SardinhaNews
Threat intelligence · CVEs & news · updated 11/14, 01:47 PM
Monthly trends
New CVEs published
count per month
Monthly count of newly published CVEs in the NVD (National Vulnerability Database). The 3-month moving average filters month-to-month noise. From 2024 to 2025, volume changed +23%. In 2026, through Oct, the change is +124% over the same period of 2025. We deliberately do not fit an exponential curve: growth has no constant rate, and a curve would imply a pace the data does not show.
New CVEs, year over year
count per month, one line per year
2026 through Oct: 92,318 · 2025 same period: 41,213 (+124%)
The same count as “New CVEs published”, overlaid by year to compare month with month. The series starts in 2022 because, before Aug 2021, the database lacks the full NVD history. The current month only enters once it closes.
CVEs by EPSS band
% of the month's CVEs with EPSS ≥1%, by probability band (absolute in tooltip)
Each CVE is classified by its probability of exploitation within the next 30 days (EPSS/FIRST). The chart shows only the risk bands; the rest sits below 1% (97.5% in Oct/26). Percentages show the mix without the effect of growing volume, and the real risk concentrates in the red line (≥10%). EPSS is the current score, not the one at publication: older CVEs had more time to rise.
CVEs by CVSS band
% of those published that month, by severity (absolute in tooltip)
Distribution by CVSS severity: low (<4.0), medium (4.0–6.9), high (7.0–8.9) and critical (≥9.0). “No CVSS” = published and not yet scored, an effect of the NVD analysis queue (5.1% in Oct/26). Rejected records are excluded. Severity measures potential impact, not attack likelihood.
Exploitation confirmations
CVEs per month, by catalog
KEV = CISA's (US) catalog of confirmed active exploitation; US federal agencies must patch within set deadlines. EUVD beyond KEV = exploited according to ENISA (European Union) and not in KEV. EUVD contains all of KEV, so only the excess becomes a line. CTIR Gov = CVEs cited in alerts from Brazil's federal government CSIRT, mandatory for federal agencies (Decree 10,748/2021); the line starts in Aug 2026, when collection began. The tooltip shows how many CTIR-cited CVEs are outside KEV.
Confirmed exploitation, year over year
CVEs added per month, one line per year
2026 through Oct: 282 · 2025 same period: 214 (+32%)
KEV (CISA, US) or EUVD (ENISA, European Union), chosen in the selector. EUVD includes all of KEV, so both views nearly match. The series starts in 2023 because 2022 was KEV's initial load (226 entries in March alone), which would flatten the other years.
Withdrawn or disputed records
% of those published that month (absolute in tooltip)
Rejected = the CVE Program voided the record (not a vulnerability, a duplicate, or the requester withdrew). Disputed = still published, but someone, usually the vendor, denies it is a flaw. The rate swings a lot: 1.9% in 2024, 3.7% in 2025, and 2.7% in 2026. Isolated peaks are usually batches: in Jan 2026, 838 records were voided at once, most of them 2025 CVEs. The chart has its own scale because these are few cases next to the total volume.
Trending CVEs (last 7 days)
Ranked by a weighted score of the last 7 days' events: added to a confirmed-exploitation catalogue (+10 — CISA KEV or EUVD/ENISA, counted only once), EPSS spike (+8), first media mention (+5), CVSS change (+2), new mentions (+1) and new CVE (+1). Bonuses add current CVSS and EPSS plus confirmed weaponization: ransomware (+4), CERT.br notification (+4), public exploit (+3 — Metasploit or Exploit-DB, counted only once), APT groups (+2) and malware (+2).
Sources:NVDEPSS (FIRST)CISA KEVEUVD (ENISA)CISA Vulnrichment (SSVC)Tenable (VPR)CERT.brCTIR GovMetasploitExploit-DBNucleiBDU/FSTECCloudflare RadarCERT.br honeypotsransomware.live
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Requires: network access, target conditions · Does not require: authentication, user interaction
How it is exploited
Exploitation method
- The attacker connects remotely to the sshd service exposed on the network.
- The attacker attempts password authentication for an account whose configuration falls into the affected case.
- The attacker supplies a password between 256 and 1024 characters long.
- sshd, when using musl libc without PAM, misinterprets whether the string is intended to be a password hash and accepts the authentication.
- The attacker gains authenticated access to the account without knowing the correct password.
Am I affected? (applicability)
- The environment runs OpenSSH in a version prior to 10.6p2.
- The operating system uses musl libc without PAM (for example, Alpine Linux).
- The sshd service is reachable over the network.
- Accounts are configured in a way that falls into the affected case (the description mentions 'some configurations of accounts').
Does not require: authentication, user interaction.
Mitigation and detection
✓ Fix available in version 10.6p2
- Update OpenSSH to version 10.6p2 or later.
- Restrict network access to the sshd service to trusted sources only.
- Disable password authentication in sshd, where possible, as a containment measure.
Impact if exploited
Password authentication bypass in sshd — unauthorized access to accounts, with potential compromise of system confidentiality, integrity, and availability.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 6 · PoC 22
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
Requires: local access, privileged account · Does not require: user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker already has local access to the host and an authenticated account.
- The attacker connects to the local socket /tmp/dynamic_socket, which is world-writable.
- The Gaia OS DynamicCLI daemon accepts the connection without authenticating the client process.
- The attacker sends a command through the socket; the daemon, running as root, processes and executes the command with root privileges.
Am I affected? (applicability)
- The host runs Gaia OS with the DynamicCLI daemon running as root.
- The socket /tmp/dynamic_socket exists and is world-writable.
- The attacker has an authenticated local account on the system.
- The DynamicCLI daemon does not require authentication from processes connecting to the socket.
Does not require: user interaction, special target conditions.
Mitigation and detection
- Apply the vendor fix for Gaia OS.
- Restrict permissions on the /tmp/dynamic_socket socket to prevent writes by unauthorized users.
- Monitor connections and commands sent to /tmp/dynamic_socket for suspicious activity.
Impact if exploited
Execution of commands as root from an authenticated local user — full compromise of the Gaia OS host.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): PoC 1
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends a network request to an Adobe Commerce/Magento endpoint that processes templates.
- The request content includes unneutralized special elements that are interpreted by the template engine (SSTI).
- The template engine executes the injected code in the context of the current user.
- No user interaction or prior privilege is required; the result is arbitrary code execution.
Am I affected? (applicability)
- Adobe Commerce or Magento is in use at version 2.4.9 or earlier (per the Nuclei detection source).
- The Adobe Commerce B2B component is present, if applicable to the environment.
- The Adobe Commerce/Magento service is exposed to the network for remote access.
- The Adobe Commerce/Magento template engine is reachable and processes untrusted input.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version Hotfix for CVE-2026-7565
- Apply the vendor hotfix for CVE-2026-7565 (known fix on record).
- Restrict network access to Adobe Commerce/Magento endpoints to trusted sources only.
- Use the automated detection available in the Nuclei template to identify vulnerable instances.
- Monitor anomalous requests to the template engine for injection attempts.
Impact if exploited
Remote code execution in the context of the current user, without user interaction, allowing control of the Adobe Commerce/Magento service and compromise of data and application.
Confidentiality: highIntegrity: highAvailability: high
Also affects components beyond the vulnerable one.
Community reports (unverified): exploitation 10 · PoC 13
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Requires: network access, target conditions · Does not require: authentication, user interaction
How it is exploited
Exploitation method
- The attacker sends remote requests to the PHP service, with no authentication or victim interaction required.
- The attacker triggers out-of-memory (OOM) strategies that cause PHP to use longjmp() to abort the request context.
- In some contexts, request memory is left uninitialized before an allocation.
- The subsequent request cleanup procedure reads or branches on this uninitialized memory.
- Consistent exploitation of this condition leads to remote code execution (RCE).
Am I affected? (applicability)
- The environment runs PHP versions prior to the fixes 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
- The PHP service is exposed to the network and reachable by the attacker.
- The attacker can send requests that trigger OOM strategies in PHP.
- Products embedding affected PHP are in use: Siemens RUGGEDCOM APE1808, Siemens Blue Planet 360 NX3 M6 WM OD IISX, Palo Alto Networks PAN-OS, Panorama M-200/M-300/M-500/M-600/M-700, Panorama Virtual Appliance, WF-500, and WF-500-B.
Does not require: authentication, user interaction.
Mitigation and detection
✓ Fix available in version 8.2.35; 8.3.36; 8.4.27; 8.5.12
- Update PHP to the fixed versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
- Apply vendor updates for products embedding affected PHP (Siemens, Palo Alto Networks).
- Restrict network access to the exposed PHP service.
- Use the automated detection available in the Nuclei template to identify the exploitation condition.
Impact if exploited
Remote code execution (RCE) in the context of the PHP service, allowing the attacker to compromise the server and the data it processes.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 30 · PoC 240
References and technical detail
- NVD — registro oficial ↗
- Alerta governamental ↗
- Advisory do fornecedor ↗
- Advisory de terceiros ↗
- Advisory de terceiros ↗
- Advisory de terceiros ↗
- Exploit-DB: PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE ↗
- Nuclei — template de detecção ↗
- EUVD (ENISA): EUVD-2026-107260 ↗
- CTIR Gov: ALERTA 93/2026 ↗
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
Requires: network access, victim action · Does not require: authentication, special target conditions
How it is exploited
Exploitation method
- The attacker prepares a message or content that exploits the unsafe action warning flaw in Microsoft Office Outlook.
- The victim must interact with the content (e.g., open a message or click an element) for the unsafe action to execute without warning.
- The ui product does not display the expected security warning, allowing the action to proceed without informed consent.
- As a result, the attacker can perform spoofing over the network, potentially leading the victim to trust false content.
Am I affected? (applicability)
- A version of Microsoft 365 Apps earlier than 16.0.14334.21048 or 16.0.17932.21140 (depending on the channel) is in use.
- Microsoft Office 2021 or Office 2024 is in use at a version earlier than the indicated fix.
- The user uses Microsoft Office Outlook to access messages or content over the network.
- The victim can be induced to interact with a message or element that triggers an unsafe action without warning.
Does not require: authentication, special target conditions.
Mitigation and detection
✓ Fix available in version 16.0.14334.21048; 16.0.17932.21140
- Update Microsoft 365 Apps, Office 2021, or Office 2024 to the fixed version 16.0.14334.21048 or 16.0.17932.21140, as applicable.
- Restrict Outlook exposure to untrusted content and instruct users not to interact with suspicious messages.
- Monitor for spoofing attempts and unsafe actions that do not trigger a warning in Outlook.
Impact if exploited
Spoofing over the network — the victim may be led to trust false content, compromising communication integrity.
Confidentiality: highIntegrity: noneAvailability: none
Community reports (unverified): exploitation 1
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Requires: network access, victim action · Does not require: authentication, special target conditions
How it is exploited
Exploitation method
- The attacker delivers a specially crafted HTML page to the victim, hosted remotely or sent through any channel.
- The victim opens the page in Google Chrome prior to 157.0.8103.50, triggering XML processing by the browser.
- XML processing triggers a use-after-free (CWE-416) in browser memory.
- The attacker exploits the condition to execute arbitrary code inside the Chrome sandbox.
Am I affected? (applicability)
- Google Chrome is in use at a version prior to 157.0.8103.50.
- The browser is used to open HTML pages from untrusted origins or received by email/message.
- The victim can be induced to open a specially crafted HTML page (interaction required by the vector).
Does not require: authentication, special target conditions.
Mitigation and detection
✓ Fix available in version 157.0.8103.50
- Update Google Chrome to version 157.0.8103.50 or later.
- Restrict opening untrusted HTML pages until the update is applied.
- Monitor the browser for signs of code execution inside the sandbox after opening suspicious pages.
Impact if exploited
Arbitrary code execution inside the Chrome sandbox — compromise of the browser and the data accessible to it.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 4
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- Attacker with network access to vCenter reaches the Syslog server.
- Sends a request that exploits directory traversal (CWE-22) in the Syslog server.
- The system resolves the path improperly and allows access to files outside the intended directory.
- The flaw leads to arbitrary code execution in the service context.
Am I affected? (applicability)
- The environment uses VMware vCenter Server in a version prior to the fix (9.1.0.0300, 9.0.2.0100, or 8.0 U3k).
- The vCenter Syslog server is in use and reachable over the network.
- The environment includes VMware Telco Cloud Infrastructure, Telco Cloud Platform, Cloud Foundation, or vSphere Foundation in an affected version.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 9.1.0.0300; 9.0.2.0100; 8.0 U3k
- Update to the fixed versions: 9.1.0.0300, 9.0.2.0100, or 8.0 U3k.
- Restrict network access to the vCenter Syslog server.
- Segment the network to limit vCenter exposure.
Impact if exploited
Remote arbitrary code execution on vCenter, with high impact to confidentiality, integrity, and availability.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 14 · PoC 13
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends an XML message to the Open Client Interface – Provisioning (OCI-P) service of Cisco BroadWorks over the network, without authentication.
- The OCI XML parser resolves external entities by default because XML entries are improperly parsed.
- The message causes the parser to fetch external resources, allowing the reading of sensitive files from the filesystem.
- The attacker obtains sensitive configuration information with the privileges of the Cisco BroadWorks user.
