Vulnerability intelligence

CVE-2025-8088 is a path traversal vulnerability affecting the Windows version of WinRAR. It allows attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild. It was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET. The vulnerability was exploited in phishing attacks to deliver RomCom malware. The attackers can trick the program into saving a file in a different location than the user intended, such as the computer's Startup folder. This allows the attackers to execute their own code. WinRAR patched the vulnerability in version 7.13.

CVE-2025-43529 is a use-after-free vulnerability in WebKit that can be exploited by processing maliciously crafted web content. Google's Threat Analysis Group discovered this flaw. Apple has released security updates for iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari to address this vulnerability, as it may have been exploited in targeted attacks against specific individuals using versions of iOS before iOS 26. Devices impacted include iPhone 11 and later, iPad Pro 12.9-inch (3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later), and iPad mini (5th generation and later).

CVE-2026-20700 is a memory corruption vulnerability found within Apple's `dyld` component, which is the Dynamic Link Editor responsible for loading dynamic libraries into memory and bridging application code with system frameworks. This flaw could enable an attacker with memory write capabilities to execute arbitrary code on affected devices. Apple addressed this issue through improved state management in updates for watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, visionOS 26.3, iOS 26.3, and iPadOS 26.3. Reports indicate that this vulnerability may have been exploited in "extremely sophisticated attacks" targeting specific individuals on versions of iOS preceding iOS 26. Google's Threat Analysis Group is credited with discovering and reporting the vulnerability.

CVE-2026-21589 is a path traversal and arbitrary file access vulnerability that affects multiple self-hosted Atlassian Data Center and Server products, including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. The flaw allows remote, unauthenticated attackers to access specific files within the web application's root directory. To successfully exploit the vulnerability, an attacker must know the exact name and path of the target file, as the flaw does not allow directory listing or file enumeration. The vulnerability impacts all versions of the affected products prior to their designated fixed releases. While Atlassian's cloud-based services are secure and require no action, organizations utilizing self-hosted deployments are advised to upgrade to the patched versions. For systems that cannot be immediately updated, recommended mitigations include taking internet-facing instances offline, deploying web application firewall (WAF) rules, or configuring URL rewriting rules to block directory traversal attempts containing double-dot (`../`) sequences.

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

CVE-2026-105134 is an operating system command injection vulnerability affecting the Replication Receiver component of the AhsayCBS backup utility, specifically within the `/rps/api/json/UpdateReceivers.do` endpoint. The flaw stems from the improper neutralization of user-supplied input, which allows remote attackers to manipulate the `random` argument. The affected API also contains an authentication bypass mechanism that permits a random token to substitute for valid credentials. Consequently, remote, unauthenticated attackers can exploit this vulnerability to execute arbitrary commands with system privileges (such as NT AUTHORITY\SYSTEM) on the host. In active campaigns, threat actors have been observed chaining CVE-2026-105134 with CVE-2026-105133—an improper authentication flaw in the utility's `checkSysPwd` function—to bypass authentication and achieve remote code execution. After gaining access, attackers configure a malicious replication receiver and drop Java Server Page (JSP) web shells into the application directory. These intrusions are typically followed by reconnaissance and the deployment of payloads, such as XMRig cryptocurrency miners disguised as Microsoft Edge processes, alongside evasion scripts designed to terminate mining activities if administrative monitoring tools are opened.