Daily Digest
The most pressing issue is a publicly disclosed SQL injection in the MySQLDB component of an online examination system (CVE‑2026‑111872), allowing remote attackers to manipulate database queries and potentially exfiltrate or corrupt exam data. This vulnerability is actively being exploited in the wild and poses an immediate risk to any deployment using the affected code.
Summary: An SQL injection vulnerability exists in the MySQLDB class of results.php/include/database.php. Attackers can manipulate the `id`, `user`, or `topic` parameters to inject malicious SQL queries, which are executed remotely without authentication.
Affected Features / Interoperability: The vulnerable functions include `MySQLDB::valid`, `MySQLDB::getresults`, `MySQLDB::noresults`, `MySQLDB::getExams`, `MySQLDB::latestExamID`, and `MySQLDB::getreport`. This impacts exam result retrieval, exam management, and reporting features. Any downstream integrations that rely on these functions for data access could be compromised.
Source:
Actions:
Summary: A SQL injection flaw is present in the `MySQLDB::topicslist` function within exammanger.php. By manipulating the `subject` parameter, an attacker can execute arbitrary SQL commands remotely.
Affected Features / Interoperability: The AJAX endpoint `exammanger.php` is affected, impacting the retrieval of exam topics. Any client-side or server-side components that call this endpoint for topic listings are at risk.
Source:
Actions:
Summary: An SQL injection vulnerability exists in the `admin-panel.php` appointment cancellation handler of the Hospital Management System. Manipulating the `ID` argument can lead to remote SQL execution.
Affected Features / Interoperability: The `admin-panel.php` component and its appointment cancellation logic are impacted, potentially affecting patient scheduling, billing, and record management integrations.
Source:
Actions:
This morning's most urgent finding is CVE-2026-73802 (CVSS 8.8 HIGH), a Gitea Runner vulnerability where workflow-controlled container options bypass Docker's disabled privileged mode, enabling host namespace escape and root command execution on runner hosts. While no entries in today's feed carry CISA KEV confirmation, the severity is driven by confirmed active exploitation risk in CI/CD environments that rely on Docker-backed runners. Two additional formal vulnerabilities affect Docker-adjacent tooling (CVE-2026-85747 in the distribution registry client, CVSS 6.8 MEDIUM) and two affect Terraform tooling (CVE-2026-111929 in Coder, CVSS 5.3 MEDIUM; CVE-2026-76113 in the Dell Terraform Provider for Redfish, CVSS 4.3 MEDIUM).
Summary: Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false, allowing a workflow author running jobs on an affected Docker-backed runner to access host namespaces and execute commands as root, bypassing container isolation.
Affected Features / Interoperability: Impacts Gitea Runner's Docker executor integration. Any CI/CD pipeline using Gitea Runner with Docker as the job runner is exposed to container escape and host root compromise. Downstream functionality at risk includes automated build/deploy workflows that assume Docker isolation holds.
Source: https://blog.gitea.com/release-of-runner-3.0.0/ ; https://gitea.com/gitea/runner/releases/tag/v3.0.0 ; https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf
Actions:
Summary: The distribution toolkit (pack, ship, store, deliver container content) reads a manifest for a digest-pinned request and passes it to UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy can cache and re-serve the substituted manifest. Fixed in version 3.1.2.
Affected Features / Interoperability: Impacts the distribution/distribution package used as a registry backend (e.g., Docker Hub). Container image pulls could serve malicious manifests, undermining image integrity verification. Downstream functionality at risk includes any pipeline pulling images from a distribution-based registry.
Source: https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80 ; https://github.com/distribution/distribution/releases/tag/v3.1.2 ; https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3
Actions:
Summary: Coder versions 2.30.0 through 2.34.8 contain an authorization bypass in the provisioner daemon DownloadFile gRPC handler, allowing authenticated provisioner daans to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code, exposing infrastructure topology or embedded secrets.
Affected Features / Interoperability: Impacts Coder's multi-organization support. Cross-organization Terraform module access could leak infrastructure topology and secrets from other orgs. Downstream functionality at risk includes any Coder deployment sharing provisioner daans across multiple organizations.
Source: https://github.com/coder/coder/security/advisories/GHSA-hrhj-hpwc-9hmc ; https://www.vulncheck.com/advisories/coder-2.30.0-before-2.34.8-cross-organization-file-disclosure-via-downloadfile-rpc
Actions:
-