Intel Center

Cloud & IdentityMEDIAAltoNEWGDPRNIS2Inteligencia operacional

Meari IoT Cloud Platform OpenAPI Service

View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization. The following versions of Meari IoT Cloud Platform OpenAPI Service are affected: IoT Cloud Platform OpenAPI Service vers:all/* (CVE-2026-101104, CVE-2026-96613) CVSS Vendor Equipment Vulnerabilities v3 7.7 Meari Meari IoT Cloud Platform OpenAPI Service Missing Authorization Background Critical Infrastructure Sectors: Commercial Facilities, Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2026-101104 The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions. View CVE Details Affected Products Meari IoT Cloud Platform OpenAPI Service Vendor: Meari Product Version: Meari IoT Cloud Platform OpenAPI Service: vers:all/* Product Status: known_affected Remediations No fix planned Meari did not respond to CISA's coordination attempts. IoT Cloud Platform OpenAPI users are advised to contact Meari for support https://www.meari.com/en/downLoadCenter. Relevant CWE: CWE-862 Missing Authorization Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.7 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N 4.0 6.3 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N CVE-2026-96613 The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitiv CVEs: CVE-2026-101104, CVE-2026-96613. Vendors: Meari Product Version: Meari IoT Cloud Platform OpenAPI Service: vers:all/* Product Status: known_affected Remediations No fix planned Meari did not respond to CISA's coordination attempts, GitHub. DORA relevance: medium.

Cloud & IdentityMEDIAAltoNEWGDPRNIS2AI ACTInteligencia operacional

One year later: Sovereign AI and the fight for choice

AI sovereignty is not a zero-sum game, but many governments now believe it is. Cloudflare's answer: more local open-source models, model-agnostic security tools, and a commitment to giving nations genuine choice. CVEs: CVE-2023-50387. Vendors: Microsoft, Google, AWS, CrowdStrike, Apple, Atlassian, GitHub, Apache, Mozilla, Kubernetes, Okta, WordPress, OpenSSL, PHP, Node.js, Python, IBM, Elastic, PostgreSQL, MySQL, NGINX, Grafana, HashiCorp, Cloudflare. DORA relevance: high.

Por qué importa

El informe aborda la soberanía de la IA y la seguridad en la cadena de suministro, destacando la necesidad de resiliencia operativa bajo marcos como DORA y NIS2 ante la dependencia de múltiples proveedores tecnológicos.

Acción recomendada

Audita el inventario de activos frente a la CVE-2023-50387 y revisa los controles de seguridad en la cadena de suministro de IA según las directrices de cumplimiento vigentes.

Vendors:MicrosoftGoogleAWSCrowdStrikeSectores:bankingpublic sectorcloud/SaaSretailCISO · Cloud Security · SecOps

Mapeo regulatorio · riesgo 35

La presencia de la CVE-2023-50387 y la necesidad de revisar la gestión de vulnerabilidades hacen aplicable la divulgación coordinada de vulnerabilidades bajo NIS2, aunque no se evidencia explotación ni incidente.

NIS2 · Art. 12 Coordinated vulnerability disclosure and a European vulnerability database (direct)

Publicado: 01 oct 2026, 13:04
Actualizado: 01 oct 2026, 16:01
Detectado: 01 oct 2026, 16:01
Fuente: Cloudflare Blog Security
Referencia técnica: NVD · CVE-2023-50387

Cloud & IdentityMEDIAAltoNEWGDPRInteligencia operacional

Exabeam brings AI-assisted security investigations to data that must stay on-premises

Exabeam has introduced a new wave of capabilities that bring the Agentic SOC to life in the cloud and on-premises environments, combining AI-driven investigation, execution, and governance. Analyst workflows alone can’t keep pace with machine-speed threats or the growing complexity of goal-driven AI agents and autonomous workflows. The future of the SOC is agentic. For more than a decade, Exabeam has built applied machine learning into security operations, beginning with its pioneering work in user … More → The post Exabeam brings AI-assisted security investigations to data that must stay on-premises appeared first on Help Net Security. CVEs: CVE-2026-76504, CVE-2026-88772. Vendors: Cisco, Google, Citrix, GitHub, Elastic. DORA relevance: medium.

