Track East Asia cyber, AI, cloud, and infrastructure risk before it becomes an incident.
A high-severity Insecure Direct Object Reference (IDOR) vulnerability has been identified in the 'App School Link' mobile application developed by Sun Rise Technology, potentially allowing authenticated users to access and modify unauthorized records. Read more
TWCERT/CC published a Taiwan Vulnerability Note for a high-severity arbitrary file write flaw in Gigabyte Control Center. The advisory says that when the product’s pairing function is enabled, an unauthenticated remote attacker could write arbitrary files to any OS path, potentially enabling code execution or privilege escalation. Gigabyte Control Center versions up to 25.07.21.01 are listed as affected, and upgrading to 25.12.10.01 or later is recommended. Read more
TWCERT/CC published a vulnerability note for an arbitrary file upload issue in a+HCM affecting versions up to and including 8.1. The note states an unauthenticated remote attacker could upload arbitrary files to arbitrary paths, including HTML files that could produce XSS-like effects. TWCERT/CC rates the issue CVSS 6.1 (Medium) and points users to the vendor’s security notice and patches. Read more
Taiwan’s TWCERT/CC published a vulnerability note for an insecure deserialization flaw in Gigabyte Control Center’s Performance Library component. The issue (CVE-2026-4416, CVSS 7.8 High) could allow a locally authenticated attacker to send a crafted serialized payload to the EasyTuneEngine service and escalate privileges. Gigabyte’s advised fix is to update Performance Library to version 25.12.31.01 or later. Read more
TWCERT/CC disclosed a high-severity “Missing Authentication” vulnerability in WinMatrix agent software from Da Yang Technology. The issue (CVE-2026-6348, TVN-202604001) affects WinMatrix agent versions 3.5.13 through 3.5.26.15 and could allow an already-authenticated local attacker to execute arbitrary code with SYSTEM privileges on the local host and other hosts in the same environment that have the agent installed. TWCERT/CC recommends updating to WinMatrix agent 3.5.27.5 or later. Read more
TWCERT/CC published a Taiwan Vulnerability Note for two critical SQL injection vulnerabilities affecting Digiwin’s EasyFlow.NET workflow platform. Both issues are rated CVSS 9.8 and allow unauthenticated remote attackers to inject arbitrary SQL, potentially enabling database read, modification, and deletion. Organizations running affected EasyFlow.NET versions are advised by TWCERT/CC to upgrade to specified fixed releases or apply patches dated 2026-01-20. Read more
Taiwan’s TWCERT/CC published a critical vulnerability notice for an OS command injection flaw in Hgiga iSherlock appliances/software, including MailSherlock, SpamSherlock, and AuditSherlock. The issue (CVE-2026-6349, CVSS 9.8) could allow arbitrary OS command execution on the server under the conditions described in the advisory. Hgiga provides fixed package versions for both the 4.5 and 5.5 branches. Read more
TWCERT/CC published TVN-202604003 detailing two vulnerabilities in Openfind’s MailGates/MailAudit email security/audit products. One issue (CVE-2026-6350) is a critical stack-based buffer overflow rated 9.8 that could allow unauthenticated remote code execution. The second (CVE-2026-6351) is a high-severity CRLF injection rated 7.5 that could allow unauthenticated access to system files. Openfind’s technical team reported the issues; updates are available for affected versions. Read more
TWCERT/CC published a critical vulnerability notice for NewSoftOA, an office automation product from NewSoft. The issue, tracked as CVE-2026-5965 and TVN-202604008, is an OS command injection flaw with a CVSS 3.1 score of 9.8. TWCERT/CC recommends upgrading to NewSoftOA 10.1.8.3 or later to address the risk. Read more
Taiwan’s TWCERT/CC reports a technical evolution in the “Contagious Interview” campaign: instead of relying on victims to manually execute a file, attackers embed a malicious VS Code workspace configuration so code runs automatically when developers open a project folder in Trusted Mode. The technique abuses VS Code’s tasks.json automation (including a run-on-folder-open behavior) and social engineering around Workspace Trust prompts. The activity primarily targets cryptocurrency software engineers and freelancers via recruiting outreach on LinkedIn and gig platforms, then directs them to download test projects from GitHub/GitLab. TWCERT/CC says the resulting payload has been identified as a newer BeaverTail variant (Type 701), with noted functional overlap with OtterCookie (sometimes referred to as “OtterCandy”), and is focused on stealing crypto-related browser extension and wallet data as well as high-value browser-stored secrets. Read more