← Back to Intel Center
SECURITY INTEL · DAILY
RSS

2026-10-29 Daily Security Intelligence

CSSA 2 · CVE 2 · Poison 2

10.0 Critical · Websoft9 application management platform proxy API missing auth…

CSSA Exclusive Early Warning 2

CSSA Exclusive Early Warning 9.9 Critical

Apache Iggy Java and C# SDKs improperly encode output, enabling path traversal that causes unauthorized deletion

Attackers exploit the Java or C# HTTP clients failing to correctly escape path parameters when building personal-access-token deletion requests. By injecting path-traversal sequences such as ../, they induce the URL parser to normalize the path onto unintended sensitive endpoints. Weak filtering of special characters lets requests be redirected to high-risk interfaces such as user management, enabling illicit deletion of arbitrary account data or unexpected system-state changes and severely harming integrity and availability.

Component
Apache Iggy is a high-performance event-driven message-stream storage platform designed for low-latency data persistence. SDKs give clients a standard data-interaction interface with connection management and resource scheduling across languages, aiming to build scalable distributed data-processing infrastructure so data flows efficiently and reliably among microservices.
Type
Improper Encoding or Escaping of Output (CWE-116)
Repo
github.com/apache/iggy · Stars 5222
Remediation
  • When concatenating URL paths, strictly percent-encode dynamic input and never splice unsanitized user-controlled strings. On the server, validate path legitimacy, reject segments with directory-traversal traits, and unify the low-level network-request wrappers across language SDKs to remove behavioral differences.
CSSA Exclusive Early Warning 10.0 Critical

Websoft9 application management platform proxy API missing authentication lets unauthorized actors tamper with reverse-proxy configuration

Attackers can abuse the logic flaw in /apphub/src/api/v1/routers/proxy.py where the /api/proxys/* path prefix is not intercepted by the global key middleware and has no session-cookie checks. Without any credentials they can send HTTP GET, POST, PUT, or DELETE requests to enumerate SSL certificate inventory, arbitrarily create or modify application reverse-proxy rules, or even delete existing proxy configurations—enabling domain hijacking or service interruption and severely damaging access-control integrity and availability of managed apps.

Component
Websoft9 is a container-based multi-application rapid deployment and management platform. Its core AppHub component centrally schedules backend microservices, manages application lifecycles, and configures network routing. The architecture separates front end and back end to automate infrastructure-as-code operations through standardized APIs.
Type
Missing Authentication for Critical Function (CWE-306)
Repo
github.com/Websoft9/websoft9 · Stars 2132
Remediation
  • Force session-token validation in every route handler that bypasses global authentication so the business layer always has a complete permission context, and regularly audit API authentication coverage to close security blind spots.

CVE Intelligence 2

CVE-2026-14571 CVSS 10.0 Critical 2026-10-28

Futurum Software management software blind SQL injection leads to sensitive data disclosure

In Futurum Software's management software, insufficient validation and sanitization of user-supplied input in private-area database queries, plus improper WAF configuration, create a blind SQL injection flaw (CWE-89). Attackers can bypass protections with crafted HTTP requests alone. Successful exploitation lets unauthenticated attackers run arbitrary database queries, extract the full schema, and obtain sensitive customer information including personally identifiable information (PII). All Futurum Software management deployments that have not fixed this defect are affected. No authentication is required for remote attack, directly threatening data confidentiality.

Component
Futurum Software is enterprise management software for internal business logic and customer-data management, involving storage and interaction of sensitive information.
Risks
  • Sensitive data disclosure: Attackers can extract the full database schema and sensitive customer data including PII
  • Unauthorized access: Unauthenticated attackers can execute arbitrary database queries, fully bypassing authentication
  • Data integrity damage: Attackers may modify or delete critical business data via SQL injection, disrupting business logic
Source
NVD · CVE-2026-14571
Remediation
  • Immediately update WAF configuration to enforce strict input validation and sanitization for private-area database queries
  • Use parameterized queries or prepared statements for database query parameters to prevent SQL injection at the root
  • Monitor anomalous HTTP request patterns, especially unconventional queries against private-area interfaces
CVE-2026-112197 CVSS 10.0 Critical 2026-10-28

NoviGest Java RMI unauthenticated remote code execution enables full server control

In the NoviGest desktop application, the Java RMI service lacks authentication on critical functionality (CWE-306). Attackers with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and run arbitrary SQL against the PostgreSQL database. Because the database account has high privileges, attackers can chain these capabilities to execute OS commands on the server, destroying confidentiality, integrity, and availability. All unpatched NoviGest desktop deployments are affected. Only network access is required—no user interaction—and the attack can be launched remotely.

Component
NoviGest is a desktop application that includes a Java RMI service component for core business logic and interaction with a PostgreSQL database.
Risks
  • From ordinary user to admin: If the victim runs the application with administrator privileges, the attacker gains the same privileges
  • Full system control: Attackers can execute arbitrary code on the victim system—installing programs, viewing/changing/deleting data, or creating fully privileged new accounts depending on user rights
  • No user-interaction attack: Direct network access to the service lets attackers trigger the flaw without inducing clicks or interaction, achieving remote code execution
Source
NVD · CVE-2026-112197
Remediation
  • Restrict network access to the Java RMI service and allow only trusted IP addresses
  • Apply least privilege to the database account and avoid connecting the application with high-privilege accounts

Package Poisoning 2

Package Poisoning npm 2026-10-29

mock-transactions-sdk@>= 0 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
a44897d057c33ac9e65085cebf75a923
Package Poisoning npm 2026-10-29

transaction-info-generate-sdk@>= 0 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
9101a77d1804fa33d36a3d64bc8aed20
← Back to Intel CenterRSSMonitor these risks automatically with CleanSource SCA →