Por qué importa

Se han reportado vulnerabilidades asociadas a múltiples proveedores críticos en el ecosistema, requiriendo validación de inventario.

Acción recomendada

Verificar la presencia de los activos afectados (Cisco, Google, Citrix, GitHub, Elastic) y aplicar parches si las versiones son vulnerables.

Vendors:CiscoGoogleCitrixGitHubSectores:cloud/SaaSCISO · Cloud Security · SecOps

Publicado: 01 oct 2026, 13:50
Actualizado: 01 oct 2026, 15:02
Detectado: 01 oct 2026, 15:02
Fuente: Help Net Security
Referencia técnica: NVD · CVE-2026-76504

Cloud & IdentityMEDIAAltoNEWGDPRAI ACTInteligencia operacional

Zammad Zero-Days Exploited in AI-Powered DIVD Hack

The flaws were chained to hijack sessions, achieve remote code execution, and elevate privileges to root. The post Zammad Zero-Days Exploited in AI-Powered DIVD Hack appeared first on SecurityWeek. CVEs: CVE-2026-102489, CVE-2026-102490. Vendors: Microsoft, Cisco, Google, Citrix, GitHub, Mozilla, OpenSSL, WatchGuard. DORA relevance: medium.

Por qué importa

Explotación activa de zero-days en Zammad que permite ejecución remota de código y escalada de privilegios a root, con riesgo crítico de compromiso total del sistema.

Acción recomendada

Identificar y aislar inmediatamente cualquier instancia de Zammad expuesta, aplicar parches de seguridad si están disponibles y auditar logs en busca de intentos de secuestro de sesión.

Vendors:ZammadMicrosoftCiscoGoogleSectores:insurancepublic sectorcloud/SaaSMITRE:T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationCISO · Cloud Security · SecOps

Publicado: 01 oct 2026, 10:42
Actualizado: 01 oct 2026, 11:01
Detectado: 01 oct 2026, 11:01
Fuente: SecurityWeek
Referencia técnica: NVD · CVE-2026-102489

Cloud & IdentityMEDIAAltoNEWGDPRNIS2Inteligencia operacional

Viidure Dashcam Android Application

View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to access, modify, or delete sensitive user data and critical system files, potentially compromising the operation of the entire platform. The following versions of Viidure Dashcam Android Application are affected: Dashcam Android Application <=3.3.1.260403 (CVE-2026-94204, CVE-2026-96587) CVSS Vendor Equipment Vulnerabilities v3 10 Viidure Viidure Dashcam Android Application Incorrect Permission Assignment for Critical Resource, Use of Hard-coded Credentials Background Critical Infrastructure Sectors: Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2026-94204 The central cloud storage backend for the entire dashcam platform is misconfigured with public‑read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet. View CVE Details Affected Products Viidure Dashcam Android Application Vendor: Viidure Product Version: Viidure Dashcam Android Application: <=3.3.1.260403 Product Status: known_affected Remediations No fix planned Viidure did not respond to CISA's coordination attempts. Users of affected versions of the Viidure Dashcam Android Application are advised to contact Viidure customer support for additional information https://viidure.app/. Relevant CWE: CWE-732 Incorrect Permission Assignment for Critical Resource Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVE-2026-96587 The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, incl CVEs: CVE-2026-94204, CVE-2026-96587. Vendors: Viidure Product Version: Viidure Dashcam Android Application: <=3, Google, GitHub, MikroTik. DORA relevance: medium.

Por qué importa

La aplicación expone credenciales hardcoded y tiene una mala configuración en el almacenamiento en la nube, permitiendo acceso público a datos sensibles de usuarios y firmware sin posibilidad de parcheo oficial.

