Decision Insights Threat Desk • August 23, 2026
Alinto SOGo versions prior to 5.12.8 contain an XSS flaw in how they render ICS (iCalendar) DESCRIPTION content, allowing an SVG payload with JavaScript to execute in the webmail interface and potentially expose mailbox data. The advisory identifies the issue as CVE-2026-8496.
Decision Insights Threat Desk • July 6, 2026
Tenda firmware versions include an undocumented backdoor in /bin/httpd login() that grants admin web access via CVE-2026-11405.
Decision Insights Threat Desk • July 2, 2026
Little Orbit’s GFAC driver has local privilege escalation and DoS issues via a minifilter port, including null dereference and write-what-where flaws.
Decision Insights Threat Desk • June 22, 2026
Microsoft Windows 10 and 11 WinRE can bypass UEFI/BIOS password enforcement, including cases affecting BitLocker.
Decision Insights Threat Desk • June 22, 2026
FastStone Image Viewer 8.3 has vulnerabilities in JP2 and PSD parsing that can enable code execution or crashes.
Decision Insights Threat Desk • June 18, 2026
CISA guidance says multiple vendor-signed UEFI applications can be abused to bypass Secure Boot and execute unverified code before the operating system loads on systems that trust the vendor’s certificate. Mitigation includes updating firmware/software and updating UEFI DBX revocations to block the affected binaries.