Cyber Threat Observatory | Alan Turing Institute

The Alan Turing Institute Threat Observatory providing intelligence and best practices to secure National Digital Identity Systems and Digital Infrastructures.

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CyberObs: CVE-2026-124554 affects JeecgBoot JimuBI. Unauthenticated SQL injection could expose or alter data where the endpoint is reachable. No confirmed in-wild exploitation.

Analysis: https://t.co/zyCiAKJaMI

#CyberSecurity #DPI #jeecgBoot #SQLinjection

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CyberObs: 4 Tier 2 Hickory DNS CVEs, spanning CVE-2026-123586 to CVE-2026-123608, affect DNS availability and DNSSEC validation. No confirmed in-wild exploitation.

Analyses: https://t.co/7qqfroPif7

#CyberSecurity #DNSSEC #DPI #Hickory

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CyberObs: 5 Tier 2 OpenAM CVEs, spanning CVE-2026-123543 to CVE-2026-123551, affect session tokens, SAML authentication, privileges and service availability. No confirmed in-wild exploitation.

Analyses: https://t.co/7qqfroPif7

#CyberSecurity #DigitalIdentity #DPI #OpenAM

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CyberObs: 21 Tier 2 OpenEMR CVEs, including cross-patient data exposure (CVE-2026-124470), FHIR authorisation bypass and potential RCE. No confirmed in-wild exploitation.

Analyses: https://t.co/7qqfroPQ4F

#CyberSecurity #HealthIT #DPI #OpenEMR

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-17301 affects IBM API Connect. Improper cryptographic signature verification can let unauthenticated attackers bypass access controls and reach protected APIs. No confirmed in-wild exploitation.

Analysis: https://t.co/LddflwdfJd

#CyberSecurity #DigitalIdentity

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-17340 affects IBM API Connect. A path traversal flaw can allow unauthenticated remote code execution in exposed API gateways. No confirmed in-wild exploitation.

Analysis: https://t.co/Z6nf5XUszg

#CyberSecurity #APISecurity

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CyberObs assessed 38 IBM API Connect Tier 2 CVEs on 7 November. Findings include authentication bypass, tenant isolation failures, SSRF and remote code execution. No confirmed in-wild exploitation.

Analyses: https://t.co/anTQLfr3k7

#CyberSecurity #APISecurity

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-123618 affects ABP Framework. An external-login flaw lets attackers with valid credentials bypass 2FA and account lockouts to obtain access tokens. No confirmed in-wild exploitation.

Analysis: https://t.co/uW3wlByHDr

#CyberSecurity #DigitalIdentity

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-114425 affects SEPPmail Secure Email Gateway.

Root-level processing increases the risk in securing communications infrastructure.

Analysis: https://t.co/kLjLvI700Q

#CyberSecurity #EmailSecurity

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-115770 affects Pocket ID. Authenticated users can falsely verify email addresses they do not control. Applications relying on these OIDC claims for account linking risk account takeover.

Analysis: https://t.co/USdQuWIhqt

#CyberSecurity #IdentitySecurity

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-121802 affects Better Auth's Expo plugin. An origin-validation flaw can allow unauthenticated attackers to forge tokens and take over user accounts or sessions. No confirmed in-wild exploitation.

Analysis: https://t.co/PARai24qIL

#CyberSecurity #DigitalIdentity

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

Tier 1 Alert: CVE-2026-102895 affects GPUStack. An authentication bypass enables unauthenticated admin access and remote code execution. Exploitation is confirmed in the wild. Upgrade to v2.2.0.

Analysis: https://t.co/gAviA4YX0o

#CyberSecurity #AISecurity

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-121543 affects smart-sso. A default authorisation flaw allows authenticated users to potentially compromise the identity provider and connected services. No confirmed in-the-wild exploitation.

Analysis: https://t.co/oqKBsh7Y7x

#CyberSecurity #DigitalIdentity

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-120232 affects Horizon DataSys Reboot Restore Standard.

A kernel driver flaw can let a low-privilege user gain SYSTEM access. A ready-to-use PoC raises the risk for kiosks and shared endpoints.

Analysis:
https://t.co/BiZRmI4KrD

#CyberSecurity #EndpointSecurity

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-119977 affects WordPress Core.

Attackers are actively exploiting a race condition that can allow remote code execution while a vulnerable WordPress site is performing a core upgrade.

Analysis:
https://t.co/UEGahKCbDD

#CyberSecurity #WordPress #VulnerabilityManagement

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-63182 affects the LightSAML PHP library.

A signature-validation flaw threatens SSO and federated identity trust.

A ready-to-use PoC is available.

Analysis:
https://t.co/zfhgENo0T2

#CyberSecurity #DigitalIdentity #SAML

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-62374 affects SD-JWT verification libraries.

Tampered disclosures can be silently dropped, potentially changing authorisation decisions where relying parties accept missing claims.

Analysis:
https://t.co/yvSNNGYhFr

#CyberSecurity #DigitalIdentity #SDJWT

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-119128 affects ZITADEL.

Forgeable verification cookies can allow unauthenticated attackers to take over accounts that have not yet established authentication methods.

Analysis:
https://t.co/WWnwnNt7nB

#CyberSecurity #DigitalIdentity #IAM

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-112256 affects OpenText Advanced Authentication Server

Unauthenticated attacks can bypass MFA and authentication control, potentially gaining access to applications protected by the identity gateway

Analysis
https://t.co/61whnn8KLd

#CyberSecurity #DigitalIdentity #MFA

[Cyber Threat Observatory | Alan Turing Institute @TuringCyberObs]

CVE-2026-86400 affects Dell PowerProtect Data Domain.

An unauthenticated attacker can gain root command execution on backup appliances, threatening recovery capability and operational resilience.

Analysis:
https://t.co/XMXubn3mfR

#CyberSecurity #Ransomware #CyberResilience