Am I affected? (applicability)
- The Open Client Interface – Provisioning (OCI-P) service of Cisco BroadWorks is exposed to the network and reachable by the attacker.
- The affected system is one of the listed Cisco BroadWorks platforms: broadworks_application_delivery_platform, broadworks_application_server, broadworks_profile_server, or broadworks_xtended_services_platform.
- The OCI XML parser has external entity resolution enabled by default (configuration unchanged).
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
- Apply the vendor (Cisco) fix for Cisco BroadWorks.
- Restrict network access to the Open Client Interface – Provisioning (OCI-P) service to trusted sources only.
- Disable external entity resolution in the OCI XML parser if the configuration allows.
- Monitor attempts to send XML messages with external entities to the OCI-P service.
Impact if exploited
Reading of sensitive files from the filesystem with the privileges of the Cisco BroadWorks user, exposing sensitive configuration information.
Confidentiality: highIntegrity: noneAvailability: none
Community reports (unverified): exploitation 1
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends a remote request to the GPUStack service that can appear to originate from 127.0.0.1 because client_ip_getter accepts a same-host reverse proxy peer or a client-supplied loopback value in the X-GPUStack-Real-IP header.
- The get_current_user function in gpustack/api/auth.py treats the loopback request as the built-in administrator when force_auth_localhost is false (default).
- The attacker gains unauthenticated administrative access and can change users and models, create persistent administrator API keys, disclose worker and cloud-provider secrets, and execute code via POST /v2/inference-backends/from-yaml.
Am I affected? (applicability)
- The GPUStack version in use is prior to 2.2.0.
- The force_auth_localhost setting is false (default).
- The GPUStack service is exposed to the network and reachable by remote attackers.
- A reverse proxy on the same host can forward requests with an apparent loopback origin, or the attacker can send the X-GPUStack-Real-IP header with a loopback value.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
- Update to version 2.2.0 or later.
- Set force_auth_localhost to true to require authentication even for loopback requests.
- Restrict network access to the GPUStack service to trusted clients only.
- Monitor requests with the X-GPUStack-Real-IP header containing loopback values and unauthenticated administrative access.
Impact if exploited
Unauthenticated administrative access — modification of users and models, persistent creation of administrator API keys, disclosure of worker and cloud-provider secrets, and code execution.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 2
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
More CVEs (39)
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker, already authenticated as an authorized user in IBM Aspera Faspex, sends a specially crafted message to the system.
- The system processes the message without correctly validating the user's authorization (CWE-863).
- The access control flaw allows the user to bypass the authorization check.
- As a result, the attacker gains full administrative privileges in the application.
Am I affected? (applicability)
- IBM Aspera Faspex version 5.0.0 through 5.0.19 is in use.
- The attacker has a valid authorized user account in IBM Aspera Faspex.
- The IBM Aspera Faspex service is reachable over the network.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
- Apply the vendor fix (corrected version not provided in the CVE record).
- Restrict network access to the IBM Aspera Faspex service to trusted sources only.
- Review and limit permissions of authorized user accounts, applying least privilege.
- Monitor message submissions that result in privilege escalation or unexpected administrative access.
Impact if exploited
An authorized user can gain full administrative privileges in IBM Aspera Faspex, compromising the confidentiality, integrity, and availability of the system.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 1
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Requires: network access, target conditions · Does not require: authentication, user interaction
How it is exploited
Exploitation method
- The attacker supplies a crafted Brotli-compressed stream to a component that uses the Brotli library to decompress data (for example, an application accepting compressed content over the network).
- The Brotli decoder (c/dec/decode.c) processes the stream without correctly validating the size, resulting in a buffer overflow.
- Memory adjacent to the decoder state is corrupted, potentially exposing sensitive memory contents, crashing the process, or allowing code execution.
Am I affected? (applicability)
- Google Brotli versions 1.0.3 through 1.2.0 are in use (library or binary).
- Any affected product from the list (for example, nodejs node.js, python-hyper brotlicffi, microsoft .net, envoyproxy envoy, istio istio, anthropic bun, apache arrow, clickhouse clickhouse, duckdb duckdb, google woff2, 7-zip p7zip, mcmilk 7-zip-zstd, andybalholm brotli, tianocore edk2, debian debian_linux, siemens ruggedcom_ape1808_firmware, siemens common_configurator, siemens data_flow_monitoring) is present in the environment.
- The component using Brotli receives or decompresses data controlled by an unauthenticated attacker over the network.
- The service that decompresses Brotli is exposed to the network and reachable by the attacker.
Does not require: authentication, user interaction.
Mitigation and detection
✓ Fix available in version 1.0.10; 1.1.1; 1.2.1; V1.24.3
- Update Brotli libraries or binaries from versions 1.0.3 through 1.2.0 to 1.0.10, 1.1.1, or 1.2.1 (or V1.24.3, per the fix record).
- Restrict network access to services that decompress Brotli, limiting exposure to unauthenticated attackers.
- Identify the listed affected products in the inventory and prioritize updating those that process external data.
Impact if exploited
Memory corruption in the Brotli decoder can cause denial of service, disclosure of sensitive memory contents, and potential unauthenticated remote code execution.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 8 · PoC 97
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends an unauthenticated HTTP request to the Simple File List plugin to upload a file with an allowed extension (e.g., png) containing PHP code.
- The attacker triggers the plugin's rename function, which does not enforce file extension restrictions, and renames the file to a PHP extension.
- The renamed PHP code is executed on the server, resulting in remote code execution.
Am I affected? (applicability)
- The Simple File List plugin is installed and active on WordPress.
- The plugin version is up to and including 4.2.2.
- WordPress is network-accessible for unauthenticated requests.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 4.2.3
- Update the Simple File List plugin to version 4.2.3 or later.
- If updating is not possible, disable or remove the plugin.
- Restrict network access to WordPress as needed.
- Use the available Nuclei template for automated detection of the vulnerability.
Impact if exploited
Unauthenticated remote code execution on the WordPress server, allowing full server compromise.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): PoC 4
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends a network request to the exposed Microsoft SharePoint Server service.
- The request reaches a critical function that lacks authentication (CWE-306).
- The system processes the request without validating credentials and grants unauthorized access.
- The attacker achieves privilege elevation over the network, with high impact on confidentiality, integrity, and availability.
Am I affected? (applicability)
- The environment uses Microsoft SharePoint Server in a version prior to the fix 16.0.5561.1001, 16.0.10417.20175, or 16.0.19725.20434.
- The SharePoint Server service is exposed to the network reachable by the attacker.
- The critical function without authentication is enabled and remotely accessible.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 16.0.5561.1001; 16.0.10417.20175; 16.0.19725.20434
- Update Microsoft SharePoint Server to the fixed version 16.0.5561.1001, 16.0.10417.20175, or 16.0.19725.20434.
- Restrict network access to the SharePoint Server service to trusted sources only.
- Segment the network to limit exposure of SharePoint Server to unauthorized attackers.
Impact if exploited
Unauthenticated privilege elevation over the network — the attacker can compromise confidentiality, integrity, and availability of SharePoint Server.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 4 · PoC 4
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker, acting as a regular user on an IRC network with two or more linked servers, sends an IRCv3 message containing a specially crafted 'label' tag.
- The labeled-response module in UnrealIRCd does not escape the 'label' tag value when echoing it into replies.
- The unescaped value is interpreted as server-to-server commands.
- The injected commands are executed with server authority, allowing the attacker to perform administrative actions on the server.
Am I affected? (applicability)
- The environment uses UnrealIRCd version 6.0.0 before 6.2.7.1.
- The labeled-response module is enabled and in use.
- The IRC network has two or more linked servers.
- The attacker has a regular user account on the IRC network.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 6.2.7.1
- Update UnrealIRCd to version 6.2.7.1 or later.
- If immediate update is not possible, disable the labeled-response module.
- Restrict access to the IRC network to trusted users only and monitor account creation.
Impact if exploited
Injection of server-to-server commands executed with server authority, allowing a regular user to compromise the integrity and control of the IRC server.
Confidentiality: noneIntegrity: highAvailability: none
Also affects components beyond the vulnerable one.
Community reports (unverified): exploitation 1 · PoC 1
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends a SIP MESSAGE to an internal or external FreeSWITCH SIP profile, which accepts inbound chat by default.
- The To field of the MESSAGE is manipulated to include a plus sign followed by the chat protocol identifier 'api'.
- The sofia_presence_handle_sip_i_message() function splits the To user on the plus sign and treats the left side as a chat protocol selector.
- By selecting the 'api' protocol, execution reaches switch_api_execute(), allowing the peer whose MESSAGE was accepted to run FreeSWITCH API commands.
- This lets the attacker invoke operating-system command sinks with the daemon's privileges, resulting in command execution, call control, and disclosure of configuration and credentials.
Am I affected? (applicability)
- FreeSWITCH is running a version prior to 1.11.3.
- Inbound chat is enabled on the internal or external profiles (stock default).
- The attacker can authenticate to a SIP profile account or, in affected configurations, stock directory users without password material can remove that barrier.
- The FreeSWITCH SIP service is reachable over the network from the attacker's origin.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
- Update to version 1.11.3 or later.
- Disable inbound chat on the internal and external SIP profiles if not required.
- Restrict network access to the SIP service to trusted origins only.
- Monitor logs for SIP MESSAGE requests whose To field contains a plus sign and the 'api' selector, as well as unexpected API command executions.
Impact if exploited
Command execution with the privileges of the FreeSWITCH daemon, enabling disclosure of configuration and credentials, arbitrary call control, and operating-system command execution.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 1 · PoC 3
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends an unauthenticated HTTP request to the Tinyproxy service.
- The request includes a specially crafted HTTP Connection header.
- During HTTP connection header parsing, the remove_connection_headers() function in reqs.c frees a header value pointer.
- The freed pointer is subsequently reused during header iteration, resulting in a use-after-free.
- Reuse of freed memory causes memory corruption and could lead to remote code execution.
Am I affected? (applicability)
- Tinyproxy 1.11.1 or Tinyproxy 1.10.0 is in use.
- The Tinyproxy service is reachable over the network for unauthenticated HTTP requests.
- The HTTP Connection header parsing flow is active (default proxy behavior).
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
- Apply the vendor fix (update to a corrected version, when available).
- Restrict network access to the Tinyproxy service to trusted clients only.
- Use the automated detection available in the Nuclei template to identify vulnerable instances.
Impact if exploited
Memory corruption that could lead to unauthenticated remote code execution — full compromise of the proxy service and host.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 3 · PoC 8
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.
Requires: network access, victim action · Does not require: authentication, special target conditions
How it is exploited
Exploitation method
- The attacker sends an HTTP request to the installModule component of WonderCMS with a specially crafted script.
- The script is uploaded to the server as part of the module installation flow.
- The Cross Site Scripting flaw (CWE-79) allows the script to execute in the victim's browser context.
- Script execution leads to arbitrary code execution on the server, as described in public exploitation sources.
Am I affected? (applicability)
- WonderCMS is in use in version 3.2.0 through 3.4.2.
- The installModule component is accessible and functional.
- The victim must interact with the uploaded script (e.g., open a page or link that loads the malicious content).
- The attacker does not need prior privileges, but successful exploitation per the Metasploit module requires authentication.
Does not require: authentication, special target conditions.
Mitigation and detection
✓ Fix available in version 3.4.2
- Update WonderCMS to version 3.4.2 or later.
- Restrict access to the installModule component to authenticated and trusted users.
- Monitor HTTP requests to the installModule endpoint for suspicious uploads.
Impact if exploited
Remote code execution on the server hosting WonderCMS, allowing full system control.
Confidentiality: lowIntegrity: lowAvailability: none
Also affects components beyond the vulnerable one.
Community reports (unverified): PoC 27
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends an unauthenticated HTTP request to the vBulletin ajax/render route.
- In the request, the pagenav[pagenumber] parameter is filled with specially crafted input.
- The vB5_Template_Runtime::runMaths() method processes this input and the insufficiently restrictive regex filter is bypassed using phpfuck-style encoding with permitted characters.
- The injected PHP code is evaluated and executed by the server.
Am I affected? (applicability)
- vBulletin 5.x through 5.7.5 or 6.x through 6.2.1 is in use.
- The ajax/render route is reachable over the network.
- The pagenav[pagenumber] parameter is processed by the vB5_Template_Runtime::runMaths() method.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 6.2.2
- Update to version 6.2.2 or later.
- Restrict network access to the ajax/render route until the update is applied.
- Use the automated detection available in the Nuclei template to identify vulnerable instances.
Impact if exploited
Unauthenticated remote PHP code execution — the attacker can fully compromise the vBulletin server.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 1 · PoC 18
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker, unauthenticated and from the network, reaches the configuration-import function of Barracuda Email Security Gateway.
- They send a compatible backup archive, crafted for this purpose.
- The system restores the backup without validating authentication, accepting the imported configuration.
- The appliance's global configuration is modified without authorization.
Am I affected? (applicability)
- The environment uses Barracuda Email Security Gateway in a version earlier than 9.4.0.030.
- The appliance is one of the listed models: Email Security Gateway 300, 400, 600, 800, or 900.
- The appliance's administration interface is reachable over the network from untrusted origins.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 9.4.0.030
- Update to version 9.4.0.030 or later.
- Restrict network access to the appliance's administration interface to trusted origins.
- Use the available automated detection (Nuclei template) to identify exposed instances.
