Loading story…
CISA warned that all versions of the SpiceJet Online Booking System contain two high-severity information disclosure flaws that can expose passenger data to unauthenticated users. The issues, tracked as CVE-2026-6375 and CVE-2026-6376, affect public-facing booking functions and were reported by Owais Shaikh. According to the advisory, one flaw allows attackers to enumerate valid passenger name records (PNRs) because authorization checks are missing and identifiers are predictable, while the other lets anyone retrieve full booking details using only a PNR and last name.
The vulnerabilities were rated CVSS 7.5 by CISA and described in CVE records as CWE-639 and CWE-306 weaknesses with low-complexity, network-based exploitation requiring no privileges or user interaction. Successful exploitation could disclose passenger names as well as broader personal, travel, and booking metadata, creating significant confidentiality risk for the transportation sector worldwide. CISA said it had no evidence of public exploitation targeting these flaws at the time of publication.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Zero Day Initiative published advisories ZDI-26-298 and ZDI-26-297 for Siemens SINEC NMS, publicly disclosing CVE-2026-24032 and CVE-2026-25654. The advisories detailed an authentication bypass and a privilege escalation issue following coordinated disclosure with Siemens.
CVE-2026-6375 and CVE-2026-6376 were recorded publicly, documenting unauthenticated access to passenger name records and booking details in SpiceJet's online booking system. The entries reference CISA's advisory and classify the issues as high-severity access control weaknesses.
CISA published ICS advisory ICSA-26-113-04 describing CVE-2026-6375 and CVE-2026-6376 in the SpiceJet Online Booking System. The vulnerabilities expose passenger booking data through weak or missing access controls, and CISA said it had no reports of known public exploitation at publication time.
Siemens released remediation updates for the SINEC NMS authentication bypass and privilege escalation vulnerabilities before coordinated public disclosure. The fixes addressed CVE-2026-24032 and CVE-2026-25654.
Rocco Calvi of TecSecurity reported a Siemens SINEC NMS privilege escalation vulnerability to the vendor, later assigned CVE-2026-25654. The issue involves improper authentication in the web service on TCP port 443 and could let an authenticated attacker access resources beyond intended privileges.
Zero Day Initiative notified Siemens of an authentication bypass vulnerability in Siemens SINEC NMS, later assigned CVE-2026-24032. The flaw affects the httpd authentication handler and could allow remote attackers to bypass authentication without prior access or user interaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cisa.gov
Open sourcezerodayinitiative.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A security researcher disclosed multiple vulnerabilities in Frontier Airlines’ website and mobile booking API that allegedly exposed sensitive passenger records using information printed on a boarding pass. According to the reports, a six-character booking code (`PNR`) and, in many cases, a passenger’s last name were enough to retrieve home addresses, phone numbers, email addresses, dates of birth, passport details, TSA PreCheck or Known Traveler Numbers, Frontier Miles numbers, billing details, and partial payment-card data. One earlier flaw reportedly allowed booking data to be accessed from the `PNR` alone before Frontier partially remediated it. The researcher said Frontier was notified in early March under a 90-day disclosure process, but key issues were still reportedly live more than 100 days later. The reports say some data remained hidden only in the user interface while still being exposed through page source or API responses in areas such as **Manage My Booking** and passenger-edit functions, and that one attempted fix may have revealed even more information. The exposure raised risks including identity theft, stalking, misuse of trusted traveler information, and easier reconstruction of payment-card numbers from disclosed `BIN`, expiration, billing data, and last four digits.
Jun 29, 2026
Basic-Fit disclosed a breach affecting about **200,000 customers in the Netherlands** after unauthorized access allowed attackers to download personal data before the intrusion was stopped. The exposed information included membership details, names, addresses, email addresses, phone numbers, dates of birth, and **bank account details**. The company said it notified affected customers and reported the incident to the Dutch Data Protection Authority, while media reports indicated the wider impact may extend beyond the Dutch customer base and raised questions about controls that failed to prevent large-scale data exfiltration. Booking.com also warned customers that unauthorized third parties may have accessed reservation-related information after suspicious activity was detected on a number of bookings. The potentially exposed data included customer names, email addresses, phone numbers, and other booking details submitted during the reservation process. Booking.com said the full scope of the incident remains under investigation, reset PIN codes tied to affected reservations, and urged customers to watch for suspicious activity and phishing attempts leveraging the stolen information.
Jun 29, 2026
Cisco disclosed two vulnerabilities in **Cisco Identity Services Engine (ISE)** and **Cisco ISE Passive Identity Connector (ISE-PIC)**, including the critical remote code execution flaw `CVE-2026-20181` and the high-severity information disclosure flaw `CVE-2026-20190`. Cisco said `CVE-2026-20181` carries a CVSS score of **9.1** and can let an authenticated attacker with valid administrative credentials execute arbitrary commands, obtain user-level access, potentially escalate privileges to root, and in single-node deployments trigger a denial-of-service condition. The second flaw, rated **7.5**, can allow an unauthenticated attacker to access sensitive information such as hashed credentials because of improper authorization checks. The affected software includes all releases prior to **3.3**, versions before **3.3 Patch 11** in release 3.3, versions before **3.4 Patch 6** in release 3.4, and versions before **3.5 Patch 4** in release 3.5, according to the Canadian Centre for Cyber Security notice summarizing Cisco’s advisories. Cisco said the vulnerabilities are independent, no workarounds are available, and no confirmed exploitation had been reported at disclosure time. Authorities urged administrators to review Cisco’s advisories and apply the available updates immediately.
Jun 29, 2026