Loading story…
Revive Adserver disclosed 12 vulnerabilities affecting version 6.0.6 and earlier, including improper access control, improper authentication, blind SQL injection, reflected and stored XSS, remote code execution, and input-validation weaknesses. The most severe issues, CVE-2026-34916 and CVE-2026-44959, allow low-privileged users to inject malicious PHP into the compiledlimitations field and trigger code execution during banner delivery, creating a path from limited access to server-side compromise.
The advisory also details CVE-2026-34917, an authentication flaw that allows low-privileged web admin session IDs to be reused against the XML-RPC API, potentially enabling abuse of API-level functions. Additional bugs include a blind SQL injection in zone-include.php, several access-control issues that can alter ownership relationships or banner activation state, and stored or reflected XSS that can execute when administrators view audit or email log details. Revive Adserver said the flaws were reported through HackerOne by multiple researchers and were fixed in version 6.0.7 and later, urging users to upgrade to the latest release.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The advisory stated that fixes for the disclosed vulnerabilities were implemented and are available in Revive Adserver version 6.0.7 and later. Revive Adserver recommended upgrading to version 6.0.7 or the latest available release.
On 2026-06-03, Revive Adserver published security advisory REVIVE-SA-2026-002 disclosing 12 vulnerabilities affecting version 6.0.6 and earlier, including access control, authentication, SQL injection, XSS, and remote code execution issues. The advisory identified CVE-2026-34916 and CVE-2026-44959 as the most severe flaws.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released security bulletin **APSB26-120** to fix multiple critical vulnerabilities in **Adobe Campaign Classic v7** affecting **7.4.3 build 9398 and earlier** on Windows and Linux, and urged customers to upgrade to **build 9399**. The patched issues include **CVE-2026-48323** (template engine injection), **CVE-2026-48330** and **CVE-2026-48326** (SQL injection), **CVE-2026-48317** (eval injection), **CVE-2026-48331** (server-side request forgery), and **CVE-2026-48333** (incorrect authorization), with several flaws enabling **arbitrary code execution** or **privilege escalation**. Adobe said the most severe bugs, including **CVE-2026-48331**, **CVE-2026-48323**, and **CVE-2026-48330**, are rated **CVSS 10.0** and can be exploited remotely without authentication or user interaction. Adobe said it is **not aware of in-the-wild exploitation**, but warned that **internet-facing and externally accessible deployments** should be remediated quickly. The bulletin applies to **on-premise and hybrid deployments**, while **Adobe-hosted instances** were already remediated by Adobe. The **Canadian Centre for Cyber Security** separately issued advisory **AV26-776**, directing administrators to review Adobe’s bulletins and apply updates for affected products, including Adobe Campaign Classic.
Aug 5, 2026
WWBN **AVideo** was found to contain multiple high-severity vulnerabilities that can let attackers seize control of deployments, hijack user sessions, and access internal network resources. On uninitialized instances running version **25.0 or earlier**, `install/checkConfiguration.php` could be abused without authentication to complete setup, create an administrator account, and write configuration files, enabling full application takeover under **CVE-2026-33038**. Separate insecure defaults in the official Docker deployment path, tracked as **CVE-2026-33037**, left new installations exposed to immediate administrative compromise because the admin password defaulted to **"password"** and database credentials defaulted to `avideo/avideo`, with no forced password change or effective hardening. AVideo also exposed users and infrastructure through web-facing flaws in session handling and URL fetching. Under **CVE-2026-33043**, `/objects/phpsessionid.json.php` disclosed active PHP session IDs to unauthenticated requests, and permissive CORS behavior could allow cross-origin session theft and account takeover. Two SSRF issues affected the unauthenticated `plugin/LiveLinks/proxy.php` endpoint: **CVE-2026-33039** allowed redirect-based bypass of URL safety checks in version **25.0 and earlier**, while **CVE-2026-33480** showed that `isSSRFSafeURL()` could also be bypassed with IPv4-mapped IPv6 addresses, extending exposure through version **26.0** and enabling access to localhost, RFC1918 networks, and cloud metadata services. WWBN issued fixes in **AVideo 26.0** for most of the disclosed flaws, with an additional patch published for the IPv6-based SSRF bypass.
Jun 29, 2026
XenForo disclosed and patched three high-severity vulnerabilities affecting multiple 2.2 and 2.3 releases, including **remote code execution**, **OAuth2 authorization abuse**, and a **template method call restriction bypass**. The most severe issue, `CVE-2026-35056`, allows an authenticated but malicious administrator with admin control panel access to execute arbitrary code on the server, affecting versions before **2.3.9** and **2.2.18**. The flaw is classified as `CWE-94` and carries a high-impact CVSS vector indicating compromise of confidentiality, integrity, and availability. Two additional XenForo flaws affect authorization controls in the platform. `CVE-2025-71278` impacts versions before **2.3.5** and allows OAuth2 client applications to request unauthorized scopes, potentially granting access beyond intended permissions; it is mapped to `CWE-863`. `CVE-2025-71281` affects versions before **2.3.7** and stems from a loose prefix match in template callback and variable method-call handling, enabling unauthorized method invocation from templates. XenForo addressed the issues in security releases **2.3.5**, **2.3.7**, **2.3.9**, and **2.2.18**, with advisories also published by VulnCheck.
Jun 29, 2026