Impact if exploited
Unauthorized modification of the appliance's global configuration by an unauthenticated remote attacker, compromising the integrity of email security rules.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): PoC 2
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
Requires: network access, privileged account · Does not require: user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker must be authenticated as an administrator on an affected Barracuda product.
- They access the timezone configuration field in the administrative interface.
- They insert a timezone value containing shell metacharacters.
- When the system later processes this value, the injected commands are executed with root privileges.
Am I affected? (applicability)
- The environment uses one of the listed Barracuda products (Email Security Gateway 300, 400, 600, 800, 900 or similar models) with affected firmware.
- The attacker has valid administrator credentials on the device.
- The administrative interface is network-accessible to the attacker.
Does not require: user interaction, special target conditions.
Mitigation and detection
- Apply the vendor fix (firmware update) as soon as available.
- Restrict access to the administrative interface to trusted networks and users.
- Monitor and review changes to the timezone field and suspicious administrative activity.
Impact if exploited
Arbitrary command execution with root privileges on the device — full compromise of the appliance.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 3 · PoC 3
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends an unauthenticated request to the MLflow Tracking Server model version creation API.
- In the request, they supply an arbitrary source path with directory traversal.
- The server validates the source parameter and rejects relative/local paths, but skips that validation entirely when the request carries the mlflow.prompt.is_prompt tag (the request is then treated as a prompt).
- With validation bypassed, the traversal path is used in file operations, allowing the attacker to execute code in the context of the service account.
Am I affected? (applicability)
- MLflow Tracking Server is in use and exposed to the network.
- The model version creation API is accessible to unauthenticated attackers.
- The server does not enforce path validation when the request contains the mlflow.prompt.is_prompt tag.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
- Apply the vendor fix (corrected version not provided).
- Restrict network access to the MLflow Tracking Server, limiting exposure of the model version creation API.
- Use the available automated detection (Nuclei template) to identify vulnerable instances.
Impact if exploited
Unauthenticated remote code execution in the context of the service account — full compromise of the MLflow Tracking Server.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): PoC 1
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker, positioned on the same network, initiates a connection to the Screen Sharing service on the target macOS.
- The attacker attempts to authenticate to the service without valid credentials.
- Due to a state management flaw in authentication, the system accepts the improper authentication.
- The attacker gains authenticated access to Screen Sharing and can interact with the remote session.
Am I affected? (applicability)
- The Screen Sharing service is enabled on macOS.
- macOS is running a version prior to the fix: macOS Sequoia before 15.7.9, macOS Sonoma before 14.8.9, macOS Tahoe before 26.6.1 or 26.7, or macOS Golden Gate before 27.
- The Screen Sharing service is reachable from the network where the attacker is located.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 14.8.9; 15.7.9; 26.6.1; 26.7
- Update to the fixed versions: macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1 or 26.7, or macOS Golden Gate 27.
- Disable the Screen Sharing service where it is not required.
- Restrict network access to the Screen Sharing service to trusted hosts and networks.
- Segment the network to limit exposure of the service to attackers on the same network.
Impact if exploited
Improper authentication to Screen Sharing without valid credentials — unauthorized access to the remote session, risking confidentiality, integrity, and availability of the system.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 16 · PoC 4
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter.. Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends an HTTP request to the /pprof/heap endpoint of the built-in Apache bRPC heap profiler service.
- In the request, the attacker sets the display parameter and supplies a malicious value in the extra_options parameter.
- The service does not validate or sanitize extra_options and concatenates it directly into a shell command string passed to popen().
- The injected command is executed by the operating system with the privileges of the bRPC process, allowing remote command execution.
Am I affected? (applicability)
- The environment uses Apache bRPC in a version prior to 1.15.0.
- The built-in bRPC heap profiler service is enabled and reachable over the network.
- The /pprof/heap endpoint is exposed to unauthenticated attackers.
- jemalloc memory profiling is in use through the heap profiler service.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 1.15.0
- Update Apache bRPC to version 1.15.0.
- Manually apply the patch available at https://github.com/apache/brpc/pull/3101.
- Restrict network access to the /pprof/heap endpoint, allowing only trusted sources.
- Use the available automated detection (Nuclei template) to identify vulnerable instances.
Impact if exploited
Remote execution of arbitrary commands on the server with the privileges of the bRPC process, allowing full compromise of the system's confidentiality, integrity, and availability.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): PoC 3
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
Requires: network access, privileged account · Does not require: user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker, authenticated in Webmail, bypasses the normal Webmail experience to reach the Webtop Media Transcoder.
- They submit or trigger the conversion of a document type not allowed by the administrator-defined restrictions.
- Webtop Media Transcoder does not enforce the file type restrictions and processes the unintended document conversion.
- Processing the disallowed type consumes resources and may cause limited availability impact on the transcoding service.
Am I affected? (applicability)
- The environment uses Openwave Webtop Media Transcoder.
- The attacker has an authenticated Webmail account.
- The attacker can bypass the Webmail experience to invoke the transcoder directly.
- The transcoder is reachable over the network from the attacker's position.
Does not require: user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 1.1.22.0
- Update to the fixed version 1.1.22.0.
- Restrict network access to Webtop Media Transcoder to only necessary origins.
- Monitor conversions of document types not allowed by administrative restrictions.
Impact if exploited
Processing and conversion of unintended document types, with possible limited availability impact on the transcoding service.
Confidentiality: noneIntegrity: noneAvailability: low
Community reports (unverified): exploitation 1 · PoC 1
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safe_exec(), which performs no sanitization. The cycle_execs.php script, which is web-accessible without authentication, retrieves queued commands and passes them directly to exec(). An attacker can exploit a race condition by first triggering cycle_execs.php (which purges the queue and enters a polling loop), then injecting a malicious command via the rc endpoint while the worker is polling. The injected shell metacharacters expand inside double quotes, achieving remote code execution within one second.
Requires: network access, target conditions · Does not require: authentication, user interaction
How it is exploited
Exploitation method
- The attacker accesses the cycle_execs.php endpoint without authentication to start the polling worker, which purges the command queue and enters an infinite loop polling the safe_execs table every second.
- While the worker is polling, the attacker sends a request to the rc/index.php endpoint with the param parameter containing shell metacharacters.
- The parameter is interpolated into a command string within double quotes without escapeshellarg() sanitization and inserted into the database queue by the safe_exec() function, which performs no sanitization.
- On the next iteration, the worker retrieves the command from the queue and passes it directly to exec(), executing the injected command and resulting in remote code execution.
Am I affected? (applicability)
- MajorDoMo is installed and the rc/index.php endpoint is reachable over the network without authentication.
- The cycle_execs.php script is web-accessible without authentication.
- The cycle_execs.php worker can be started by the attacker (e.g., via HTTP request) and remains polling.
- The param parameter is accepted by the rc/index.php endpoint and interpolated into a command without sanitization.
- The injected command references a valid .bat file in the rc/commands/ directory (default installation ships with shutdown.bat).
Does not require: authentication, user interaction.
Mitigation and detection
- Apply the vendor fix (corrected version not provided).
- Restrict network access to the rc/index.php and cycle_execs.php endpoints, allowing only trusted sources.
- Use the available Nuclei template for automated detection of the vulnerability.
Impact if exploited
Unauthenticated remote code execution on the server hosting MajorDoMo, allowing the attacker to take full control of the system.
Confidentiality: highIntegrity: highAvailability: high
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
Requires: network access, victim action · Does not require: authentication, special target conditions
How it is exploited
Exploitation method
- The attacker accesses the Zammad application over the network without prior privileges.
- The attacker induces the victim to interact (e.g., click a link or open a page) to enable session hijacking.
- Session hijacking allows the attacker to assume the victim's identity in the application.
- With the hijacked session, the attacker executes remote code with the permissions of the zammad user.
Am I affected? (applicability)
- The Zammad version in use is between 6.3.0 and 6.5.4 (inclusive).
- The Zammad version in use is between 7.0.0 and 7.1.2 (inclusive) — the bug is present but not exploitable due to changes in the underlying framework.
- The Zammad application is exposed to the network and reachable by the attacker.
- A Zammad user can be induced to perform the interaction required for session hijacking.
Does not require: authentication, special target conditions.
Mitigation and detection
✓ Fix available in version 6.3.0; 6.5.4; 7.1.3
- Update to the fixed versions: 6.3.0, 6.5.4, or 7.1.3.
- Restrict network access to the Zammad application to trusted sources only.
- Monitor and invalidate suspicious user sessions.
Impact if exploited
Session hijacking leading to remote code execution as the zammad user — compromise of the application and data accessible to that user.
Confidentiality: highIntegrity: highAvailability: high
Also affects components beyond the vulnerable one.
Community reports (unverified): exploitation 4 · PoC 5
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends a remote authentication request to the Samba server configured with the 'check password script' feature.
- The client-controlled username is passed to the script without proper escaping of shell meta-characters, due to the use of the %u substitution character.
- The script is executed by the samba-dcerpcd service with the meta-characters interpreted by the shell.
- The attacker achieves arbitrary command execution on the affected system.
Am I affected? (applicability)
- The Samba server or classic domain controller is configured with the 'check password script' feature.
- The check password script uses the %u substitution character.
- The samba-dcerpcd service is started as a system service.
- The Samba version in use is earlier than the fixed version indicated (0:4.23.5-109.el10_2, 0:4.21.3-114.el10_0.1, 0:4.10.16-26.el7_9.1, 0:4.19.4-16.el8_10).
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 0:4.23.5-109.el10_2; 0:4.21.3-114.el10_0.1; 0:4.10.16-26.el7_9.1; 0:4.19.4-16.el8_10
- Update Samba to the fixed version: 0:4.23.5-109.el10_2, 0:4.21.3-114.el10_0.1, 0:4.10.16-26.el7_9.1, or 0:4.19.4-16.el8_10.
- Review the 'check password script' configuration and avoid using the %u substitution character if possible.
- Restrict network access to affected Samba services to trusted clients only.
- Monitor samba-dcerpcd and check password script logs for suspicious activity.
Impact if exploited
Remote command execution on the affected system, allowing the attacker to fully compromise the Samba server or domain controller.
Confidentiality: highIntegrity: highAvailability: high
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP requests.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends HTTP requests to the FortiSandbox JRPC API.
- The attacker supplies a manipulated session value containing '../filedir'.
- The is_valid_session() function passes the value to os.path.join() without validation.
- The resolved path points to an existing directory (e.g., /tmp/), causing the session check to succeed.
- The attacker gains unauthenticated read access.
Am I affected? (applicability)
- FortiSandbox versions 5.0.0 through 5.0.5 or 4.4.0 through 4.4.8.
- The FortiSandbox JRPC API is reachable over the network.
- The is_valid_session() function is used to validate sessions.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
- Apply the vendor fix.
- Restrict network access to the FortiSandbox JRPC API.
- Use the available automated detection (Nuclei template) to identify the vulnerability.
Impact if exploited
Authentication bypass with unauthenticated read access, allowing privilege escalation.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): exploitation 4 · PoC 3
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.
Requires: network access, target conditions · Does not require: authentication, user interaction
How it is exploited
Exploitation method
- The attacker accesses N-central over the network without valid credentials.
- They use an alternate path or channel in authentication to bypass identity verification.
- The system grants unauthorized authenticated access, allowing the attacker to act as a legitimate user.
Am I affected? (applicability)
- N-central is in use at version through 2026.1 (inclusive).
- The N-central service is exposed to the network and reachable by the attacker.
- N-central authentication is enabled and uses the vulnerable alternate path or channel (CWE-288).
Does not require: authentication, user interaction.
Mitigation and detection
- Apply the vendor fix (corrected version not provided in the CVE record).
- Restrict network access to the N-central service to trusted sources only.
- Segment the network to limit N-central exposure.
- Monitor authentication attempts and access via alternate paths or channels.
Impact if exploited
Authentication bypass in N-central — an unauthenticated remote attacker gains unauthorized authenticated access, compromising system confidentiality.
Confidentiality: highIntegrity: noneAvailability: none
Community reports (unverified): exploitation 3
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.
Requires: local access, privileged account · Does not require: user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker needs local access to the target system, with a session or code already running on the host.
- The attacker triggers the BPF (Berkeley Packet Filter) mechanism through calls that exploit the incorrect sign extension in the check_alu_op function of the BPF verifier.
- The incorrect sign check allows the verifier to be bypassed, resulting in arbitrary kernel read/write.
- With arbitrary kernel read/write, the attacker can corrupt memory (denial of service) or achieve unspecified other impacts, such as privilege escalation.
Am I affected? (applicability)
- The Linux kernel in use is prior to version 4.14.8 (as per the Metasploit module) or within the 'through 4.4' range indicated by NVD; verify the exact kernel version on the host.
- The system is compiled with BPF support.
- Unprivileged access to BPF is permitted, i.e., kernel.unprivileged_bpf_disabled is not set to 1.
- The attacker has a local account with low privileges that allows executing code on the host.
Does not require: user interaction, special target conditions.
Mitigation and detection
- Apply the vendor fix for the Linux kernel (update to a corrected version).
- Set kernel.unprivileged_bpf_disabled to 1 to prevent unprivileged BPF access.
- Restrict local access to the host to trusted users only.
