Threat Library

Vercel patched two critical unauthenticated remote code execution vulnerabilities in the Next.js framework: one triggered via specially crafted AVIF image files, and another via a path traversal flaw affecting Windows-hosted servers. Both flaws could allow attackers to fully compromise affected servers without authentication, posing a significant risk to any organization running unpatched Next.js deployments.

Manchester Airports Group (MAG) disclosed a breach in which attackers accessed and stole customer data, including Wi-Fi sign-up information from Manchester, Stansted, and East Midlands airports. The incident highlights ongoing risks to critical transportation infrastructure operators handling large volumes of traveler personal data.

PaperCut has disclosed active zero-day exploitation of a vulnerability affecting all versions of its PaperCut NG and PaperCut MF print management software. Attackers are leveraging the flaw in real-world attacks prior to patch availability or widespread patch adoption, echoing previous high-profile PaperCut exploitation campaigns.

CISA has added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: an ownCloud improper authentication flaw, an unspecified Linux Kernel vulnerability, and a JFrog Artifactory path traversal issue. These vulnerabilities pose significant risk to federal and enterprise systems and are subject to expedited remediation under BOD 26-04. Organizations using these technologies should prioritize patching to prevent exploitation.

A vulnerability (CVE-2025-2399) in multiple Mitsubishi Electric CNC Series products allows a remote attacker to trigger an out-of-bounds read by sending specially crafted packets to TCP port 683, resulting in a denial-of-service condition. The flaw affects a wide range of M800/M80/E80, M800V/M80V, and M700V/M70V/E70 series controllers used in industrial manufacturing environments. Vendor fixes are available for most affected product lines, with mitigations recommended for systems that cannot be immediately patched.

The Xiiaozet LK100W device, versions prior to 2.1.240, contains three critical vulnerabilities including OS command injection, missing authentication for a critical function, and an authentication bypass that together could allow a remote attacker to fully compromise the device. Two of the three flaws are rated CVSS v3.1 9.8 (Critical) and require no authentication or user interaction to exploit remotely. CISA has published an advisory recommending immediate firmware update to v2.1.240.

Rockwell Automation OTTO Fleet Manager versions up to V2.36.2 use a bcrypt implementation with an insufficient work factor, weakening stored password hashes against offline brute-force attacks. Exploitation requires an attacker to first obtain an unencrypted system backup, after which weakly hashed credentials could be cracked more easily. Rockwell has released version 2.36.3 to remediate the issue, along with guidance to enable encrypted system backups.

A critical flaw in openssl_encrypt (before 1.4.9) allows attackers to inject unsanitized ANSI escape sequences into the email field of identity documents, enabling forgery of the fingerprint verification line shown to users. This undermines the out-of-band verification mechanism designed to prevent key substitution/MITM attacks, allowing attackers to trick users into trusting an attacker-controlled key.

openssl_encrypt versions prior to 1.4.9 fail to properly re-derive and validate cryptographic fingerprints when loading identities from identity.json, allowing attackers to silently substitute public keys while preserving the claimed fingerprint. This enables man-in-the-middle style attacks where encrypted data is protected with attacker-controlled keys and forged signatures pass verification, undermining the core trust model of the identity store.

A critical unauthenticated remote code execution vulnerability affects the ILIAS learning management system, stemming from insecure PHP deserialization of session data via the Shibboleth logout endpoint. An attacker can seed a malicious serialized object into any live session via the unauthenticated LTI entry point, then trigger its instantiation and destructor via the logout-notification handler to write attacker-controlled content to an arbitrary path under the web root, achieving code execution as the web server user.

The getgrav/grav-plugin-api plugin before version 1.0.18 fails to properly validate API key scope in a critical authorization function, allowing an API key with limited privileges to perform super-admin actions if it belongs to a super-admin account. This flaw enables attackers holding a low-scoped but valid API key to disable 2FA, hijack or delete API keys, and manipulate super-admin accounts, effectively granting full administrative takeover.

DB-GPT, an open-source LLM/AI agent development framework, contains an unauthenticated path traversal vulnerability in its skill upload endpoint that allows arbitrary file writes anywhere the server process can write. Combined with a broken authentication dependency that grants admin privileges by default, attackers can plant or overwrite Python modules to achieve full remote code execution with no credentials required.

JFrog Artifactory is affected by a path traversal vulnerability that allows an authenticated user to write files outside the intended Docker cache directory under specific remote-repository configurations. CISA has added this CVE to its Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild, with a remediation deadline of September 10, 2026. Organizations using Artifactory as a package/artifact registry should treat this as a priority patching item.

A privilege escalation vulnerability in the Linux Kernel's IPv6 networking subsystem has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. The flaw affects multiple Linux distributions including SUSE and Red Hat, with a compressed remediation window of only three days from disclosure to due date, signaling high urgency and severity.

CVE-2023-49105 is an improper authentication vulnerability in ownCloud that allows attackers to access, modify, or delete arbitrary files without valid credentials when a victim's username is known and no signing-key is configured. The flaw has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Organizations using ownCloud for file storage or as a backend for automated data pipelines face high risk of unauthorized data access and manipulation.

A subscription-based adversary-in-the-middle phishing toolkit called NovaCookies is being used to abuse legitimate Docusign notification emails to lure victims into fraudulent Microsoft 365 login flows. The service acts as a reverse proxy that captures authenticated session cookies, allowing attackers to bypass MFA and hijack active Microsoft 365 sessions for $320/month.

Nimbus Manticore, an Iranian state-sponsored APT group affiliated with the IRGC, has expanded its toolset with a new TWOSTROKE-like backdoor and an SSH tunneling utility, according to Group-IB research. The group is characterized as one of the most active Iranian threat actors in 2026, conducting cyber espionage operations using newly discovered infrastructure and malware.

The U.S. DoJ and FBI disrupted infrastructure operated by China-linked threat actor QTFY, tied to Nanjing Xinjiuwei Network Technology Company, which used two custom hacking platforms—QScan and QTRouter—to target U.S. critical infrastructure and sensitive networks. The takedown highlights ongoing state-sponsored efforts to compromise network edge devices for espionage and data theft purposes.

Meta has agreed to a proposed settlement of up to approximately $18 billion with a bipartisan coalition of 52 state attorneys general over allegations that Facebook and Instagram were designed to foster compulsive use among children and teenagers. This is a legal and regulatory matter rather than a cybersecurity incident, involving no technical exploitation, vulnerability, or malicious activity.

Researchers disclosed GPUThor, a new Rowhammer-class attack that defeats NVIDIA's ECC memory protections, allowing attackers with local access to induce bit flips leading to denial-of-service or root-level privilege escalation. This is particularly concerning for shared GPU infrastructure such as cloud AI training clusters and multi-tenant inference environments.