Forwarded from TWCERTCC Security Advisory TWCERTCC-200-202606-00000005

【CVE-2024-21182】Oracle WebLogic Server Unspecified Vulnerability (CVSS v3.1: 7.5)
【Whether exploited by ransomware: Unknown】 Oracle WebLogic has an unspecified vulnerability. An unauthenticated attacker connecting through the T3 or IIOP protocol may exploit this vulnerability to compromise Oracle WebLogic Server. Successful exploitation of this vulnerability may result in unauthorized access to critical data or allow the attacker to obtain full access to all data accessible by Oracle WebLogic Server.

【CVE-2022-0492】Linux Kernel Improper Authentication Vulnerability (CVSS v3.1: 7.8)
【Whether exploited by ransomware: Unknown】 The Linux Kernel has an improper authentication vulnerability. An attacker may elevate privileges through the release_agent function of cgroups v1.

【CVE-2025-48595】Android Framework Integer Overflow Vulnerability (CVSS v3.1: 8.4)
【Whether exploited by ransomware: Unknown】 Android Framework has an integer overflow vulnerability, which may result in arbitrary code execution and thereby cause local privilege escalation.

【CVE-2026-45247】Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability (CVSS v3.1: 9.8)
【Whether exploited by ransomware: Unknown】 Mirasvit Full Page Cache Warmer has a deserialization of untrusted data vulnerability. An unauthenticated attacker may achieve remote code execution by providing a specially crafted PHP object in the CacheWarmer Cookie.

【CVE-2026-28318】SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability (CVSS v3.1: 7.5)
【Whether exploited by ransomware: Unknown】 SolarWinds Serv-U has an uncontrolled resource consumption vulnerability. An attacker may cause the Serv-U service to crash without authentication by using a specially crafted POST request with the Content-Encoding: deflate header.

Information Sharing Level: WHITE (the intelligence content is information that may be publicly disclosed)