Acción recomendada

Identificar y restringir el uso de la aplicación Viidure en dispositivos corporativos y auditar cualquier conexión a los buckets de almacenamiento asociados a esta plataforma.

Vendors:ViidureSectores:Transportation SystemsMITRE:T1552 Unsecured CredentialsT1530 Data from Cloud Storage ObjectCISO · Cloud Security · SecOps

Mapeo regulatorio · riesgo 85

La exposición pública de datos personales, credenciales cloud y firmware evidencia controles insuficientes de protección de datos y gestión del riesgo de ciberseguridad.

GDPR · Art. 24 Responsibility of the controller (direct) · Art. 25 Data protection by design and by default (direct)

NIS2 · Art. 21 Cybersecurity risk-management measures (direct)

Publicado: 29 sept 2026, 12:00
Actualizado: 29 sept 2026, 17:01
Detectado: 29 sept 2026, 17:01
Fuente: CISA All Alerts
Referencia técnica: NVD · CVE-2026-94204

Cloud & IdentityMEDIAAltoNEWNIS2Inteligencia operacional

Anjvision YSSD-RTMP-H5

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, access user accounts, execute OS-level commands, or take full control over the device. The following versions of Anjvision YSSD-RTMP-H5 are affected: YSSD-RTMP-H5 firmware 3.3.2.4_build_2024-12-26 (CVE-2026-100291, CVE-2026-100292, CVE-2026-100293, CVE-2026-100294, CVE-2026-100295, CVE-2026-100296, CVE-2026-100297, CVE-2026-100298, CVE-2026-100299) CVSS Vendor Equipment Vulnerabilities v3 9.8 Anjvision Anjvision YSSD-RTMP-H5 Initialization of a Resource with an Insecure Default, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Verification of Cryptographic Signature, Use of Hard-coded Credentials, Active Debug Code, Improper Check for Unusual or Exceptional Conditions, Server-Side Request Forgery (SSRF), Insufficiently Protected Credentials, Use of Weak Credentials Background Critical Infrastructure Sectors: Commercial Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2026-100291 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations. View CVE Details Affected Products Anjvision YSSD-RTMP-H5 Vendor: Anjvision Product Version: Anjvision YSSD-RTMP-H5 firmware: 3.3.2.4_build_2024-12-26 Product Status: known_affected Remediations No fix planned Anjvision has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of affected versions of YSSD-RTMP-H5 are invited to contact Anjvision customer support for additional information http://www.anjvision.com/problem/list-129-cn.html . Relevant CWE: CWE-1188 Initialization of a Resource with an Insecure Default Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVEs: CVE-2026-100291, CVE-2026-100292, CVE-2026-100293, CVE-2026-100294, CVE-2026-100295. Vendors: Anjvision Product Version: Anjvision YSSD-RTMP-H5 firmware: 3, GitHub. DORA relevance: medium.

Por qué importa

El dispositivo presenta múltiples vulnerabilidades críticas (CVSS 9.8) sin parche disponible, permitiendo ejecución remota de comandos y acceso no autorizado.

Acción recomendada

Aísle los dispositivos Anjvision YSSD-RTMP-H5 de redes públicas inmediatamente y restrinja el acceso administrativo mediante segmentación de red.

Vendors:AnjvisionSectores:Commercial FacilitiesMITRE:T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsCISO · Cloud Security · SecOps

Mapeo regulatorio · riesgo 75

La vulnerabilidad crítica sin parche, con posible ejecución de comandos y toma de control del dispositivo, exige medidas de gestión del riesgo y tratamiento coordinado de vulnerabilidades conforme a NIS2.