Impact if exploited
Kernel memory corruption (denial of service) or possible privilege escalation and unspecified other impacts, compromising system integrity and confidentiality.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): PoC 8
References and technical detail
- NVD — registro oficial ↗
- Advisory do fornecedor ↗
- Advisory do fornecedor ↗
- Advisory do fornecedor ↗
- Advisory do fornecedor ↗
- Advisory do fornecedor ↗
- Metasploit: exploit/linux/local/bpf_sign_extension_priv_esc ↗
- Exploit-DB: Linux - BPF Sign Extension Local Privilege Escalation (Metasploit) ↗
- Exploit-DB: Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation ↗
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.
Requires: network access, target conditions · Does not require: authentication, user interaction
How it is exploited
Exploitation method
- The attacker sends a remote print job to the Samba printing service.
- The attacker controls the job description string and includes unescaped shell meta characters.
- Samba substitutes the %J character with the job description in the 'print command' setting without escaping meta characters.
- The configured command is executed by the shell with the injected characters, resulting in remote code execution.
Am I affected? (applicability)
- The Samba printing subsystem is in use and reachable over the network.
- The 'print command' setting uses the %J substitution character.
- The Samba version in use is prior to the fix (fixed versions: 0:4.23.5-109.el10_2, 0:4.21.3-114.el10_0.1, 0:4.10.16-26.el7_9.1, 0:4.19.4-16.el8_10).
Does not require: authentication, user interaction.
Mitigation and detection
✓ Fix available in version 0:4.23.5-109.el10_2; 0:4.21.3-114.el10_0.1; 0:4.10.16-26.el7_9.1; 0:4.19.4-16.el8_10
- Update to the fixed versions: 0:4.23.5-109.el10_2, 0:4.21.3-114.el10_0.1, 0:4.10.16-26.el7_9.1, 0:4.19.4-16.el8_10.
- Restrict network access to the Samba printing service.
- Use the available automated detection (Nuclei template) to identify vulnerable instances.
Impact if exploited
Remote code execution on the affected system, allowing full control of the server.
Confidentiality: highIntegrity: highAvailability: high
Also affects components beyond the vulnerable one.
Community reports (unverified): PoC 14
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends unauthenticated remote requests to the FUXA service exposed on the network.
- The improper access control flaw (CWE-862) in scheduler management allows creating and modifying schedulers without authentication.
- The system accepts scheduler operations without validating the requester's authorization.
- The created or modified schedulers execute actions in the connected ICS/SCADA environment, enabling follow-on actions.
Am I affected? (applicability)
- FUXA version 1.2.8 through 1.2.10 is in use.
- The FUXA service is reachable over the network from untrusted origins.
- The connected ICS/SCADA environment relies on FUXA for visualization or operation.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
- Update FUXA to version 1.2.11.
- Restrict network access to the FUXA service to trusted origins.
- Segment FUXA from the ICS/SCADA environment to limit follow-on actions.
- Use the available Nuclei template for automated detection of the flaw.
Impact if exploited
Unauthenticated creation and modification of schedulers in FUXA, exposing the connected ICS/SCADA environment to follow-on actions.
Confidentiality: noneIntegrity: highAvailability: high
Also affects components beyond the vulnerable one.
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends an unauthenticated HTTP request to the RSFiles component endpoint (com_rsfiles), triggering the rsfiles.upload task.
- The component's write method performs no authentication, CSRF token, or file extension checks.
- The attacker uploads an executable PHP file to the web-accessible downloads/ directory.
- The uploaded file is executed on the server, resulting in remote code execution (RCE).
Am I affected? (applicability)
- The RSFiles component (com_rsfiles) is installed in Joomla.
- The RSFiles version is earlier than 1.17.12.
- The component's downloads/ directory is web-accessible.
- The RSFiles component endpoint is exposed to the network.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
- Update the RSFiles component to version 1.17.12 or later.
- Restrict network access to the RSFiles component endpoint.
- Use the automated detection available in the Nuclei template to identify vulnerable instances.
Impact if exploited
Unauthenticated remote code execution on the web server — full control of the Joomla server.
Confidentiality: highIntegrity: highAvailability: high
Also affects components beyond the vulnerable one.
Community reports (unverified): PoC 13
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends specially crafted network traffic to an internal component of SAP NetWeaver Application Server ABAP.
- The internal component processes the network input without sufficiently validating the received data.
- The validation failure leads to a memory corruption condition in the affected functionality.
- Successful exploitation allows arbitrary code execution and full compromise of the system.
Am I affected? (applicability)
- SAP NetWeaver Application Server ABAP is in use in the environment.
- The internal component that processes network input is reachable from the attacker's network.
- No authentication barrier or network segmentation prevents sending traffic to the internal component.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
- Apply the vendor fix.
- Restrict network access to the affected internal component, allowing only trusted sources.
- Segment the network to limit exposure of SAP NetWeaver Application Server ABAP.
- Monitor anomalous network traffic directed at the internal component for memory corruption attempts.
Impact if exploited
Unauthenticated remote code execution — full system compromise, with high impact on confidentiality, integrity, and availability.
Confidentiality: highIntegrity: highAvailability: high
Also affects components beyond the vulnerable one.
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends specially crafted network traffic to SAP Web Dispatcher.
- An internal component of SAP Web Dispatcher processes the network input without sufficient validation.
- The validation flaw triggers a memory corruption condition (CWE-122: heap-based buffer overflow).
- Successful exploitation allows arbitrary code execution and full system compromise.
Am I affected? (applicability)
- SAP Web Dispatcher is in use in the environment.
- SAP Web Dispatcher is reachable over the network by unauthenticated attackers.
- No fixed version is provided in the CVE record to confirm the update.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
- Apply the vendor (SAP) fix, as the fixed version is not provided in the CVE record.
- Restrict network access to SAP Web Dispatcher to trusted sources only.
- Segment the network to limit exposure of SAP Web Dispatcher to unauthenticated attackers.
Impact if exploited
Unauthenticated remote code execution on SAP Web Dispatcher — full system compromise, with high impact on confidentiality, integrity, and availability.
Confidentiality: highIntegrity: highAvailability: high
Also affects components beyond the vulnerable one.
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker, unauthenticated and with network access to the SAP Gateway, sends requests to the service.
- The SAP Gateway applies the default Access Control List with high privileges, categorizing the external attacker as an internal application server.
- Due to this improper categorization, the attacker is treated as a trusted internal entity.
- The attacker can then perform unauthorized actions within the application environment.
Am I affected? (applicability)
- The SAP Gateway is exposed to the network and reachable by unauthenticated attackers.
- The default Access Control List of the SAP Gateway is active with high privileges.
- There is no network restriction preventing external access to the SAP Gateway.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
- Apply the vendor fix for the SAP Gateway.
- Restrict network access to the SAP Gateway to trusted sources only.
- Review and adjust the default Access Control List configuration to avoid improper high privileges.
- Monitor SAP Gateway logs to detect unauthenticated requests that result in categorization as an internal application server.
Impact if exploited
Unauthorized actions within the application environment, with high impact on the confidentiality, integrity, and availability of the affected system.
Confidentiality: highIntegrity: highAvailability: high
Also affects components beyond the vulnerable one.
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends specially crafted data over the network to the SAP NetWeaver AS ABAP or ABAP Platform system.
- The system does not sufficiently verify incoming authentication assertions under certain configurations.
- The flaw allows bypassing authentication and impersonating arbitrary users, including privileged accounts.
- The compromise may extend to connected components and systems.
Am I affected? (applicability)
- The environment uses SAP NetWeaver AS ABAP or ABAP Platform.
- The system configuration allows receipt of authentication assertions from untrusted sources or without adequate verification.
- The service is exposed to the network, allowing an unauthenticated attacker to send data.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
- Apply the vendor fix.
- Restrict network access to the SAP NetWeaver AS ABAP/ABAP Platform service.
- Review and harden authentication assertion verification configurations.
- Segment the network to limit impact on connected components and systems.
Impact if exploited
Authentication bypass with impersonation of arbitrary users, including privileged accounts, leading to full system compromise and possible propagation to connected components and systems, with high impact on confidentiality, integrity, and availability.
Confidentiality: highIntegrity: highAvailability: high
Also affects components beyond the vulnerable one.
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends a SOAP request to the Apache Axis 1.x service, without authentication.
- The message contains a SOAP <Fault> element with <detail><exceptionName> pointing to a class present on the application's classpath.
- Axis loads the named class; if a String <data> element is also present, it instantiates the class through its String constructor before checking that it is an AxisFault.
- Loading alone runs the class's static initializer, and instantiation through the String constructor is also triggered.
- With a suitable class on the classpath, this leads to remote code execution; the fault is parsed before any per-service handler chain runs, so authentication configured on a service does not protect against it.
Am I affected? (applicability)
- Apache Axis 1.x is in use, in any version through 1.4.
- The Axis SOAP service is exposed to the network and reachable by the attacker.
- The application's classpath contains a suitable class that, when loaded or instantiated through a String constructor, allows code execution.
- Authentication handlers are configured on the service, but they do not protect because the fault is parsed before the handler chain runs.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 41f3b4e8d04e310ca81f86b92630ab2c11d608bd
- Migrate to another SOAP engine, such as Apache Axis 2/Java, or apply the vendor fix (patch from commit 41f3b4e8d04e310ca81f86b92630ab2c11d608bd) to an Axis build.
- Restrict network access to the Axis SOAP service to trusted clients only.
- Review the application's classpath to remove classes that could be abused through loading or instantiation via a String constructor.
Impact if exploited
Unauthenticated remote code execution on the server hosting Apache Axis 1.x, with loss of confidentiality, integrity, and availability of the system.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): PoC 1
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends a network request to NetScaler ADC or NetScaler Gateway configured as a SAML IDP.
- Input is not sufficiently validated, leading to a memory overread.
- The system processes the request and may expose data or crash, depending on adjacent memory contents.
Am I affected? (applicability)
- NetScaler ADC or NetScaler Gateway is configured as a SAML IDP.
- The version in use is prior to the fix (72.61, 63.18, or 37.272, depending on the branch).
- The SAML IDP service is reachable over the network.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 72.61; 63.18; 37.272
- Update to the fixed version: 72.61, 63.18, or 37.272.
- Restrict network access to the SAML IDP service to trusted sources only.
- Monitor for exploitation attempts and failures in the SAML IDP service.
Impact if exploited
Memory overread may expose sensitive data and cause unavailability of the SAML IDP service.
Confidentiality: highIntegrity: lowAvailability: high
Community reports (unverified): exploitation 2 · PoC 8
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
Requires: network access, target conditions · Does not require: authentication, user interaction
How it is exploited
Exploitation method
- The attacker sends remote HTTP requests to the Apache HTTP Server with mod_http2 enabled.
- The requests trigger the assign_headers() function in mod_http2, which handles a shared resource without proper synchronization.
- The race condition (CWE-362) is exploited to achieve remote code execution.
Am I affected? (applicability)
- Apache HTTP Server is in use in versions 2.4.55 through 2.4.70.
- The mod_http2 module is enabled and reachable over the network.
- The mod_h2 (GitHub) version is between 2.0.8 and 2.0.42.
- The attacker can send HTTP requests to the server without prior authentication.
- Exploitation depends on concurrency conditions on the target, outside the attacker's control (AC:H).
Does not require: authentication, user interaction.
Mitigation and detection
- Apply the vendor fix (corrected version not provided in the CVE record).
- Disable the mod_http2 module if not required.
- Restrict network access to the HTTP service to trusted sources only.
- Monitor for exploitation attempts through logs of anomalous HTTP requests to mod_http2.
Impact if exploited
Remote code execution on the Apache HTTP Server, allowing full control of the service and compromising confidentiality, integrity, and availability.
Confidentiality: highIntegrity: highAvailability: high
Community reports (unverified): PoC 16
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends a network request to an N-central endpoint that processes XML.
- The XML includes a reference to a malicious external entity.
- The system does not properly restrict external entity resolution (CWE-611), allowing XML Schema Poisoning.
- As a result, the attacker may achieve read of sensitive data and modification of information processed by the service.
Am I affected? (applicability)
- N-central is in use in a version prior to 26.4.1.
- The N-central service is exposed to the network (remotely accessible).
- The XML-processing endpoint is accessible without prior authentication.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 26.4.1
- Update N-central to version 26.4.1 or later.
- Restrict network access to XML-processing endpoints, allowing only trusted sources.
- Monitor for attempts to send XML with external entity references.
Impact if exploited
Read of sensitive data and modification of information processed by N-central, with potential impact on the confidentiality and integrity of the service.
Confidentiality: highIntegrity: highAvailability: low
Community reports (unverified): exploitation 1
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. This issue affects N-central: before 26.4.1.
Requires: network access · Does not require: authentication, user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker sends a network request to an N-central endpoint that accepts URL or destination parameters.
- The system fails to properly validate the supplied destination and performs the request on the attacker's behalf.
- The request is directed to an unintended internal or external resource, allowing access to internal services or actions on behalf of the server.
Am I affected? (applicability)
- N-central is in use in a version prior to 26.4.1.
- The N-central service is exposed to the network and reachable by the attacker.
- The vulnerable endpoint that accepts destination parameters is accessible without prior authentication.
Does not require: authentication, user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 26.4.1
- Update N-central to version 26.4.1 or later.
