FediSecfeeds

##

CVE-2025-40300
(5.5 MEDIUM)

EPSS: 0.04%

updated 2026-01-16T20:25:45.940000

1 posts

In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors af

Ubuntu@activitypub.awakari.com at 2026-01-09T16:55:37.000Z ## Ubuntu 24.04: Linux-azure-nvidia Critical Issues CVE-2025-40300 Several security issues were fixed in the Linux kernel.

#Ubuntu #Linux #Distribution #- #Security #Advisories

Origin | Interest | Match ##

CVE-2026-21858
(10.0 CRITICAL)

EPSS: 3.72%

updated 2026-01-16T19:31:34.467000

5 posts

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise dependi

https://github.com/Ashwesker/Ashwesker-CVE-2026-21858

4 repos

https://github.com/Chocapikk/CVE-2026-21858

https://github.com/sastraadiwiguna-purpleeliteteaming/SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

https://github.com/cropnet/ni8mare-scanner

cvedatabase@techhub.social at 2026-01-19T22:00:02.000Z ##

A new critical unauthenticated RCE in n8n (CVE-2026-21858) allows full takeover of exposed workflow instances, including access to connected APIs and data pipelines. If you self‑host n8n, lock down public access and patch immediately.

https://www.cvedatabase.com/cve/CVE-2026-21858

#CyberSecurity #n8n

##

youranonnewsirc@nerdculture.de at 2026-01-13T03:22:47.000Z ##

Latest global tech and cybersecurity news (Jan 12-13, 2026):

The World Economic Forum's 'Global Cybersecurity Outlook 2026' highlights AI, geopolitics, and cyber-fraud as key shapers of risk, with fraud now surpassing ransomware as a top concern. CISA added a Gogs Path Traversal vulnerability (CVE-2025-8110) to its Known Exploited Vulnerabilities Catalog due to active exploitation. A critical vulnerability (CVE-2026-21858) was found in the n8n workflow automation platform, affecting thousands of systems. In technology, Google removed some medical AI Overviews following "alarming" results.

https://www.60-sekunden-cyber.de/kw2-2026/

##

sbeyer at 2026-01-13T00:12:55.324Z ##

Die erste Ausgabe von 60 Sekunden Cyber beschäftigt sich mit dem aktuellen ESA-Hack, der Situation Taiwans, CVE-2026-21858 und dem Schlag gegen Black Axe.

#cyber #cybersicherheit #itsicherheit #news

##

zeldman@front-end.social at 2026-01-09T17:16:01.000Z ##

Tell your friends.

The vulnerability, tracked as CVE-2026-21858 (CVSS score: 10.0), has been codenamed Ni8mare by Cyera Research Labs. Security researcher Dor Attias discovered and reported it on November 9, 2025.

https://thehackernews.com/2026/01/critical-n8n-vulnerability-cvss-100.html

##

hrbrmstr@mastodon.social at 2026-01-09T12:31:34.000Z ##

this was some great and necessary debunking of the ridiculous attempt at a "look how cool we are” CVE assignment.

between this and the "it's actually not a real vuln from an internet-perspective" for the recent daft D-Link CVE assignment, the cyber part of 2026 is off to a really horrible start.

https://horizon3.ai/attack-research/attack-blogs/the-ni8mare-test-n8n-rce-under-the-microscope-cve-2026-21858/

##

CVE-2025-68493
(8.1 HIGH)

EPSS: 0.13%

updated 2026-01-16T19:10:47

1 posts

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.

Hackread@mstdn.social at 2026-01-15T11:54:58.000Z ##

📢⚠️ Years-old vulnerable Apache Struts 2 versions were downloaded 387K+ times in one week, despite a high-severity CVE-2025-68493 flaw - Patch to 6.1.1 now!

Read: https://hackread.com/years-old-vulnerable-apache-struts-2-downloads/

#Cybersecurity #ApacheStruts #Vulnerability #InfoSec #DevSecOps

##

CVE-2025-68428
(7.5 HIGH)

EPSS: 0.02%

updated 2026-01-16T18:34:24.440000

2 posts

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents

2 repos

https://github.com/Nurjaman2004/jsPDF-Bulk-Detector-CVE-2025-68428-

https://github.com/12nio/CVE-2025-68428_PoC

DarkWebInformer@infosec.exchange at 2026-01-11T02:00:20.000Z ##

❗️CVE-2025-68428: Critical Path Traversal in jsPDF

GitHub: https://github.com/12nio/CVE-2025-68428_PoC

CVSS: 9.2
CVE Published: January 5th, 2026
Exploit Published: January 8th, 2026

News source: https://www.bleepingcomputer.com/news/security/critical-jspdf-flaw-lets-hackers-steal-secrets-via-generated-pdfs/

