Vulnerability intelligence

CVE-2024-21338 is an elevation of privilege vulnerability found within the Windows kernel, specifically residing in the `appid.sys` AppLocker driver. This flaw allows an attacker with low-privileged local code execution to escalate their privileges to SYSTEM-level by exploiting an exposed Input/Output Control (IOCTL) handler. The vulnerability stems from insufficient validation of user-supplied input within the `AppHashComputeImageHashInternal()` function, which can be invoked by sending a specially crafted IOCTL request to the `\Device\Appid` device object. By manipulating this IOCTL request, an attacker can cause the driver to execute an attacker-chosen routine in kernel context, effectively crossing the admin-to-kernel security boundary. This vulnerability affects supported versions of Windows 10, Windows 11, and Windows Server.

CVE-2026-33557 describes an authentication bypass vulnerability found in Apache Kafka. The flaw stems from the default configuration of the `sasl.oauthbearer.jwt.validator.class` property, which is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. This default validator fails to properly validate JSON Web Token (JWT) signatures, issuers, or audiences. As a result, a remote attacker can exploit this weakness by crafting a malicious JWT token containing an arbitrary `preferred_username`. This allows the attacker to bypass authentication and gain unauthorized access to the Kafka broker. Apache Kafka versions 4.1.0 and 4.1.1 are affected, with the issue resolved in versions 4.1.2, 4.2.0, and later, which correctly validate JWT tokens. A recommended workaround for affected versions is to explicitly configure `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator`.

CVE-2026-13753 describes a missing authorization vulnerability found in the embedded web server of HP Deskjet 2800 Series Printers running firmware version TBP1CN2612AR and earlier. This flaw allows an unauthenticated attacker with network access to send direct GET requests to specific administrative API endpoints. Through this method, the attacker can retrieve sensitive configuration data that would normally require administrator credentials when accessed via the printer's web interface. The exposed information includes plaintext Wi-Fi Direct credentials, unique device identity details, and other administrative security state information. This bypasses the intended web interface security by failing to validate session states at the backend API layer.

Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.

CVE-2026-56291 is a vulnerability found in the Joomla extension Balbooa Forms. It is categorized as an unauthenticated arbitrary file upload flaw, meaning an attacker can upload executable files without needing to authenticate to the system. This capability can lead to full Remote Code Execution (RCE) on affected systems. The vulnerability has been added to CISA's Known Exploited Vulnerabilities Catalog, indicating that it is being actively exploited in the wild.

CVE-2026-48939 describes an unrestricted file upload vulnerability found within the iCagenda extension for Joomla. This flaw permits the upload of arbitrary files through the file attachment feature. The vulnerability ultimately enables the upload and execution of PHP code on the affected server. This issue has been added to CISA's Known Exploited Vulnerabilities Catalog, indicating that it is being actively exploited.