Lantronix Exploits, Azure Bugs Lead Security Briefing
Actively exploited Lantronix flaws and critical Azure privilege escalation bugs dominate today's security landscape.
A critical command injection vulnerability in Lantronix EDS5000 devices, CVE-2025-67038, is being actively exploited. The flaw lies in the HTTP RPC module, which fails to sanitize usernames when writing logs after failed authentication attempts, allowing for shell command execution. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, highlighting its immediate threat to operational technology (OT) environments. Organizations using affected Lantronix devices should apply patches or mitigations immediately to prevent further compromise. As The Hacker News reported, CISA's warning underscores the urgency of addressing this flaw.
Microsoft Azure and Windows environments are facing multiple critical vulnerabilities, including authorization bypass and missing authentication flaws. CVE-2026-83711 and CVE-2026-70352, detailed by Vypr Intelligence, allow for privilege escalation over a network. Additionally, CVE-2026-69502, an SSRF vulnerability in Azure SQL Database, also enables privilege escalation, as noted by The Hacker News and SecurityWeek. These vulnerabilities pose a significant risk to data integrity and system security within Azure deployments.
Several WordPress plugins are affected by critical vulnerabilities, including unauthenticated RCE, authentication bypass, and privilege escalation. The ComboBlocks plugin (CVE-2024-11080) and Mstore Api plugin (CVE-2026-13447) present significant risks due to their exploitable nature. Furthermore, the AI Website Builder plugin (CVE-2026-82923) allows unauthenticated attackers to install and activate plugins and themes. As Vypr Intelligence highlighted, a batch of 25 vulnerabilities has been disclosed, with these critical flaws demanding immediate attention from administrators.
Critical vulnerabilities have been identified in ASUS Control Center, allowing unauthorized users to obtain encryption keys and gain local service control. CVE-2026-75754, as reported by Cyber Security News, encompasses missing authentication for critical functions, SSRF, and hard-coded credentials. This could lead to a complete compromise of the system, emphasizing the need for prompt patching by affected users.
Multiple critical vulnerabilities exist within the XING CPTrans-ME-X system, including OS command injection and the use of hard-coded and default passwords. CVE-2026-62928, CVE-2026-70403, and CVE-2026-69657 expose the system to unauthenticated command execution and unauthorized access. Administrators should prioritize updating or mitigating these vulnerabilities to secure their environments.
The FreeIPMI software, versions prior to 1.6.19, contains multiple stack-based buffer overflow vulnerabilities. CVE-2026-85509, CVE-2026-85508, and CVE-2026-85504 can be triggered by malformed responses or oversized data, potentially leading to denial-of-service or code execution. Users of FreeIPMI should update to a patched version to address these security risks.
The DocsGPT application, versions 0.15.0 and below, has a critical vulnerability related to prompt injection. CVE-2026-31020 allows for the rendering of user-supplied prompt data through Jinja templates without proper sanitization, potentially leading to code execution or data leakage. Prompt remediation and updating to a secure version are recommended.
WWBN AVideo's notify.ffmpeg.json.php script contains a path traversal vulnerability, CVE-2026-86189. This allows unauthenticated attackers to write files to arbitrary locations on the server by manipulating the 'avideoRelativePath' parameter, posing a significant security risk.
The Hkuds AutoAgent has an unauthenticated remote code execution vulnerability in its TCP server. CVE-2026-86124 allows attackers to execute arbitrary commands as root by connecting to the exposed port, necessitating immediate attention and patching.
Voltronic Power SNMP Web Pro 1.1 is affected by an unauthenticated remote code execution vulnerability. CVE-2026-44402 allows attackers to upload a crafted archive via the upload.cgi endpoint, leading to arbitrary command execution as root.
The ACPT (Premium) WordPress plugin, up to version 2.0.66, has a privilege escalation vulnerability due to missing authorization checks in its submit() function. CVE-2026-15354 allows unauthenticated users to submit forms, potentially leading to unauthorized actions.
Lightstar's SmartIT Desktop Manager contains a hard-coded password vulnerability. CVE-2026-85148 allows unauthenticated remote attackers to access user hosts by exploiting the known credential.