##

benzogaga33@mamot.fr at 2026-01-09T10:40:03.000Z ##

Cette faille critique dans jsPDF (CVE-2025-68428) peut exposer les données de votre serveur https://www.it-connect.fr/faille-critique-jspdf-cve-2025-68428/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

##

CVE-2025-70753
(7.5 HIGH)

EPSS: 0.05%

updated 2026-01-16T18:32:29

1 posts

Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_4CA50 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

cR0w@infosec.exchange at 2026-01-13T17:05:57.000Z ##

Another Tenda

https://www.cve.org/CVERecord?id=CVE-2025-70753

https://www.cve.org/CVERecord?id=CVE-2025-71023

##

CVE-2025-71024
(7.5 HIGH)

EPSS: 0.05%

updated 2026-01-16T18:32:29

1 posts

Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the serviceName2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

cR0w@infosec.exchange at 2026-01-13T16:00:18.000Z ##

One more Tenda for old time's sake.

https://www.cve.org/CVERecord?id=CVE-2025-71024

https://www.cve.org/CVERecord?id=CVE-2025-71023

##

CVE-2025-71025
(7.5 HIGH)

EPSS: 0.05%

updated 2026-01-16T18:32:29

1 posts

Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the cloneType2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

cR0w@infosec.exchange at 2026-01-13T16:00:18.000Z ##

One more Tenda for old time's sake.

https://www.cve.org/CVERecord?id=CVE-2025-71024

https://www.cve.org/CVERecord?id=CVE-2025-71023

##

CVE-2025-71027
(7.5 HIGH)

EPSS: 0.05%

updated 2026-01-16T18:24:14.237000

1 posts

Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanMTU2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

cR0w@infosec.exchange at 2026-01-13T16:00:18.000Z ##

One more Tenda for old time's sake.

https://www.cve.org/CVERecord?id=CVE-2025-71024

https://github.com/ninjazan420/CVE-2025-60021-PoC-Apache-bRPC-Heap-Profiler-Command-Injection

##

CVE-2025-71026
(7.5 HIGH)

EPSS: 0.05%

updated 2026-01-16T18:23:52.100000

1 posts

Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanSpeed2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

cR0w@infosec.exchange at 2026-01-13T16:00:18.000Z ##

One more Tenda for old time's sake.

updated 2026-01-16T18:16:08.780000

2 posts

Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_o

1 repos

beyondmachines1 at 2026-01-19T20:01:02.204Z ##

Apache bRPC Critical Remote Command Injection Vulnerability

Apache bRPC versions prior to 1.15.0 contain a critical remote command injection vulnerability (CVE-2025-60021) in the heap profiler service. Attackers can exploit unvalidated input in the extra_options parameter to execute arbitrary commands and gain full system control.

**If you are using Apache bRPC, make sure all bRPC instances are isolated from the internet and accessible from trusted networks only. Disable the heap profiler service to prevent attackers from running remote commands on your servers and plan a quick upgrade to version 1.15.0.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/apache-brpc-critical-remote-command-injection-vulnerability-d-8-0-d-6/gD2P6Ple2L

##

beyondmachines1@infosec.exchange at 2026-01-19T20:01:02.000Z ##

Apache bRPC Critical Remote Command Injection Vulnerability

Apache bRPC versions prior to 1.15.0 contain a critical remote command injection vulnerability (CVE-2025-60021) in the heap profiler service. Attackers can exploit unvalidated input in the extra_options parameter to execute arbitrary commands and gain full system control.

**If you are using Apache bRPC, make sure all bRPC instances are isolated from the internet and accessible from trusted networks only. Disable the heap profiler service to prevent attackers from running remote commands on your servers and plan a quick upgrade to version 1.15.0.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/apache-brpc-critical-remote-command-injection-vulnerability-d-8-0-d-6/gD2P6Ple2L

##

CVE-2026-22023
(7.5 HIGH)

EPSS: 0.05%

updated 2026-01-16T16:45:11.670000

1 posts

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, there is an out-of-bounds heap read vulnerability in cryptography_aead_encrypt(). This issue has been patched in version 1.4.3.

cR0w@infosec.exchange at 2026-01-12T14:39:00.000Z ##

Space Hacking ( NASA Cryptolib ) 🚀

##

CVE-2026-22024
(5.3 MEDIUM)

