Loading story…
A high-severity vulnerability tracked as CVE-2026-58375 affects JimuReport through version 2.5.0, allowing unauthenticated remote attackers to access the POST /jmreport/auto/export endpoint and export report contents without logging in. The issue stems from the endpoint being annotated with @JimuNoLoginRequired, which causes JimuReportTokenInterceptor to skip authentication and authorization checks.
Researchers said the export service also does not verify the auto-export configuration flag before returning data, enabling attackers to enumerate Snowflake report identifiers and retrieve arbitrary report contents. Exposed data can include SQL query results and credentials embedded in report data sources, creating a significant information disclosure risk. The flaw is rated 8.7 CVSS 4.0 and 7.5 CVSS 3.1, and organizations using JimuReport are advised to update to a patched or latest available version and review access controls on sensitive endpoints.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A high-severity information disclosure and authentication bypass vulnerability affecting JimuReport through version 2.5.0 was publicly disclosed. The flaw in the POST /jmreport/auto/export endpoint allows unauthenticated attackers to enumerate Snowflake report identifiers and export arbitrary report contents, including SQL query results and embedded credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
JeecgBoot through version **3.9.2** contains a high-severity broken access control flaw tracked as `CVE-2026-58377` that lets authenticated low-privilege users fully manage OpenAPI credentials. The affected `/openapi/auth/*` and `/openapi/permission/*` endpoints reportedly lack required Shiro authorization annotations, allowing create, read, update, and delete actions against stored AK/SK pairs. Reports say the credential list endpoint returns secret keys in plaintext, exposing sensitive credentials that can be stolen and reused to access the platform's OpenAPI functionality. A related JeecgBoot issue indicates the impact extends beyond credential disclosure: the public `/openapi/call/{path}` handler allegedly accepts an `appkey` header without validating the expected secret-key signature, allowing attackers to invoke configured API routes after obtaining any key pair and potentially receive a JWT for the credential owner, including an administrator. Separately, a vulnerability report for **JimuReport 2.3.4**, part of the JeecgBoot ecosystem, says the `POST /jmreport/auto/export` endpoint can export report data without authentication because it is marked `@JimuNoLoginRequired`, creating additional exposure of business data, PII, and embedded credentials.
Jun 30, 2026
Splunk issued urgent fixes for **CVE-2026-20253**, a critical `CVSS 9.8` vulnerability in **Splunk Enterprise** that allows unauthenticated arbitrary file creation and truncation through a PostgreSQL sidecar service endpoint missing authentication controls. The flaw affects supported Splunk Enterprise releases prior to **10.4.0**, **10.2.4**, **10.0.7**, **9.4.12**, and **9.3.13** depending on branch, and Splunk said **Splunk Cloud is not affected** because it does not use Postgres sidecars. Splunk and national cyber authorities urged administrators to apply updates immediately, noting that no vendor detections or workarounds were initially available for the core issue. Public technical analysis from watchTowr Labs showed the bug can be reached through Splunk Web on port `8000`, which proxies requests to localhost-only PostgreSQL recovery endpoints, enabling attackers to abuse `/v1/postgres/recovery/backup` and `/restore` for filesystem access. Researchers demonstrated a full pre-auth exploitation chain that used path traversal, PostgreSQL connection-string injection, local `.pgpass` credentials, and PostgreSQL large-object export to gain arbitrary file write as the `splunk` user, then overwrite a Splunk Python script to achieve remote code execution. Splunk also disclosed additional Enterprise flaws including **CVE-2026-20251** (`CVSS 8.8`) in the Splunk Secure Gateway app due to unsafe `jsonpickle` deserialization, plus stored XSS and SSRF issues, prompting guidance to patch quickly, restrict dashboard creation and web exposure, and disable or remove vulnerable components where immediate upgrades are not possible.
Jun 29, 2026
Joomla disclosed two high-severity core vulnerabilities affecting its platform: **CVE-2026-23898**, an input-validation flaw in the `com_joomlaupdate` autoupdate server mechanism that can lead to arbitrary file deletion, and **CVE-2026-23899**, an improper access-control issue in webservice endpoints that can permit unauthorized access. Both issues are remotely exploitable over the network with low attack complexity, according to the published CVSS v4.0 vectors. The file-deletion bug is mapped to **CWE-73** and the webservice issue to **CWE-284**. Joomla said both vulnerabilities carry high potential impact across confidentiality, integrity, and availability, while requiring high privileges, and published separate security advisories through its developer portal. The disclosures indicate risk to core Joomla deployments that rely on the affected update and webservice functionality, making patch review and access-control validation a priority for administrators.
Jun 29, 2026