NIS2 · Art. 21 Cybersecurity risk-management measures (direct) · Art. 12 Coordinated vulnerability disclosure and a European vulnerability database (direct)

Publicado: 29 sept 2026, 12:00
Actualizado: 29 sept 2026, 17:01
Detectado: 29 sept 2026, 17:01
Fuente: CISA All Alerts
Referencia técnica: NVD · CVE-2026-100291

Cloud & IdentityMEDIAAltoNEWGDPRInteligencia operacional

BlackFog adds prompt protection and governance for agentic AI

BlackFog has announced the launch of ADX Vision 2.0, expanding its AI security capabilities to help organizations govern and control the use of generative and agentic AI across the enterprise. As employees move from simply interacting with AI tools to deploying agents capable of making decisions and acting on corporate data, the security challenge for organizations is changing. Traditional controls were not designed to address risks such as prompt injection, unauthorized data exposure and limited … More → The post BlackFog adds prompt protection and governance for agentic AI appeared first on Help Net Security. CVEs: CVE-2026-76504, CVE-2026-88772. Vendors: Cisco, Google, Citrix, GitHub. DORA relevance: high.

Por qué importa

La presencia de vulnerabilidades críticas en stacks tecnológicos críticos (Cisco, Google, Citrix, GitHub) combinada con la adopción de agentes de IA aumenta la superficie de ataque y el riesgo de exposición de datos bajo normativas DORA y GDPR.

Acción recomendada

Audita inmediatamente el inventario de activos para identificar versiones afectadas de Cisco, Google, Citrix y GitHub y aplica los parches de seguridad disponibles.

Vendors:CiscoGoogleCitrixGitHubSectores:bankingcloud/SaaSMITRE:T1190 Exploit Public-Facing ApplicationCISO · Cloud Security · SecOps

Publicado: 01 oct 2026, 07:25
Actualizado: 01 oct 2026, 11:02
Detectado: 01 oct 2026, 11:02
Fuente: Help Net Security
Referencia técnica: NVD · CVE-2026-76504

Cloud & IdentityMEDIAAltoNEWGDPRInteligencia operacional

Google says Gemini 4 Argon can find and patch critical software flaws

Google announced Gemini 4 Argon, its new frontier AI model, and is rolling it out to a set of trusted cyber defenders through its Fairwind Program. Google says the model can locate critical software vulnerabilities, validate them, and patch them without human help, and it will release a version without cyber guardrails to those defenders and to its own internal teams. Developers, enterprises, and consumers get Argon later, starting with paid API customers and Google … More → The post Google says Gemini 4 Argon can find and patch critical software flaws appeared first on Help Net Security. CVEs: CVE-2026-88772. Vendors: Google, Citrix, GitHub. DORA relevance: medium.

Por qué importa

Se ha reportado una vulnerabilidad crítica (CVE-2026-88772) que afecta a infraestructuras clave de Google, Citrix y GitHub, requiriendo verificación inmediata de exposición.

Acción recomendada

Audita el inventario de activos para identificar instancias de Google, Citrix y GitHub afectadas por CVE-2026-88772 y aplica los parches de seguridad correspondientes.

Vendors:GoogleCitrixGitHubSectores:public sectorhealthcarecloud/SaaSMITRE:T1190 Exploit Public-Facing ApplicationCISO · Cloud Security · SecOps

Publicado: 01 oct 2026, 04:00
Actualizado: 01 oct 2026, 07:02
Detectado: 01 oct 2026, 07:02
Fuente: Help Net Security
Referencia técnica: NVD · CVE-2026-88772

What your team should look at right now

CISA Adds One Known Exploited Vulnerability to Catalog

Meari IoT Cloud Platform OpenAPI Service

Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Kevin Mandia’s Armadin Raises $255 Million at $2.5 Billion Valuation

Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure

Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader

Enterprises Struggle to Prepare for AI and Quantum Threats, PwC Says

One year later: Sovereign AI and the fight for choice

Exabeam brings AI-assisted security investigations to data that must stay on-premises

Zammad Zero-Days Exploited in AI-Powered DIVD Hack

Viidure Dashcam Android Application

Anjvision YSSD-RTMP-H5

BlackFog adds prompt protection and governance for agentic AI

Google says Gemini 4 Argon can find and patch critical software flaws