EPSS: 0.06%

updated 2026-01-16T16:44:36.080000

1 posts

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the cryptography_encrypt() function allocates multiple buffers for HTTP requests and JSON parsing that are never freed on any code path. Each cal

cR0w@infosec.exchange at 2026-01-12T14:39:00.000Z ##

Space Hacking ( NASA Cryptolib ) 🚀

##

CVE-2026-22026
(7.5 HIGH)

EPSS: 0.05%

updated 2026-01-16T16:43:52.067000

1 posts

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the libcurl write_callback function in the KMC crypto service client allows unbounded memory growth by reallocating response buffers without any

cR0w@infosec.exchange at 2026-01-12T14:39:00.000Z ##

Space Hacking ( NASA Cryptolib ) 🚀

Writeup: https://cymulate.com/blog/cve-2026-20965-azure-windows-admin-center-tenant-wide-rce/

##

CVE-2026-20965
(7.5 HIGH)

EPSS: 0.03%

updated 2026-01-16T16:23:11.237000

4 posts

Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally.

DarkWebInformer at 2026-01-19T19:57:40.564Z ##

‼️CVE-2026-20965: Windows Admin Center Azure SSO Flaw Risks Tenant-Wide Compromise

Details: Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally.

CVSS: 7.5
CVE Published: January 13th, 2026

Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20965

##

DarkWebInformer@infosec.exchange at 2026-01-19T19:57:40.000Z ##

‼️CVE-2026-20965: Windows Admin Center Azure SSO Flaw Risks Tenant-Wide Compromise

Details: Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally.

CVSS: 7.5
CVE Published: January 13th, 2026

Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20965

Writeup: https://cymulate.com/blog/cve-2026-20965-azure-windows-admin-center-tenant-wide-rce/

##

cR0w@infosec.exchange at 2026-01-15T15:48:00.000Z ##

Stupid cloud anyway.

https://cymulate.com/blog/cve-2026-20965-azure-windows-admin-center-tenant-wide-rce/

##

_r_netsec@infosec.exchange at 2026-01-15T15:43:06.000Z ##

CVE-2026-20965: Cymulate Research Labs Discovers Token Validation Flaw that Leads to Tenant-Wide RCE in Azure Windows Admin Center https://cymulate.com/blog/cve-2026-20965-azure-windows-admin-center-tenant-wide-rce/

##

CVE-2026-0713
(8.3 HIGH)

EPSS: 0.03%

updated 2026-01-16T15:55:33.063000

1 posts

A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashb

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22638
(8.3 HIGH)

EPSS: 0.03%

updated 2026-01-16T15:55:33.063000

1 posts

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is inst

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22920
(3.7 LOW)

EPSS: 0.03%

updated 2026-01-16T15:55:33.063000

1 posts

The device's passwords have not been adequately salted, making them vulnerable to password extraction attacks.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22637
(6.8 MEDIUM)

EPSS: 0.03%

updated 2026-01-16T15:55:33.063000

1 posts

The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22917
(4.3 MEDIUM)

EPSS: 0.06%

updated 2026-01-16T15:55:33.063000

1 posts

Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-0712
(7.6 HIGH)

EPSS: 0.04%

updated 2026-01-16T15:55:33.063000

1 posts

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22646
(4.3 MEDIUM)

EPSS: 0.03%

updated 2026-01-16T15:55:33.063000

1 posts

Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance information (like file paths, database errors, or software versions) that can be used to map the application's internal structure and discover other, more critical vulnerabilities.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22911
(5.3 MEDIUM)

EPSS: 0.05%

updated 2026-01-16T15:55:33.063000

1 posts

Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access to the device.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22645
(5.3 MEDIUM)

EPSS: 0.03%

updated 2026-01-16T15:55:33.063000

1 posts

The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22857
(0 None)

EPSS: 0.04%

updated 2026-01-16T15:55:33.063000

1 posts

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_thread_func because the IRP is freed by irp->Complete() and then accessed again on the error path. This vulnerability is fixed in 3.20.1.

cR0w@infosec.exchange at 2026-01-14T18:38:50.000Z ##

FreeRDP

Edit to add more.

##

CVE-2026-22859
(0 None)

EPSS: 0.04%

updated 2026-01-16T15:55:33.063000

1 posts

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing an out‑of‑bounds read. This vulnerability is fixed in 3.20.1.

cR0w@infosec.exchange at 2026-01-14T18:38:50.000Z ##

FreeRDP

Edit to add more.

