company described the fix vaguely as a bug that could cause crashes, failing to assign a CVE identifier. Users of AnyDesk on Linux systems are at risk, as the exploit can be executed before a connection is approved. This situation raises concerns about the transparency of security updates and the potential for malicious exploitation if users do not update their software promptly.

Attackers are exploiting two recently disclosed vulnerabilities in the AhsayCBS backup utility, which is used for data backup and recovery. These flaws allow the attackers to take control of affected devices and deploy malicious software, including web shells and XMRig cryptocurrency miners disguised as Microsoft Edge. The specific vulnerability, identified as CVE-2026-105133, has a CVSS v4 score of 5.5, indicating a moderate level of risk. This situation primarily affects users of the AhsayCBS backup software, which could lead to unauthorized access and potential financial losses due to the mining activities. Companies using this utility should be vigilant and assess their systems for these vulnerabilities to prevent exploitation.

A serious vulnerability in SonicWall SMA1000 appliances, identified as CVE-2026-102255, is currently being exploited by attackers. This flaw, which was patched just three days ago, poses a significant risk as it allows unauthorized access to systems using these devices. Organizations that have not yet applied the latest patch are particularly vulnerable to attacks. SonicWall has urged users to update their systems immediately to mitigate this threat. The urgency of the situation is heightened by the fact that the vulnerability is actively being exploited in the wild, making swift action essential for affected users.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five vulnerabilities to its Known Exploited Vulnerabilities catalog, which are being actively exploited by a China-linked group known as Flax Typhoon. One of the most critical vulnerabilities is CVE-2015-3306, which has a maximum severity score of 10.0 and involves improper access control in ProFTPD, a popular FTP server software. This exploitation poses a significant risk to federal agencies and other organizations using affected systems, as attackers can potentially gain unauthorized access. CISA has set an October 11 deadline for these agencies to address the vulnerabilities to mitigate the risk of exploitation. Organizations should prioritize applying patches and updates to secure their systems against these threats.

Recent vulnerabilities in AhsayCBS, identified as CVE-2026-105133 and CVE-2026-105134, are being actively exploited by attackers. These flaws allow unauthorized users to bypass authentication and execute operating system commands, posing a significant risk to systems running this backup software. Organizations using AhsayCBS should be particularly vigilant, as these vulnerabilities could lead to unauthorized access and manipulation of sensitive data. The situation underscores the necessity for timely software updates and vulnerability management to protect against such exploits. Users are urged to monitor for any updates from Ahsay and implement any available patches as soon as possible.

Citrix has addressed a serious security vulnerability, identified as CVE-2026-107406, affecting its NetScaler ADC and NetScaler Gateway products. This memory overflow issue could allow attackers to execute remote code or cause a denial-of-service (DoS) under specific configurations. Users of these products need to be aware of the potential risks, as exploitation could lead to significant disruptions or unauthorized control of their systems. Citrix has released patches to mitigate this vulnerability, emphasizing the importance of updating systems to protect against potential attacks. Keeping software current is a crucial step for organizations to safeguard their networks from emerging threats.

Satel Netco Design has several vulnerabilities that could be exploited by attackers to execute arbitrary scripts in users' browsers, manipulate files, and potentially run unauthorized code. The affected versions of Satel Netco Design are those prior to v2.1.7. Specifically, vulnerabilities include stored cross-site scripting, inefficient regular expression complexity, and relative path traversal, all of which could lead to significant security issues. Users with Network Operator and Viewer privileges are particularly at risk as they may be able to exploit these flaws. Satel has advised all users to upgrade to version 2.1.7 to mitigate these risks, which underscores the importance of keeping software up to date to protect against potential attacks.

Red Lion Controls has identified multiple vulnerabilities in the N-Tron 700 Series devices that could allow attackers to gain administrative access. Successful exploitation could enable unauthorized users to view, edit, and upload configuration files, and even cause the devices to reboot continuously. The affected versions include firmware versions up to 3.11.0 and bootloader versions up to 2.0.6.1. Users are urged to upgrade to firmware version 3.11.1 or later and take additional measures, such as disabling web GUI access and configuring SNMP communities. This is particularly concerning as these devices are deployed across critical infrastructure sectors globally, potentially putting sensitive systems at risk.

The Grid Protection Alliance has identified multiple vulnerabilities in its openPDC and openHistorian products, affecting versions prior to 2.9.482 and 2.8.585, respectively. These vulnerabilities include issues like deserialization of untrusted data, missing authentication, and server-side request forgery, which could allow attackers to execute arbitrary code or access sensitive data without proper authentication. Notably, the internal data publisher in openPDC can be accessed by unauthenticated network attackers, posing a serious risk. The company has released patches for these vulnerabilities in the latest versions, but users running older versions or Docker images are advised to take immediate action to secure their systems. This situation underscores the importance of maintaining updated software in critical infrastructure sectors, such as energy.