- Restrict network access to the N-central service to trusted sources only.
- Segment the network to limit the N-central server's reach to sensitive internal services.
Impact if exploited
Forged requests from the N-central server can reach internal services not otherwise exposed, compromising the confidentiality and integrity of those systems.
Confidentiality: highIntegrity: highAvailability: low
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injection. This issue affects N-central: before 26.4.1.
Requires: network access, privileged account · Does not require: user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker, with network access, sends a request to N-central exploiting improper neutralization of input during web page generation.
- The malicious input is processed and reflected or stored in the generated page, resulting in cross-site scripting (CWE-79).
- A legitimate user's browser executes the injected script in the application context.
- The attacker can perform actions on behalf of the victim or obtain sensitive data, as the CVSS vector indicates high impact on confidentiality and integrity.
Am I affected? (applicability)
- N-central is in use in a version prior to 26.4.1.
- The attacker has valid credentials with privileges (PR:L) to access the N-central web interface.
- The N-central web interface is exposed to the network (AV:N).
Does not require: user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 26.4.1
- Update N-central to version 26.4.1 or later.
- Restrict network access to the N-central web interface to trusted networks.
- Monitor access and request logs for script injection attempts.
Impact if exploited
Script execution in the victim's browser within the N-central context, allowing session theft, data alteration, and unauthorized actions on behalf of the user.
Confidentiality: highIntegrity: highAvailability: low
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Relative path traversal vulnerability in N-able N-central allows Path Traversal. This issue affects N-central: before 26.4.1.
Requires: network access, privileged account · Does not require: user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker, with network access, sends requests to the N-central service.
- The attacker uses a manipulated relative path to traverse directories (path traversal).
- The system does not properly validate the path, allowing access to files or directories outside the intended scope.
- This can result in reading or altering files, depending on process permissions.
Am I affected? (applicability)
- The N-central version in use is earlier than 26.4.1.
- The N-central service is exposed to the network and reachable by the attacker.
- The attacker has valid credentials with high privileges (PR:H).
Does not require: user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 26.4.1
- Update N-central to version 26.4.1 or later.
- Restrict network access to the N-central service to trusted sources only.
- Monitor path traversal attempts in the service logs.
Impact if exploited
Path traversal with high impact on confidentiality and integrity, allowing unauthorized access to files and possible data alteration on the N-central server.
Confidentiality: highIntegrity: highAvailability: low
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 26.4.1.
Requires: network access, privileged account · Does not require: user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker accesses N-central over the network.
- With an existing privilege, sends a request that exploits the incorrect privilege assignment.
- The system grants the attacker a higher privilege level than intended.
- The attacker operates with elevated privileges, compromising confidentiality and integrity.
Am I affected? (applicability)
- A version of N-central prior to 26.4.1 is in use.
- The attacker has an authenticated account on N-central with some privilege (PR:H in the vector).
- The N-central service is reachable over the network by the attacker.
Does not require: user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 26.4.1
- Update N-central to version 26.4.1 or later.
- Restrict network access to N-central to trusted sources only.
- Review and limit authenticated accounts with privileges on N-central.
Impact if exploited
Privilege escalation in N-central — an authenticated attacker gains higher privileges, with high impact on system confidentiality and integrity.
Confidentiality: highIntegrity: highAvailability: low
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: before 2026.4.1.
Requires: local access, privileged account · Does not require: user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker already has local access to the host or a session on the system.
- They invoke a critical function in N-central that lacks authentication.
- The system executes the function without validating the requester's identity or permission.
- The attacker gains elevated privileges in N-central.
Am I affected? (applicability)
- N-central is in use at a version before 2026.4.1.
- The attacker already has local access to the host or a session in N-central.
- The affected critical function is available and reachable from that local session.
Does not require: user interaction, special target conditions.
Mitigation and detection
✓ Fix available in version 2026.4.1
- Update N-central to version 2026.4.1 or later.
- Restrict local access to the host and sessions in N-central to strictly necessary users and processes.
- Monitor and review privilege changes in N-central.
Impact if exploited
Privilege escalation in N-central — an attacker with local access gains elevated control over the system, compromising confidentiality and integrity.
Confidentiality: highIntegrity: highAvailability: low
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS). This issue affects N-central: before 26.4.1.
Requires: network access, privileged account, victim action · Does not require: special target conditions
How it is exploited
Exploitation method
- The attacker, with high privileges in N-central, sends an HTTP request containing malicious headers to an application endpoint.
- The application fails to properly neutralize script syntax in HTTP headers (CWE-644).
- The victim, upon interacting with the affected interface, has the malicious content reflected or stored and executed in the browser context.
- The script runs with the victim's privileges, allowing actions on their behalf within the N-central session.
Am I affected? (applicability)
- The N-central version in use is earlier than 26.4.1.
- The attacker has an authenticated account with high privileges in N-central (per PR:H of the CVSS vector).
- The victim must interact with the affected interface (UI:A of the CVSS vector).
- The N-central web interface is reachable over the network (AV:N of the CVSS vector).
Does not require: special target conditions.
Mitigation and detection
✓ Fix available in version 26.4.1
- Update N-central to version 26.4.1 or later.
- Restrict access to the N-central web interface to trusted networks and users.
- Monitor HTTP requests with anomalous headers or script injection attempts.
Impact if exploited
Script execution in the victim's browser within the N-central context, allowing actions on their behalf and potential session compromise.
Confidentiality: highIntegrity: highAvailability: low
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
Requires: network access, privileged account · Does not require: user interaction, special target conditions
How it is exploited
Exploitation method
- The attacker, authenticated, creates a namespace whose name contains an underscore character (_).
- Quay's robot account listing function builds a SQL LIKE pattern from the user-controlled namespace name without escaping wildcard metacharacters.
- The underscore acts as a wildcard in the LIKE, causing the query to match namespaces from other tenants.
- The system returns robot accounts and their decrypted authentication tokens belonging to other tenants.
- The attacker uses the obtained tokens to perform unauthorized image operations on other tenants' resources.
Am I affected? (applicability)
- The attacker has an authenticated account in Quay with permission to create namespaces.
- Quay is exposed to the network and reachable by the attacker.
- The Quay version in use contains the vulnerable robot account listing function (LIKE pattern construction without escaping).
Does not require: user interaction, special target conditions.
Mitigation and detection
- Apply the vendor fix for Quay.
- Restrict namespace creation to trusted users.
- Monitor for creation of namespaces with names containing underscores and for cross-tenant robot account listing.
Impact if exploited
Cross-tenant credential theft: authentication tokens of robot accounts from other tenants are exposed, allowing unauthorized image operations.
Confidentiality: highIntegrity: highAvailability: high
Also affects components beyond the vulnerable one.
References and technical detail
The “Requires/Does not require” line and the confidentiality, integrity and availability impact come from the official CVSS vector. Method, applicability and mitigation are an automatic summary of the NVD description, public exploitation sources (Metasploit, Nuclei, Exploit-DB) and the CVE record via CIRCL (advisories and fixed version), linked under “References and technical detail”. Community reports come from CIRCL sightings and are unverified.
Recent zero-days
Windows 0-day dropped by disgruntled researcher hands hackers System rights
"SignDrop" exploit lets local users gain all-powerful System rights.
Check Point warns of zero-day flaw exploited for root access
Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October. [...]
Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process. The post Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’ appeared first on SecurityWeek .
Hackers Exploit New N-central Zero-Day Hours After PoC Publication
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges. The post Hackers Exploit New N-central Zero-Day Hours After PoC Publication appeared first on SecurityWeek .
Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2
N-able on Thursday said it's taking additional precautions in the wake of public disclosure of a new set of flaws tracked as 4EverAble2Shell and Agent2Shell. "We are restricting certain N-central features and integrations," the company said in a Thursday update. "These measures may affect some functionality, but we believe taking additional precautions while remediation is completed is the
Zero-day no N-able N-central é explorada e instala mineradores
Atacantes exploram uma nova zero-day no N-able N-central, apelidada “4EverAble2Shell”, para comprometer servidores e instalar mineradores de criptomoedas. Pesquisadores relatam ao menos 21 sistemas afetados, sendo 19 com a atualização de segurança mais recente. Divulgação e mecanismo O pesquisador Sean Bales publicou em 12 de novembro dois exploits zero-day, 4EverAble2Shell e Agent2Shell, testados contra o […]
More news (94)
New N-able "4EverAble2Shell" zero-day exploited hours after PoC released
Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed "4EverAble2Shell" to compromise servers and deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, including 19 running the company's latest security update. [...]
New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver. The proof of concept, called SignDrop, targets a log-authentication feature added to the driver last year. It abuses how clfs.sys creates companion files when a privileged process opens a prepared log, using path redirection to take control of
New Windows SignDrop zero-day gives hackers SYSTEM privileges
Security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) has released a new Windows zero-day exploit that can let attackers gain SYSTEM privileges. [...]
Zero-day no FortiMail exige prioridade máxima em correção
Um zero-day está sendo ativamente explorado no FortiMail: ele é identificado como CVE-2026-104286, está no catálogo KEV da CISA desde 1º de outubro e é o item mais crítico do lote de correções liberado pela Fortinet em 22 de outubro, segundo relatório da Solustic Tecnologia. O firmware corrigido para FortiOS, FortiManager, FortiAnalyzer, FortiMail e FortiAuthenticator […]
N-able releases security hotfixes for zero-day vulnerabilities
N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted environments offline. [...]
Microsoft Patch Tuesday fixes Outlook flaw already under attack
Microsoft’s November 2026 Patch Tuesday fixes an actively exploited Outlook vulnerability. Check for Office updates separately.
Microsoft corrige falhas, incluindo zero-day explorada no Outlook
A Microsoft publicou atualizações de segurança referentes a novembro de 2026 que corrigem 1.094 vulnerabilidades em seus produtos, incluindo uma falha no Outlook que a empresa afirma ter sido explorada. A zero-day, rastreada como CVE-2026-124194, foi classificada como falha de falsificação (spoofing) e decorre do fato de o Outlook não alertar os usuários antes de […]
Google corrige falha zero-day do Chrome explorada em ataques
O Google publicou atualizações emergenciais de segurança para corrigir uma nova vulnerabilidade no Chrome explorada em ataques zero-day, a oitava falha do tipo desde o início do ano. A empresa informou em comunicado de segurança publicado na segunda-feira que tem conhecimento de um exploit para a CVE-2026-125350 em uso ativo. Origem da falha A vulnerabilidade […]
Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
CVE-2026-124194 is the Outlook zero-day for which Microsoft says it’s aware of active exploitation. The post Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft appeared first on SecurityWeek .
Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062. "REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the
Update Chrome now to fix a flaw attackers are exploiting
Google has released Chrome updates for desktop and Android to patch a zero-day vulnerability already being exploited in attacks.
Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix. A researcher who goes by forcequit released the escape, called worse_query, on Sunday, a
Google patches eighth Chrome zero-day exploited in attacks this year
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. [...]
Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component. Use-after-free bugs typically occur when a program attempts to access a memory location after
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks. The post Chrome Update Patches Exploited XML Zero-Day, Eighth This Year appeared first on SecurityWeek .
Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion
Last month, Microsoft disclosed a vulnerability in Microsoft Paint, but messaging regarding a patch was unclear.
Hackers exploit SSHole OpenSSH flaw to breach Linux systems
Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. [...]
Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the wallets, both companies said late last week. Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker
Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)
SonicWall has fixed an exploited SonicOS SSL-VPN vulnerability (CVE-2026-19868) that may allow attackers with valid credentials to bypass SAML-enforced multi-factor authentication. With no workarounds listed, the company has urged admins to patch quickly. About CVE-2026-19868 CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSL-VPN service, and is exploitable only if SAML is enabled for SSL-VPN logins. According to SonicWall, a user with valid credentials for an alternate authentication method may be able to bypass … More → The post Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868) appeared first on Help Net Security .
LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday. It has several security fixes to release and asked operators to be careful until they are out. One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could
SonicWall corrige bypass de MFA explorado no SSL-VPN
A SonicWall publicou atualizações de segurança para corrigir sete vulnerabilidades nos firewalls SonicOS, incluindo uma falha de bypass de autenticação em SSL-VPN explorada em ataques. A falha, rastreada como CVE-2026-19868, permite que atacantes com credenciais válidas para um método de autenticação alternativo contornem os controles de autenticação SAML, potencialmente incluindo o MFA imposto por SAML […]
Falha de autenticação no OpenSSH afeta sistemas Linux
Uma vulnerabilidade em bypass de autenticação no OpenSSH, presente há cerca de uma década na aplicação em sistemas Linux que utilizam a biblioteca musl, permite que atacantes acessem contas simplesmente digitando qualquer senha com mais de 256 caracteres. A falha, apelidada de “*sshole”, está registrada como CVE-2026-123158 e foi detalhada pelo pesquisador Özgün Kültekin, que […]
SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA. The post SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins appeared first on SecurityWeek .
Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian. The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled,
Zyxel corrige falha explorada em switches GS1900 globalmente
A Zyxel publicou uma atualização de segurança para uma vulnerabilidade que comprometeu cerca de mil switches da linha GS1900 em todo o mundo. A falha, identificada como CVE-2026-107441, permite que um atacante não autenticado execute comandos no sistema ao enviar uma requisição HTTP especialmente construída à interface web do equipamento. A empresa de cibersegurança Binarly […]
OpenSSH flaw lets attackers log into password-disabled Linux accounts
A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password. [...]
Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries
From EOP to RCE in six simple steps
Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441)
Zyxel GS1900 series network switches that received a fix for a flaw that was later reported to have been exploited in the wild are still open to an exploit attackers used, Binarly found. That’s because the patch fixed a different bug (CVE-2026-7273) from the one (CVE-2026-107441) the exploit actually relies on. The exploit for an unpatched bug In June 2026, Zyxel published an advisory on CVE-2026-7273, a stack-based buffer overflow vulnerability in the CGI program … More → The post Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441) appeared first on Help Net Security .
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests. The post Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day appeared first on SecurityWeek .
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found. The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that closes the hole. The earlier fix is the 2.90
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. [...]
SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records
SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched. Details of the security flaws, which affect SonicWall GMS 9.5.2 and earlier versions, are below - CVE-2026-109593 (CVSS score: 9.1) - An unauthenticated file read vulnerability that could allow an attacker with network access to read internal GMS files,
UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
UEFI bootkit BlackX exploits Microsoft's lack of clarity around Secure Boot protections.
Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract
QNAP lança correções para PHP2Shell em sistemas NAS
A QNAP publicou atualizações de segurança para corrigir as falhas PHP2Shell em seus sistemas NAS e orientou usuários a instalar imediatamente. A empresa já havia solicitado que os clientes mantivessem os dispositivos offline enquanto aguardavam a atualização. Softwares afetados Os sistemas operacionais QTS e QuTS hero, que rodam nos NAS da fabricante, utilizam PHP. As […]
Ivanti corrige duas zero-days no Connect Secure sob ataque
A Ivanti publicou atualizações de segurança para corrigir duas novas falhas no gateway de acesso remoto Connect Secure (ICS), exploradas em ataques zero-day encadeados desde pelo menos 1º de outubro. Os agentes de ameaça usaram os dois problemas, catalogados como CVE-2026-111357 e CVE-2026-118527, em conjunto com uma vulnerabilidade de bypass de autenticação (CVE-2026-104935) corrigida pela […]
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks. The post Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain appeared first on SecurityWeek .
Falha “SMS of Death” derruba celulares Android sem clique
Uma falha grave no Android, apelidada de “SMS of Death“, permite que um atacante derrube o sinal e as ligações de um celular apenas com o conhecimento do número de telefone. Divulgada em 29 de outubro de 2026 e catalogada como CVE-2026-58882, a vulnerabilidade afeta o sistema de telefonia do Android e pode levar o […]
Cisco emite correção emergencial para DoS em VPN de firewalls
A Cisco publicou uma correção emergencial para uma vulnerabilidade explorada em ataques de negação de serviço (DoS) contra o serviço SSL VPN dos firewalls ASA e FTD. A empresa voltou a alertar organizações sobre esse tipo de ataque, que já havia atingido o mesmo serviço em agosto. Os softwares Secure Firewall Adaptive Security Appliance (ASA) […]
Cisco corrige zero-day explorado para derrubar firewalls
A Cisco publicou atualizações de segurança para corrigir um zero-day de negação de serviço no software Adaptive Security Appliance (ASA) e Threat Defense (FTD) que atacantes estão explorando para derrubar remotamente dispositivos de firewall vulneráveis. A falha, rastreada como CVE-2026-76418, é de severidade alta e afeta equipamentos que executam ASA e FTD com configurações que […]
New Cisco firewall zero-day exploited to crash SSL VPN devices
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. [...]
Have an older iPhone or iPad? Apple has a security update for you
Apple has backported a fix for a CoreGraphics flaw reportedly exploited in targeted attacks to the iPhone XS, XS Max and XR, and seventh-generation iPad.
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system. Successful exploitation could allow an unauthenticated, remote attacker to cause the
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed. The post Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network appeared first on SecurityWeek .
Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
An exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewalls to reload. The post Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August appeared first on SecurityWeek .
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged. The post Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day appeared first on SecurityWeek .
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Warp Panda in attacks targeting the U.S. legal sector. The vulnerability in question is CVE-2026-41709 (CVSS score:
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Tailscale is preparing a patch for Tailscale SSH flaws whose details went public over the weekend, before any fixes had been released. The post Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws appeared first on SecurityWeek .
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones. The post iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18 appeared first on SecurityWeek .
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]
Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Running at system boot, it periodically polled the update domain to execute any code served, with full privileges. The post Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover appeared first on SecurityWeek .
Microsoft releases emergency .NET security fixes for Google Brotli bug
Redmond joins growing list of software maintainers scrambling to patch compression flaw
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. [...]
Popcorn Time’s forgotten updater left millions of devices exposed to hijacking
The update process for an abandoned streaming app could let attackers take over PCs. If you ever used Popcorn Time, check your devices.
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target. The findings were
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially
PHP shares mitigation for new RCE vulnerability with no patch
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. [...]
URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges. The post Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months appeared first on SecurityWeek .
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote
Arista corrige zero-day no VeloCloud explorado em ataques
A Arista Networks publicou atualizações de segurança para corrigir uma vulnerabilidade zero-day explorada ativamente que afeta implantações on-premises do VeloCloud Orchestrator (VCO). O VCO é um portal de gerenciamento baseado em web que ajuda administradores a configurar, monitorar e gerenciar SD-WANs VeloCloud (redes de longa distância definidas por software) e dispositivos de borda associados. Rastreada […]
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. [...]
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network
Hackers got a four-day head start on epic PHP2Shell vulnerability
Hackers were already probing the bug before defenders were told it existed.
eMudhra kills its certificate business after researchers cracked its private keys in under a second
The private keys were so weak they could be guessed in under a second — and one of them was just the number 4. The post eMudhra kills its certificate business after researchers cracked its private keys in under a second appeared first on CyberScoop .
Amazon says PHP2Shell exploitation began 4 days before patches
Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. [...]
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
Cloudflare reports millions of exploit attempts, while Amazon spotted attackers trying their luck four days before patches landed
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in. Palo Alto has not shipped fixed PAN-OS releases yet. Fortinet and Cisco published their own advisories, and neither company has confirmed a vulnerable product so far: Fortinet is checking 12 products, Cisco 31 products and cloud services. Palo Alto says the … More → The post What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers appeared first on Help Net Security .
PHP2Shell Exploitation Started Days Before Patches
Initial attempts were observed on October 17, and mass activity began shortly after patches were released. The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek .
PHP blames supply chain security biz Chainguard for putting entire web at risk
'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reg
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits ahead of the patch becoming available. 
PHP warns it plans to release 2 emergency patches imminently
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign
Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software. Siemens first published its security advisory on 15 October 2026, giving the flaw reported by Jose Oregon from Huntress Labs a CVSS v4.0 score of 8.4. On 17 October, it updated the advisory to tell customers that version 4.0.9.8 resolves the issue, and a blog post warning about active … More → The post Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign appeared first on Help Net Security .
Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device
Falha crítica no BlockStrap permite RCE no Magento
Pesquisadores alertam que hackers podem explorar em breve uma vulnerabilidade de gravidade máxima (CVE-2026-103849) que afeta o Magento e o Adobe Commerce, com potencial para executar código PHP arbitrário nos servidores das lojas. Segundo a empresa de segurança para e-commerce Sansec, ataques que aproveitam a falha, apelidada de BlockStrap, ainda não foram observados, mas espera-se […]
BeyondTrust corrige zero-day explorado desde agosto
A BeyondTrust alertou clientes na quinta-feira, 15 de outubro de 2026, para corrigirem uma falha crítica no Remote Support (RS) explorada em ataques zero-day desde o fim de agosto. O produto é a solução corporativa de suporte remoto da empresa, usada por service desks de TI e equipes de atendimento ao cliente para solucionar problemas […]
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
Prolific Chinese espionage group exploits BeyondTrust zero-day
Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers. The post Prolific Chinese espionage group exploits BeyondTrust zero-day appeared first on CyberScoop .
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
An alleged Chinese state-backed group is using a new zero-day affecting BeyondTrust IT support software to conduct espionage attacks.
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts. The post Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day appeared first on SecurityWeek .
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]
CISA alerta para exploração de zero-day no Ivanti
A CISA pediu que administradores corrijam appliances Ivanti Connect Secure após a exploração da CVE-2026-104935, falha zero-day que permite contornar autenticação remotamente e executar comandos, viabilizando roubo de credenciais e exfiltração de dados. O alerta foi publicado em 13 de outubro de 2026, quando a agência incluiu o problema em seu catálogo de vulnerabilidades conhecidas […]
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM. The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of
Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available. The post Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution appeared first on SecurityWeek .
Cisco Warns of Exploited Secure Email Gateway Vulnerability
Unauthenticated, remote attackers could write arbitrary files to the operating system and execute commands with root privileges. The post Cisco Warns of Exploited Secure Email Gateway Vulnerability appeared first on SecurityWeek .
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an
Palo Alto corrige zero-day do PAN-OS explorado em ataques
type: Vulnerabilidade zero-day de execução remota de código explorada em ataques sector: Não informado initial_vector: Interface de gerenciamento do PAN-OS, com credenciais válidas e acesso de rede actor: Não informado exposed_data: Não informado records_count: Não informado incident_date: Não informado cve: CVE-2026-0322 keywords: PAN-OS, CVE-2026-0322, zero-day, firewall, Palo Alto Networks, execução remota de código A Palo […]
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]
Vulnerability news
Sources monitored:Ars Technica SecurityBleepingComputerCISA AdvisoriesCISO AdvisorCisco TalosCyberScoopDark ReadingGoogle Project ZeroHelp Net SecurityKrebs on SecurityMalwarebytes LabsSANS Internet Storm CenterSecurityWeekThe Hacker NewsThe RecordThe Register SecurityUnit 42
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a high-severity security flaw impacting UnrealIRCd, an open-source Internet Relay Chat (IRC) server, to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-114713 (CVSS score: 8.6), is a case of improper neutralization of delimiters
Cisco confirma primeira exploração de falha no BroadWorks
A Cisco confirmou a primeira exploração observada de uma vulnerabilidade no BroadWorks. Em 10 de novembro, a agência de segurança cibernética dos Estados Unidos alertou que a falha CVE-2026-20320 havia sido usada em ataques. Na noite de quinta-feira, a Cisco publicou uma atualização do boletim de segurança informando ter conhecimento de abuso ativo. É a […]
Researchers continue to find serious vulnerabilities in internet connected refrigerators
VulnCheck disclosed 14 vulnerabilities in Dixell refrigeration units that give an attacker root access, while online honeypots are being flooded with hacks and malicious probes. The post Researchers continue to find serious vulnerabilities in internet connected refrigerators appeared first on CyberScoop .
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE
A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server. Updates released yesterday fix it, along with 51 other security flaws. Full protection from this flaw also requires rebuilding any C-language extensions installed on the server. The flaw, tracked as CVE-2026-6460, has a CVSS score of 8.8. Any code run this way has the rights of the operating
Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper
Vulnerable Check Point Security Gateway instances have been targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts. [...]
New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs
Two attacks made public this week allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines (VMs), which are built to keep the server's operator out. One of them, Mior, can also modify a VM's memory and fake the signed report confirming which software it runs. Both need control of the server's hypervisor, and Mior also needs control of the server's BIOS. Researchers
In Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data Breach
Noteworthy stories that might have slipped under the radar: Siemens details security advisory policy, OpenAI Codex backdoor risk, Microsoft warns of model weight backdoors. The post In Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data Breach appeared first on SecurityWeek .
How one AI agent exposed five critical enterprise security gaps
An AI agent built to automate invoice processing could be manipulated into changing vendor bank details through a malicious email, without triggering traditional security alerts. Token Security examines five critical AI agent security gaps and shares practical guidance from industry security leaders on preventing them. [...]
More news (76)
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-114713 UnrealIRCd Improper Neutralization of Delimiters Vulnerability CVE-2026-123039 Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form . Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
Google pushes second Chrome update this week
Google has pushed out a second Chrome update this week, fixing security flaws that could allow attackers to run malicious code.
Citrix Patches 10 Critical NetScaler Vulnerabilities
Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions. The post Citrix Patches 10 Critical NetScaler Vulnerabilities appeared first on SecurityWeek .
OpenAI’s Daybreak brings AI agents to security testing and vulnerability fixes
OpenAI is bringing AI agents into more of the software security process with Daybreak, pairing web application penetration testing with tools that investigate vulnerabilities and develop fixes. The two offerings, Red Team and Defense Factory, connect the work of finding security weaknesses with patching and retesting them. Red Team tests applications and verifies fixes Daybreak Red Team, offered through an early-access program, uses coordinated agents to examine application source code and context, investigate potential attack … More → The post OpenAI’s Daybreak brings AI agents to security testing and vulnerability fixes appeared first on Help Net Security .
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader follow-up wave
Policy and Disclosure: 2026 Edition
Since 2021, Project Zero has followed a “90 + 30” vulnerability disclosure policy, allowing vendors up to 90 days to remediate a vulnerability plus an extra 30 days “soak time” for patch rollout. Our goal was to encourage faster patching and give vendors time to deliver patches to users. The advent of AI-assisted vulnerability discovery and exploitation has changed the threat landscape such that the vulnerability remediation timeline encouraged by our disclosure policy is clearly insufficient. LLMs have increased the speed at which attackers can find and exploit vulnerabilities, alongside the risk that multiple parties, including malicious ones, discover the same bug. A vulnerability reported today presents a much higher immediate risk to users than one reported last year. In this new environment, it is crucial that vendors move towards remediating vulnerabilities faster.
