Loading story…
A set of seven vulnerabilities affecting the Graylog Web Interface v2.2.3 was coordinated for public disclosure by INCIBE-CERT, including CVE-2026-1435 (CVSS v4.0 9.1, CWE-613) and additional issues CVE-2026-1436 (CVSS v4.0 7.0, CWE-284) plus CVE-2026-1437 through CVE-2026-1441 (CVSS v4.0 6.1, CWE-79). The flaws were reported as discovered by Julen Garrido Estévez (B3xal) and impact Graylog’s web UI component used for log management and security/IT operations.
Technical details published for CVE-2026-1435 indicate incorrect session invalidation: Graylog generates a new sessionId on each login but does not invalidate previously issued session identifiers, allowing a stolen/leaked old token to remain usable for authenticated requests. An attacker with network access to the Graylog web service/API (e.g., port 9000 or the server’s HTTP/S endpoint) could reuse an old sessionId to gain unauthorized access and act via the web UI/API under the affected account. INCIBE-CERT recommends updating to a patched/current Graylog version, noting older versions are considered obsolete and are not otherwise mitigated.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A vulnerability affecting the Graylog Web Interface version 2.2.3 was publicly disclosed as CVE-2026-1435. The flaw allows previously issued session identifiers to remain valid after subsequent logins, creating a risk of unauthorized access if a session ID is stolen or leaked.
INCIBE-CERT issued an alert warning about multiple vulnerabilities in Graylog. The advisory indicates broader public reporting and awareness of security issues affecting the product.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of critical and high-severity vulnerabilities affecting a diverse set of software products were publicly disclosed in October 2025. Epsilon RH by Grupo Castilla was found to have a SQL injection vulnerability (CVE-2025-41028) that allows attackers to manipulate the database by sending crafted POST requests to the 'sEstadoUsr' parameter in the '/epsilonnetws/WSAvisos.asmx' endpoint. Lanscope Endpoint Manager (CVE-2025-61932) was reported to have an improper origin verification flaw, enabling attackers to execute arbitrary code via specially crafted packets, though remote exploitation is not possible. Galaxy Software Services Vitals ESP Forum Module (CVE-2025-31342) was discovered to allow remote authenticated users to upload dangerous files, leading to arbitrary command execution. Fsas Technologies Inc.'s ETERNUS SF (CVE-2025-62577) contains incorrect default permissions, allowing low-privileged users to obtain database credentials and potentially escalate privileges to execute OS commands as an administrator. Excellent Infotek's Document Management System (CVE-2025-11948) is vulnerable to unauthenticated arbitrary file upload, enabling attackers to deploy web shells and execute code on the server. Vvveb CMS up to version 1.0.5 is susceptible to authenticated code injection via its Code Editor, allowing attackers to modify files and achieve remote code execution. The Theme Editor plugin for WordPress (CVE-2025-9890) is vulnerable to cross-site request forgery, which can be exploited to achieve remote code execution if an administrator is tricked into clicking a malicious link. The PPOM plugin for WooCommerce (CVE-2025-11391) allows unauthenticated arbitrary file uploads, posing a severe risk to affected e-commerce sites. The Appointments plugin for WordPress (CVE-2017-20206) and the Flickr Gallery plugin (CVE-2017-20207) both suffer from unauthenticated PHP object injection vulnerabilities, which have been actively exploited to create backdoors using the WP_Theme() class. RegistrationMagic (CVE-2017-20208) is also affected by a PHP object injection flaw, allowing attackers to fetch and install remote files. Finally, BLU-IC2 and BLU-IC4 devices (CVE-2025-11925) have an API that returns an incorrect Content-Type header, potentially enabling HTML/JavaScript injection in responses. Each of these vulnerabilities presents a significant risk, with several allowing remote code execution, privilege escalation, or the installation of persistent backdoors. The affected products span web applications, content management systems, endpoint management tools, and specialized enterprise software. Security teams are advised to review the specific advisories, apply patches or mitigations where available, and monitor for signs of exploitation, as several vulnerabilities have been reported as actively exploited in the wild. The diversity and severity of these disclosures underscore the ongoing need for rigorous vulnerability management and timely response to public advisories.
Jun 29, 2026
Two high-severity vulnerabilities in **Incus** exposed users to host compromise through separate attack paths fixed in version **6.23.0**. **CVE-2026-33897** allows a low-privileged user to abuse `pongo2` processing in instance template files to bypass expected chroot-based filesystem isolation and perform arbitrary file reads and writes as **root** on the host. The issue affects Incus versions prior to `6.23.0` and carries a CVSS v3.1 score reflecting high impact across confidentiality, integrity, and availability. A second flaw, **CVE-2026-33898**, affects the temporary local web server launched by `incus webui`, which improperly accepts an invalid authentication token when that token is passed in the URL. An attacker able to reach that localhost service could obtain the same Incus access as the user who started the interface, creating a path to local privilege escalation or remote abuse if a user is lured into interacting with the web UI. The bug is tracked as **CWE-287**, while the template-isolation failure is mapped to **CWE-1336**; both issues were disclosed through GitHub security advisories and resolved in **Incus 6.23.0**.
Jun 29, 2026
GitLab disclosed and remediated three high-severity vulnerabilities in GitLab CE/EE that could be exploited by unauthenticated attackers under certain conditions. **CVE-2026-4922** is a cross-site request forgery flaw (`CWE-352`) that could let an attacker trigger GraphQL mutations as an authenticated user, while **CVE-2026-5262** is a cross-site scripting issue (`CWE-79`) that could expose tokens in the Storybook development environment. GitLab also fixed **CVE-2026-5816**, an improper path validation flaw (`CWE-41`) that could allow arbitrary JavaScript execution in a victim’s browser session. The issues affect multiple GitLab CE/EE release lines, with patched versions identified as **18.9.6**, **18.10.4**, and **18.11.1** depending on the flaw. CVE-2026-4922 affects versions from `17.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; CVE-2026-5262 affects versions from `16.1.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; and CVE-2026-5816 affects `18.10` before `18.10.4` and `18.11` before `18.11.1`. The vulnerabilities carry CVSS v3.1 ratings reflecting high confidentiality and integrity impact, and GitLab linked the disclosures to its patch release notice, internal work items, and HackerOne reports.
Jun 29, 2026