Vulnerability intelligence

CVE-2026-105445 is a vulnerability in Docker Hub's identity and access management system, specifically within the feature that converts a personal account into an organization. When a personal account is converted, the user must designate an existing account as the organization's owner. The flaw occurred because this conversion process transferred the original account's personal access tokens (PATs) to the designated owner's account without changing or revoking the token's secret. Consequently, an attacker could create a personal account, generate a PAT, and convert that account into an organization while naming a target user as the owner. Because the token's ownership record was updated to the victim but the secret remained the same, the attacker could use the token to authenticate as the target user. This flaw allowed unauthorized users to impersonate victims to pull, push, or delete container images in their personal repositories and connected organizations, depending on the token's permissions. However, the vulnerability was limited to registry access; it did not grant access to the Docker Hub web interface, nor could it be used to change passwords, email addresses, or two-factor authentication settings. Discovered by security researchers who dubbed it "GhostPat," the exposure window lasted from August 26, 2024, until Docker deployed a backend fix on September 30, 2026. Docker reported finding no evidence of active exploitation in the wild.

CVE-2025-41450 is an improper authentication vulnerability affecting the Danfoss AK-SM8xxA Series, which are system managers used to orchestrate refrigeration and HVAC systems in the food retail sector. Discovered by researchers at Claroty, the flaw is rooted in a hidden "code-of-the-day" authentication mechanism that utilizes a password based on the current date. By abusing this mechanism, an attacker can bypass normal authentication controls on the device. Successfully exploiting this vulnerability allows an attacker to access the device's administrative interface and generate web reports containing sensitive information, such as internal IP addresses, usernames, and store names. This vulnerability, alongside others in the same product line, has been highlighted in the context of cyberattacks targeting supermarket refrigeration systems to disrupt temperature controls. Danfoss has released firmware updates to remediate the issue.

CVE-2026-87690 is a relative path traversal vulnerability (CWE-22) affecting the `post/apple_ios/gather/ios_image_gather` post-exploitation module in the Rapid7 Metasploit Framework. The issue arises because the module interpolates file names retrieved from a Meterpreter directory listing—which can be fully controlled by a hostile or tampered iOS device—directly into the local destination path without proper sanitization. Because the underlying file-writing function writes to any supplied path, directory traversal sequences (such as `../`) can allow files to be written outside of the intended `~/.msf4/loot/` directory. An attacker controlling a compromised iOS device can exploit this flaw by luring a Metasploit operator into running the affected gather module. This allows the attacker to overwrite local files on the operator's workstation, specifically targeting the `~/.msf4/msfconsole.rc` resource file, which automatically executes at startup. By writing malicious Ruby code or loading a custom plugin through this file, the attacker can achieve persistent code execution with the operator's privileges upon the next launch of the console. The vulnerability has been addressed in Metasploit Framework version 6.5.5 and later by applying sanitization to directory listing entries.

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.