PHP2Shell Exploited in Destructive Check Point Gateway Attacks
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root. The post PHP2Shell Exploited in Destructive Check Point Gateway Attacks appeared first on SecurityWeek .
PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14
The PostgreSQL Global Development Group released PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, fixing 52 security vulnerabilities and more than 140 other bugs. Most of those code execution bugs are memory errors or type confusion, where PostgreSQL handles a value as the wrong data type. They turn up in PL/Perl and PL/Tcl, text search functions such as ts_rank_cd(), parallel query, logical replication, dblink and statistics import. Thirty-two of the 52 CVEs carry … More → The post PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14 appeared first on Help Net Security .
Ataques ao ScreenConnect comprometem MSPs e clientes
A ConnectWise investiga uma campanha de malware contra provedores de serviços gerenciados (MSPs) que usa ambientes ScreenConnect comprometidos para instalar clientes de acesso remoto não autorizados em dispositivos de clientes. A empresa desativou cinco extensões de terceiros em cerca de 400 ambientes de parceiros por precaução. Alcance e método A Huntress descobriu a campanha na […]
Apache corrige falha crítica de execução remota no HTTP/2
A Apache Software Foundation corrigiu uma vulnerabilidade crítica no módulo HTTP/2 do Apache HTTP Server que pode ser explorada por um atacante não autenticado para obter execução remota de código (RCE). Rastreada como CVE-2026-119618, a falha foi descoberta pelas equipes OSS Scanner da Anthropic e de Pesquisa de Vulnerabilidades do Google Cloud. Origem e versões […]
Apache HTTP Server patches critical HTTP/2 remote code execution flaw
A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE). [...]
ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories
A search result isn't always safe. An access request isn't always harmless. And a familiar account doesn't always mean a familiar person is using it. Simple things to remember. Yet a surprising amount of this week's trouble starts right there. Attackers are using fake websites, stolen access, and trusted tools to get into places they shouldn't be. AI is helping them build attacks faster, while
Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry
A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository. Quay enables anonymous access by default, and while it is enabled, the attacker needs no account. When it is off, anyone with a valid account can still exploit the flaw, Red Hat said yesterday. The company has released fixed builds for eight Quay
Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass
Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass. The critical vulnerabilities that impact NetScaler ADC and NetScaler Gateway are listed below - CVE-2026-120868 (CVSS score: 9.3) - A memory overflow vulnerability in Packet
Apache Patches Critical HTTP Server RCE Found by Anthropic, Google
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled. The post Apache Patches Critical HTTP Server RCE Found by Anthropic, Google appeared first on SecurityWeek .
Chrome, Firefox Updates Patch Over 180 Vulnerabilities
Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160. The post Chrome, Firefox Updates Patch Over 180 Vulnerabilities appeared first on SecurityWeek .
SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the details with The Hacker News, said the recovered attacker toolkit exploits CVE-2026-84869 (CVSS score: 9.9), an
Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs
Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week. The company has already applied mitigations against attacks between VMs, and between VMs and the host. Inside a VM, the flaws may let an attacker with code on the same processor core infer data from other processes or the kernel. The affected
Siemens Desigo, Gridscale
View CSAF Summary On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497). The vulnerability is an out-of-bounds write that could allow a remote attacker to cause memory corruption and potentially execute arbitrary code. This advisory covers the status of impact of various Siemens software products. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Desigo, Gridscale are affected: Desigo CC family V8 vers:all/* (CVE-2026-111497) Desigo CC family V9 vers:all/* (CVE-2026-111497) Gridscale X DSA vers:intdot/>=5.3|<5.4 (CVE-2026-111497) Gridscale X PSS®E vers:intdot/<36.8.0 (CVE-2026-111497) CVSS Vendor Equipment v3 9.8 Siemens Desigo CC family V8 1 Vulnerability Out-of-bounds Write Background Critical Infrastructure Sectors: Critical Manufacturing, Energy, Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Read More 4 Affected Products Desigo CC family V8 Product Status: known_affected, known_not_affected Remediations Vendor fix Install the latest .NET security updates via Windows Update. Desigo CC family V9 Product Status: known_affected, known_not_affected Remediations Vendor fix Install the latest .NET security updates via Windows Update. Gridscale X DSA >= V5.3 < V5.4 Product Status: known_affected, known_not_affected Remediations Vendor fix Update to V5.4 or later version Gridscale X PSS®E < V36.8.0 Product Status: known_affected, known_not_affected Remediations Vendor fix Update to V36.8.0 or later version Additional Metrics Relevant CWE: CWE-787 Out-of-bounds Write CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H View CVE Details Acknowledgments Siemens ProductCERT reported this vulnerability to CISA. General Recommendations Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment. Recommended security guidelines can be found at: https://www.siemens.com/gridsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use . Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabili
Siemens RUGGEDCOM APE1808
View CSAF Summary Palo Alto Networks has published information on a vulnerability in PAN-OS related to the Node2Shell vulnerability. This advisory lists the related Siemens Industrial products affected by this vulnerability. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. The following versions of Siemens RUGGEDCOM APE1808 are affected: RUGGEDCOM APE1808 vers:all/* (CVE-2026-111497) CVSS Vendor Equipment v3 9.8 Siemens RUGGEDCOM APE1808 1 Vulnerability Out-of-bounds Write Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Read More 1 Affected Product RUGGEDCOM APE1808 with Palo Alto Networks PAN-OS Product Status: known_affected Remediations Vendor fix Upgrade to corresponding available PAN-OS version. Contact customer support to receive additional patch and update information. Additional Metrics Relevant CWE: CWE-787 Out-of-bounds Write CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H View CVE Details Acknowledgments Siemens ProductCERT reported this vulnerability to CISA. General Recommendations As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens' operational guidelines for Industrial Security ( https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use . Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-898633 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties
Siemens Building Automation and Energy Products
View CSAF Summary On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products. As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines, and to follow the recommendations in the product manuals. Siemens is actively monitoring the situation and assessing the implications of these vulnerabilities on our portfolio. Because this evaluation is ongoing, our findings are subject to change as new technical details and vendor updates emerge. We will publish updated findings, guidance, and remediation recommendations as soon as they become available. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available. The following versions of Siemens Building Automation and Energy Products are affected: AMIS TS vers:all/* (CVE-2026-109618, CVE-2026-109619) blueplanet 360 NX3 M6 WM OD IISX vers:all/* (CVE-2026-109618, CVE-2026-109619) blueplanet 360 NX3 M6 WM OD IISX - S vers:all/* (CVE-2026-109618, CVE-2026-109619) Energy Engage V2.0SP9 vers:all/* (CVE-2026-109618, CVE-2026-109619) Energy Engage V3.1SP1 vers:all/* (CVE-2026-109618, CVE-2026-109619) Heliox Rapid vers:all/* ()Local Monitoring bt-monitoring-vm vers:intdot/<20261103 (CVE-2026-109618, CVE-2026-109619) Spectrum Power 3 vers:all/* (CVE-2026-109619) Spectrum Power 4 vers:all/*, vers:all/*, vers:all/* (CVE-2026-109618, CVE-2026-109619, CVE-2026-109618, CVE-2026-109619, CVE-2026-109618, CVE-2026-109619) Spectrum Power 7 vers:all/* (CVE-2026-109618, CVE-2026-109619) Spectrum Power TG vers:all/* (CVE-2026-109618, CVE-2026-109619) CVSS Vendor Equipment v3 9.8 Siemens AMIS TS 1 Vulnerability Use After Free Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Read More 11 Affected Products AMIS TS Product Status: known_affected, known_not_affected Remediations None available Currently no fix is available blueplanet 360 NX3 M6 WM OD IISX Product Status: known_affected, known_not_affected Remediations None available Currently no fix is available Energy Engage V2.0SP9 Product Status: known_affected, known_not_affected Remediations No fix planned Currently no fix is planned Energy Engage V3.1SP1 Product Status: known_affected, known_not_affected Remediations Vendor fix Upgrade PHP version to V8.1.34 release 6 blueplanet 360 NX3 M6 WM OD IISX - S Product Status: known_affected, known_not_affected Remediations None available Currently no fix is available Local Monitoring bt-monitoring-vm < V20261103 Product Status: known_affected, known_not_affected Remediations Vendor fix Update to V20261103 or later version Spectrum Power 4 using Nagios or Zabbix Product Status: known_affected, known_not_affected Remediations None available Currently no fix is available Spectrum Power 4 with Web Office Portal V3.0, V3.1 and V3.2 Product Status: known_affected, known_not_affected Remediations None available Currently no fix is available Spectrum Power 4 with HISViews V1.0 Product Status: known_affected, known_not_affected Remediations None available Currently no fix is available Spectrum Power 7 using IHM (NagiosXI) Product Status: known_affected, known_not_affected Remediations Vendor fix Red Hat released a PHP security patch for RHEL 8 and 9 Spectrum Power TG which are based on Microsoft Windows using the WebConsole and WebQuery components Product Status: known_affected, known_not_affected Remediations Vendor fix Upgrade PHP version to V8.5.12 Additional Metrics Relevant CWE: CWE-416 Use After Free CVSS Version Base Score Base Se
Siemens Industrial Edge Management
View CSAF Summary Siemens is currently assessing the impact of Node2Shell (CVE-2026-111497) on Industrial Edge. Please check your Industrial Edge Management (IEM) setup: - No Management Applications installed: No action is required. Although the affected Brotli library is included in the IEM software stack, the affected functionality is not used or exposed. The same applies to IEDK. - Management Applications installed: Follow the specific mitigations until a fix is available. - Device Applications installed: Follow the specific mitigations until a fix is available. For Siemens-managed services, Industrial Edge Hub and Industrial Edge Management Cloud, appropriate Firewall/WAF protection has already been implemented. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens Industrial Edge Management are affected: Cloud Connector Configurator vers:intdot/<1.24.3 (CVE-2026-111497) Common Configurator (CC on IEM) vers:all/* (CVE-2026-111497) Common Configurator on Device (CC on Edge) vers:all/* (CVE-2026-111497) Data Flow Monitoring vers:intdot/<3.0.18 (CVE-2026-111497) Databus Configurator vers:intdot/<4.0.1 (CVE-2026-111497) DataXess Configurator vers:intdot/<1.5.7 (CVE-2026-111497) Edge OPC UA Server Configurator vers:intdot/<2.3.10 (CVE-2026-111497) Flow Creator Configurator vers:intdot/<1.15.1 (CVE-2026-111497) Industrial Edge Hub vers:all/* (CVE-2026-111497) Industrial Edge Management Cloud vers:all/* (CVE-2026-111497) CVSS Vendor Equipment v3 9.8 Siemens Cloud Connector Configurator 1 Vulnerability Out-of-bounds Write Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Read More 10 Affected Products Cloud Connector Configurator < V1.24.3 Product Status: known_affected Remediations Vendor fix Update to V1.24.3 or later version Industrial Edge Management Cloud Product Status: known_affected Remediations Vendor fix Vulnerability fixed on central cloud service starting 2026-10-28; no user actions necessary Common Configurator (CC on IEM) Product Status: known_affected Remediations Mitigation Uninstall all Management Applications and protect your IEM instance with a Firewall/WAF until a fix is available None available Currently no fix is available Common Configurator on Device (CC on Edge) Product Status: known_affected Remediations Mitigation Stop Common Configurator on Device (CC on Edge) until a fix is available None available Currently no fix is available Data Flow Monitoring < V3.0.18 Product Status: known_affected Remediations Vendor fix Update to V3.0.18 or later version Databus Configurator < V4.0.1 Product Status: known_affected Remediations Vendor fix Update to V4.0.1 or later version DataXess Configurator < V1.5.7 Product Status: known_affected Remediations Vendor fix Update to V1.5.7 or later version Edge OPC UA Server Configurator < V2.3.10 Product Status: known_affected Remediations Vendor fix Update to V2.3.10 or later version Flow Creator Configurator < V1.15.1 Product Status: known_affected Remediations Vendor fix Update to V1.15.1 or later version Industrial Edge Hub Product Status: known_affected Remediations Vendor fix Vulnerability fixed on central cloud service starting 2026-10-29; no user actions necessary Additional Metrics Relevant CWE: CWE-787 Out-of-bounds Write CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H View CVE Details Acknowledgments Siemens ProductCERT reported this vulnerability to CISA. General Recommendations As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends
Siemens RUGGEDCOM APE1808
View CSAF Summary Palo Alto Networks has published information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. The following versions of Siemens RUGGEDCOM APE1808 are affected: RUGGEDCOM APE1808 vers:all/* (CVE-2026-109618, CVE-2026-109619) CVSS Vendor Equipment v3 9.8 Siemens RUGGEDCOM APE1808 1 Vulnerability Use After Free Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Read More 1 Affected Product RUGGEDCOM APE1808 with Palo Alto Networks PAN-OS (10.2 All, 11.1 All, 11.2 All, 12.1 All, 12.2 All) Product Status: known_affected Remediations Vendor fix Upgrade to corresponding available PAN-OS version. Contact customer support to receive additional patch and update information. Additional Metrics Relevant CWE: CWE-416 Use After Free CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H View CVE Details CVE-2026-109619 PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). Read More 2 Affected Products RUGGEDCOM APE1808 with Palo Alto Networks PAN-OS (10.2 All, 11.1 All, 11.2 All, 12.1 All, 12.2 All) Product Status: known_affected Remediations Vendor fix Upgrade to corresponding available PAN-OS version. Contact customer support to receive additional patch and update information. RUGGEDCOM APE1808 with Palo Alto Networks PAN-OS (10.2 All, 11.1 All, 11.2 All, 12.1 All, 12.2 All) Product Status: known_affected Remediations Vendor fix Upgrade to corresponding available PAN-OS version. Contact customer support to receive additional patch and update information. Additional Metrics Relevant CWE: CWE-416 Use After Free CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H View CVE Details Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security ( https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use . Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assess
Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)
CVE-2026-102895 is a trivial authentication-bypass vulnerability. GPUStack is also an attractive target. It is open-source software that manages clusters of GPUs, which are typically used to run AI workloads. All versions of GPUStack prior to 2.2.0, which was released at the end of June. This vulnerability was not made public until the end of July, and the CVE was assigned on November 4th. 
