Loading story…
Two high-severity vulnerabilities in WeKan before version 8.35 expose its integration features to abuse by low-privileged authenticated users. CVE-2026-41454 is a missing authorization flaw (CWE-862) in Integration REST API JsonRoutes handlers that allows authenticated board members to perform administrative integration actions without proper privilege checks. Attackers can enumerate integrations and webhook URLs, create, modify, or delete integrations, and manage integration activity, creating significant confidentiality and integrity risk.
A second flaw, CVE-2026-41455 (CWE-918), allows server-side request forgery through webhook integration URL handling because the url schema field accepts arbitrary destinations without protocol or target validation. An attacker able to create or modify integrations can force the server to send HTTP POST requests to internal network services and leak full board event payloads; the advisory also says response handling can be abused to overwrite arbitrary comment text without authorization checks. WeKan published fixes and released version 8.35 to address both issues.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Two high-severity WeKan vulnerabilities were disclosed: CVE-2026-41454, which lets authenticated board members perform unauthorized administrative integration actions, and CVE-2026-41455, an SSRF issue in webhook integrations that can target internal services and expose board event payloads. Both affect WeKan versions before 8.35.
WeKan published version 8.35 containing fixes for two vulnerabilities affecting earlier releases: a missing authorization issue in Integration REST API endpoints and an SSRF flaw in webhook URL handling. The references indicate both a fixing code change and the 8.35 release as the remediation point.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kiteworks released security updates addressing **126 vulnerabilities** across Kiteworks Core, Email Protection Gateway (EPG), and Secure Data Forms (SDF). The most serious flaws affect Core and EPG versions earlier than `9.5.1`, including critical account-takeover vulnerabilities that could expose sensitive files, email workflows, sharing functions, and administrative capabilities. Core fixes also include arbitrary code execution, privilege escalation, and exposure of internal network resources; EPG and SDF fixes address unauthorized data modification, denial of service, and security-bypass issues. The Canadian Centre for Cyber Security issued advisory **AV26-988** urging organizations to review Kiteworks advisories and apply available updates. Administrators should upgrade affected deployments to `9.5.1` or later where applicable, identify internet-facing instances, and investigate suspicious account activity or indications of unauthorized access, particularly before remediation changes alter available evidence.
Oct 2, 2026
A newly recorded vulnerability, **CVE-2026-32968**, affects the `com_mb24sysapi` module and allows **unauthenticated remote code execution** through an OS command injection flaw. The weakness is classified as **CWE-78** and stems from improper neutralization of special elements in OS commands, enabling a remote attacker to execute arbitrary commands and potentially take full control of an affected system. The CVE is described as a variant of `CVE-2020-10383`, carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, and is referenced by CERT VDE advisories **VDE-2026-024** and **VDE-2026-025**. A separate high-severity issue, **CVE-2026-29839**, was recorded for **DedeCMS v5.7.118** in the `/sys_task_add.php` component. The flaw is a **Cross-Site Request Forgery** vulnerability classified as **CWE-352**, and its updated **CVSS v3.1** vector is `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, indicating that successful exploitation could significantly affect confidentiality, integrity, and availability. The record includes references to a public gist and the DedeCMS website, highlighting another internet-exposed web application weakness with potentially serious impact.
Jun 29, 2026
MeWare Software Development Inc.'s **PDKS** platform was disclosed with two high-severity vulnerabilities affecting versions from `V16.20200313` before `VMYR_3.5.2025117`. **CVE-2026-7399** is an insecure direct object reference (**IDOR**) issue mapped to `CWE-639` that allows authorization bypass through a user-controlled key, enabling attackers with low privileges to abuse access rights and expose or alter sensitive data. The flaw carries a CVSS v3.1 vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`, indicating network-reachable exploitation with low attack complexity and high impact on confidentiality and integrity. A second flaw, **CVE-2026-7402**, affects the same product range and stems from improper rate limiting, tracked as `CWE-799`. The vulnerability allows flooding attacks against PDKS and is rated with the CVSS v3.1 vector `AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`, reflecting high impact on integrity and availability. Both issues were referenced in advisories published through **USOM**, pointing organizations using vulnerable PDKS releases to update to a fixed version at or beyond `VMYR_3.5.2025117`.
Jun 29, 2026