55
30
30
55
30
60
Experts plans to release VMware vRealize Log RCE exploit
60
30
Experts released VMware vRealize Log RCE exploit
60
55
60
60
35
42
55
60
30
55
CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer
Apache Storm Logviewer ignores logs.users and logs.groups ACLs for daemon logs, letting unauthorized users read sensitive logs.
CVE-2026-82437 (severity: moderate) affects Apache Storm Logviewer (storm-webapp) versions 3.0.0 before 3.1.0. The Logviewer offers logs.users and logs.groups settings for operators to control who may read log content, but for daemon logs the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer. As a result, configured access controls were not enforced and unauthorized users could read daemon log content.
25
Privileged File System Vulnerability Present in a SCADA System
Unit 42 details CVE-2025-0921 (CVSS 6.5), a privileged file operations flaw in Iconics Suite enabling DoS and privilege escalation.
Unit 42 disclosed CVE-2025-0921 (CVSS 6.5), an execution-with-unnecessary-privileges flaw in the Pager Agent of the AlarmWorX64 MMX feature of Mitsubishi Electric Iconics Digital Solutions GENESIS64. Attackers could misuse privileged file system operations to corrupt critical binaries, causing denial-of-service or integrity loss on vulnerable SCADA systems. The analysis demonstrates a chain with CVE-2024-7587, which grants excessive permissions to the C:\ProgramData\ICONICS directory via the GenBroker32 installer. Iconics released an advisory with a workaround that addresses the reported issues.
38
30
30
42
55
60
30
42
47
42
42
35
35
55
60
30
60
60
42
55
55