New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
N-able on Thursday said it's investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026.4.1 HF2. "Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet," N-able said in a new advisory. "Legacy API is
PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution
PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution. The security flaw, tracked as CVE-2026-126325, carries a CVSS v4 score of 9.2 out of a maximum of 10.0. It has been described as a case of improper input validation and deserialization of untrusted data that could result in
Stolen Claude API keys can turn Claude Code into a remote-controlled implant
Darktrace researchers turned Claude Code into a remote-controlled implant in a lab test, steering the coding agent through the memory stores feature of Anthropic’s Claude platform and pulling a 1 GB file out through the Claude Files API. Once the agent was set up, every job and every result traveled through api.anthropic.com, the endpoint the agent already calls for inference, so the attacker’s traffic looked like a coding agent doing its job. The technique needs … More → The post Stolen Claude API keys can turn Claude Code into a remote-controlled implant appeared first on Help Net Security .
Hackers Deploy Malware in Fresh ScreenConnect Campaign
The attackers exploited a vulnerability in a legitimate extension to bypass ScreenConnect authentication. The post Hackers Deploy Malware in Fresh ScreenConnect Campaign appeared first on SecurityWeek .
Hackers Target N-central Zero-Days as N-able Rushes Patches
The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones. The post Hackers Target N-central Zero-Days as N-able Rushes Patches appeared first on SecurityWeek .
Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover
A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes. MongoDB, the company that makes the database, released fixed versions earlier this week. The affected servers are members of a replica
Critical Red Hat Quay Vulnerability Could Expose Private Container Images
Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access. The post Critical Red Hat Quay Vulnerability Could Expose Private Container Images appeared first on SecurityWeek .
Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data
A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections. Fixed versions were released for all three supported lines: 22.23.5, 24.22.3, and 26.13.1. The crash
Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux. An attacker who can reach the
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. [...]
N-able Takes N-central Platform Offline After Discovery of 33 Flaws
The RMM provider also released a hotfix as one of recommended mitigations to address public exploits for the alleged zero-days that allow for attacker takeover.
Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-2026-108186 (CVSS score: 9.6) - An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via
Critical Xen Orchestra Flaws Exploited in Attacks
The authentication bypass allows attackers to execute arbitrary code as admin and take over XCP-ng nodes. The post Critical Xen Orchestra Flaws Exploited in Attacks appeared first on SecurityWeek .
Git fixes six vulnerabilities, including code execution during recursive clones
The Git project has released security updates addressing six vulnerabilities that could allow attackers to execute code, write to unintended files or cause memory corruption when Git processes malicious repositories or other specially prepared input. Code execution during cloning A vulnerability tracked as CVE-2026-111760 stems from an integer truncation in Git’s handling of its index. An extremely long file path can pass Git’s safety checks under one name and then be written under a shorter … More → The post Git fixes six vulnerabilities, including code execution during recursive clones appeared first on Help Net Security .
Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits
Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes. The activity has been found to share some
Asus, Zoom Release Security Patches
Attackers could exploit them for command execution, memory overwrites, and privilege escalation. The post Asus, Zoom Release Security Patches appeared first on SecurityWeek .
Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities
Attackers could exploit the bugs to tamper with certificate entries, achieve remote code execution, and compromise hosts. The post Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities appeared first on SecurityWeek .
Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords
Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant. Most of the open apps were games, landing pages, and calculators, but about 1 in 10 contained internal business or
Fortinet Patches Nearly 100 Vulnerabilities
The massive drop comes after the company integrated frontier AI models into its product security testing. The post Fortinet Patches Nearly 100 Vulnerabilities appeared first on SecurityWeek .
ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure
Pre-Patch Tuesday advisories were published by VDE CERT, Phoenix Contact, Johnson Controls, and Hitachi Energy. The post ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure appeared first on SecurityWeek .
CISA flags Cisco BroadWorks flaw as actively exploited in attacks
The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks. [...]
Ubuntu certificate revocation checks arrive in curl, OpenSSL is next
Ubuntu 26.10 ships curl with certificate revocation checking built in. The check comes from upki, a project from the rustls developers. Ubuntu’s developers ran the same curl command on both releases: Ubuntu 26.04 accepted a revoked certificate and connected, while 26.10 refused it. A certificate authority revokes a certificate when it should stop being trusted before it expires. OpenSSL checks a certificate chain by default, but it doesn’t check whether any certificate in that chain … More → The post Ubuntu certificate revocation checks arrive in curl, OpenSSL is next appeared first on Help Net Security .
Adobe corrige 110 falhas em nove produtos
A Adobe publicou atualizações de segurança referentes a novembro de 2026 que corrigem cerca de 110 vulnerabilidades em nove produtos. Receberam patches o Adobe Experience Manager (AEM), Audition, After Effects, Connect, Content Credentials SDK, Dimension, Media Encoder, Photoshop e Premiere. Falhas críticas no Connect e no AEM Correções de severidade crítica foram aplicadas no Adobe […]
Microsoft corrige falha no Active Directory
A Microsoft publicou atualizações de segurança para uma vulnerabilidade no Windows Active Directory que permite a um atacante autorizado executar código pela rede. A falha é rastreada como CVE-2026-119948 (CVSS de 7.5) e foi divulgada em 10 de novembro de 2026, afetando múltiplas versões de desktop e servidor do Windows. A Microsoft classifica o problema […]
Falha crítica no FortiClient permite RCE
A Fortinet alertou para uma vulnerabilidade crítica no FortiClient que possibilita a um atacante remoto executar código no computador da vítima. O acesso depende apenas de o usuário visitar um site malicioso. A falha é rastreada como CVE-2026-121529 e recebeu pontuação CVSS de 9.1 (CVSS de 9.1). A Fortinet publicou o comunicado em 10 de […]
Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data. The post Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities appeared first on SecurityWeek .
Chipmaker Patch Tuesday: Over 200 Vulnerabilities Addressed by Intel, AMD
Intel and AMD disclose more than 200 vulnerabilities, including critical flaws in Intel TDX software and numerous AMD graphics bugs. The post Chipmaker Patch Tuesday: Over 200 Vulnerabilities Addressed by Intel, AMD appeared first on SecurityWeek .
Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes
Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers.
Recently Patched Barracuda Vulnerabilities Exploited in Attacks
The security defects could allow attackers to bypass authorization and gain root access to devices. The post Recently Patched Barracuda Vulnerabilities Exploited in Attacks appeared first on SecurityWeek .
Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights. The team tested the method on
Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms
Apple has patched Bluetooth and AirPlay pairing flaws, iMessage vulnerabilities, and an exploited Brotli bug across its platforms. The post Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms appeared first on SecurityWeek .
Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Details of the vulnerabilities are below - CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity
EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch
Forty-five percent of surveyed IT service management providers in the EU took more than three months to apply critical patches to critical systems, according to ENISA’s 2026 assessment of cybersecurity in the Union. Attackers can turn a newly disclosed flaw into a working attack within days, and sometimes within hours or minutes. Those providers run systems for other organizations, so a slow patch at one becomes exposure for the customers that depend on it, and … More → The post EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch appeared first on Help Net Security .
An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones
Criminals are using leaked exploit kits to break into vulnerable iPhones, according to iVerify’s 2026 Advanced Mobile Threat Report. Attacks delivered through ads and compromised websites have reached employees who use phones for work. DarkSword chains together several software flaws to compromise iPhones. Researchers disclosed the toolkit in March 2026, and a newer version appeared on GitHub within a week, giving criminal groups code they could adapt. Another toolkit, Coruna, was served from websites posing … More → The post An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones appeared first on Help Net Security .
Fortinet: falhas críticas permitem execução de código sem login
A Fortinet divulgou vulnerabilidades críticas que afetam FortiManager, FortiAnalyzer e FortiOS, incluindo falhas que podem permitir a atacantes executar código sem fazer login. Publicados em 10 de novembro de 2026, os avisos cobrem APIs de gerenciamento, serviços de comunicação de dispositivos, roteamento e configurações específicas de alta disponibilidade. Os requisitos de ataque variam, tornando recursos […]
SAP corrige falhas de severidade máxima em novembro
A SAP publicou 35 correções de segurança em sua atualização de novembro de 2026, incluindo quatro vulnerabilidades de severidade máxima que afetam os softwares NetWeaver, Web Dispatcher e Gateway. A empresa classificou essas quatro falhas com nota 10/10 na escala CVSS, indicando que atacantes não autenticados podem explorá-las para comprometer totalmente os sistemas-alvo remotamente. As […]
Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for November 2026, which includes 1328 vulnerabilities affecting a range of products, including 60 that Microsoft marked as "critical." Out of 60 "critical" vulnerabilities, 45 are remote code execution (RCE) vulnerabilities.
November Patch Tuesday: An Overflowing Cornucopia of CVEs
Microsoft serves up an actively exploited Outlook zero-day, and a wave of critical Exchange, SharePoint, Windows Search, and LDAP bugs that exhausted defenders need to prioritize fast.
Railway breach leads to $740,000 in fraudulent AI charges
Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing credentials for up to 100,000 workspaces. [...]
Microsoft Fixes Nearly 1,100 Security Vulnerabilities
Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month's Patch Tuesday addresses 63 critical flaws -- including a zero-day in Microsoft Outlook -- and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla.
N-able tira N-central do ar após 30 zero-days
A N-able desativou ontem, 9 de novembro, seus ambientes hospedados do N-central e orientou clientes com servidores próprios a também desligá-los. A decisão ocorreu depois de o pesquisador de segurança Sean Bales divulgar, na noite de domingo, 8 de novembro, mais de 30 supostas falhas zero-day, algumas capazes de permitir a tomada de sistemas vulneráveis. […]
Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday
Microsoft’s November security update addresses roughly 1,090 vulnerabilities across Windows, Office, Azure and the company’s other product lines, the second consecutive monthly release to exceed the totals of all previous years. The release formally lists 1,094 CVEs, with Windows accounting for 726 and Office 174. A smaller number of patches went to SQL Server, Exchange […] The post Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday appeared first on CyberScoop .
Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
Researcher finds 35,000 Grok Build apps wide open to anyone who looked for them.
Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row
An exploited Outlook vulnerability drew most of the attention in Microsoft's latest Patch Tuesday, which listed 1,093 bugs total.
Microsoft releases Windows 10 KB5131096 extended security update
Microsoft released the Windows 10 KB5131096 extended security update, which includes this month's November 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]
Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1. The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An
SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users
An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday. The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE
Microsoft Patch Tuesday November 2027 , (Tue, Nov 10th)
Microsoft continues its AI-induced patch surge, addressing 1,260 different vulnerabilities this month. 68 of these vulnerabilities are considered critical. 167 of the vulnerabilities are Chromium issues affecting Microsoft Edge. 
Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
Today is Microsoft's November 2026 Patch Tuesday, with security updates addressing a record-breaking 1,235 flaws, including one actively exploited Microsoft Outlook zero-day vulnerability. [...]
AI Coding Agents Leak Thousands of Secrets to GitHub
A command in Claude Code inadvertently saves files with credentials and other sensitive data to public Git repositories, creating security gaps for organizations.
Windows 11 KB5132061 & KB5131087 cumulative updates released
Microsoft has released the Patch Tuesday Windows 11 and cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. [...]
Adobe Patches 110 Vulnerabilities Across 9 Products
Adobe has fixed vulnerabilities in AEM, Premiere, Photoshop, After Effects, Connect, Audition, Dimension, Content Credentials SDK, and Media Encoder. The post Adobe Patches 110 Vulnerabilities Across 9 Products appeared first on SecurityWeek .
Highlights (30 days)
Most mentioned vendors
Attack types
Tags
Actively exploited criticals (CVSS + KEV/EUVD)
CVEs with critical severity (CVSS ≥ 9.0) listed in a confirmed-exploitation catalogue — CISA KEV or EUVD/ENISA, the same criterion worth +10 in the ranking. They arrive sorted by most recent modification, but the filters above the table and the clickable headers let you narrow and reorder by CVSS, EPSS or VPR. If it's on this list, it's a top patching priority.
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.
A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks. A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.
Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2
Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer, a different vulnerability than CVE-2012-1709.
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.