##

CVE-2026-22852
(0 None)

EPSS: 0.04%

updated 2026-01-16T15:55:33.063000

1 posts

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client when processing Audio Input (AUDIN) format lists. audin_process_formats reuses callback->formats_count across multiple MSG_SNDIN_FORMATS PDUs and writes past the newly allocated formats array, causing memory corruption and a crash.

cR0w@infosec.exchange at 2026-01-14T18:38:50.000Z ##

FreeRDP

updated 2026-01-15T21:48:49.657000

1 posts

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the Crypto_AOS_ProcessSecurity function reads memory without valid bounds checking when parsing AOS frame hashes. This issue has been patched in

cR0w@infosec.exchange at 2026-01-12T14:39:00.000Z ##

Space Hacking ( NASA Cryptolib ) 🚀

https://github.com/CkAbhijit/CVE-2026-0227-Advanced-Scanner

##

CVE-2025-69260
(7.5 HIGH)

EPSS: 0.26%

updated 2026-01-15T21:32:45

1 posts

A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability.

DarkWebInformer@infosec.exchange at 2026-01-12T19:06:17.000Z ##

‼️Trend Micro Apex Central Multiple Vulnerabilities

CVE:

CVE-2025-69258 (CVSS: 9.8)
CVE-2025-69259 (CVSS: 7.5)
CVE-2025-69260 (CVSS: 7.5)

CWE: CWE-1285, CWE-306, CWE-641

PoC/Writeup: https://www.tenable.com/security/research/tra-2026-01

Disclosure Date: January 7. 2026

Disclosure: https://success.trendmicro.com/en-US/solution/KA-0022071

##

CVE-2026-23746(CVSS UNKNOWN)

EPSS: 0.56%

updated 2026-01-15T21:31:54

1 posts

Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the SmartCardController service (DCG.SmartCardControllerService.exe). The service registers a TCP remoting channel with unsafe formatter/settings that permit untrusted remoting object invocation. A remote,

secdb at 2026-01-19T00:01:02.377Z ##

📈 CVE Published in last 7 days (2026-01-12 - 2026-01-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1174

Severity:
- Critical: 102
- High: 430
- Medium: 413
- Low: 33
- None: 196

Status:
- : 19
- Analyzed: 196
- Awaiting Analysis: 638
- Modified: 4
- Received: 135
- Rejected: 35
- Undergoing Analysis: 147

Top CNAs:
- VulnCheck: 188
- kernel.org: 138
- GitHub, Inc.: 124
- Microsoft Corporation: 114
- Wordfence: 92
- MITRE: 91
- Fortinet, Inc.: 30
- VulDB: 30
- SICK AG: 26
- Adobe Systems Incorporated: 25

Top Affected Products:
- UNKNOWN: 948
- Microsoft Windows 11 24h2: 83
- Microsoft Windows 11 25h2: 83
- Microsoft Windows Server 2025: 83
- Microsoft Windows Server 2022 23h2: 77
- Microsoft Windows 11 23h2: 77
- Microsoft Windows Server 2022: 75
- Microsoft Windows 10 22h2: 70
- Microsoft Windows 10 21h2: 70
- Microsoft Windows Server 2019: 69

##

CVE-2026-0227(CVSS UNKNOWN)

EPSS: 0.07%

updated 2026-01-15T21:31:54

7 posts

A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated attempts to trigger this issue results in the firewall entering into maintenance mode.

1 repos

youranonnewsirc@nerdculture.de at 2026-01-17T21:22:41.000Z ##

Here's a summary of the most important global, technology, and cybersecurity news from the last 24 hours:

Cyber incidents remain the top global business risk for the fifth consecutive year, with AI surging to second place, according to the Allianz Risk Barometer 2026. New EvilAI malware is masquerading as AI tools to infiltrate organizations. Microsoft has disrupted the RedVDS cybercrime infrastructure. Palo Alto Networks patched a critical denial-of-service bug (CVE-2026-0227) affecting firewalls. In technology, the US imposed AI chip tariffs on Nvidia, causing global supply chain friction. OpenAI will begin testing advertisements in ChatGPT. California is investigating xAI over sexualized deepfakes. Globally, geopolitical tensions continue, with Trump threatening tariffs amidst disputes over Greenland.

https://security.paloaltonetworks.com/CVE-2026-0227

##

cR0w@infosec.exchange at 2026-01-15T18:55:32.000Z ##

Anyone hear of a PoC for CVE-2026-0227 yet?

PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal

##

benzogaga33@mamot.fr at 2026-01-15T16:40:03.000Z ##

Palo Alto Networks – CVE-2026-0227 : cette nouvelle faille permet de désactiver le firewall à distance https://www.it-connect.fr/palo-alto-networks-cve-2026-0227-firewalls/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #PaloAlto

##

jbhall56@infosec.exchange at 2026-01-15T13:33:39.000Z ##

Tracked as CVE-2026-0227, this security flaw affects next-generation firewalls (running PAN-OS 10.1 or later) and Palo Alto Networks' Prisma Access configurations when the GlobalProtect gateway or portal is enabled. https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-dos-bug-letting-hackers-disable-firewalls/

##

cR0w@infosec.exchange at 2026-01-14T17:33:23.000Z ##

There's the DoS.

CVSS-BT: 7.7 / CVSS-B: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/R:U/V:D/RE:M/U:Amber)

https://security.paloaltonetworks.com/CVE-2026-0227

##

AAKL@infosec.exchange at 2026-01-14T17:29:02.000Z ##

New security advisories. You'll need a login to access details.

Palo Alto: PAN-SA-2026-0001 Chromium: Monthly Vulnerability Update (January 2026) https://security.paloaltonetworks.com/PAN-SA-2026-0001

CVE-2026-0227 PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal https://security.paloaltonetworks.com/CVE-2026-0227 #PaloAlto #infosec #vulnerability #Chromium

##

wav3@infosec.exchange at 2026-01-14T17:24:40.000Z ##

@cR0w cve-2026-0227 seems spicy

##

CVE-2025-36911
(7.1 HIGH)

EPSS: 0.00%

updated 2026-01-15T21:31:47

1 posts

In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.

6 repos

https://github.com/PivotChip/FrostedFastPair

https://github.com/Cedric-Martz/CVE-2025-36911_scan

https://github.com/SteamPunk424/CVE-2025-36911-Wisper_Pair_Target_Finder-

https://github.com/zalexdev/wpair-app

https://github.com/SpectrixDev/DIY_WhisperPair

https://github.com/ap425q/whisper-pair

AAKL@infosec.exchange at 2026-01-16T17:51:56.000Z ##

The vulnerability for this was updated yesterday: https://www.cve.org/CVERecord?id=CVE-2025-36911

Malwarebytes: WhisperPair exposes Bluetooth earbuds and headphones to tracking and eavesdropping https://www.malwarebytes.com/blog/news/2026/01/whisperpair-exposes-bluetooth-earbuds-and-headphones-to-tracking-and-eavesdropping

More about Bluetooth hijacking: https://whisperpair.eu/ #infosec #bluetooth #vulnerability

##

CVE-2026-21441
(7.5 HIGH)

EPSS: 0.02%

updated 2026-01-15T19:21:06.850000

1 posts

urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the

linux@activitypub.awakari.com at 2026-01-12T15:56:28.000Z ## Ubuntu: urllib3 Important Denial of Service CVE-2026-21441 urllib3 could be made to use excessive resources if it received specially crafted network traffic.

#Ubuntu #Linux #Distribution #- #Security #Advisories

Origin | Interest | Match ##

CVE-2025-69259
(7.5 HIGH)

EPSS: 0.30%

updated 2026-01-15T19:14:24.493000

1 posts

A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability..

DarkWebInformer@infosec.exchange at 2026-01-12T19:06:17.000Z ##

‼️Trend Micro Apex Central Multiple Vulnerabilities

CVE:

CVE-2025-69258 (CVSS: 9.8)
CVE-2025-69259 (CVSS: 7.5)
CVE-2025-69260 (CVSS: 7.5)

CWE: CWE-1285, CWE-306, CWE-641

PoC/Writeup: https://www.tenable.com/security/research/tra-2026-01

Disclosure Date: January 7. 2026

Disclosure: https://success.trendmicro.com/en-US/solution/KA-0022071

##

CVE-2025-9014(CVSS UNKNOWN)

EPSS: 0.09%

updated 2026-01-15T18:31:42

1 posts

A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation. A remote, unauthenticated attacker can exploit this flaw and cause Denial of Service on the web portal service.This issue affects TL-WR841N v14: before 250908.

cR0w@infosec.exchange at 2026-01-15T18:30:41.000Z ##

TP-Link

https://www.cve.org/CVERecord?id=CVE-2025-9014

##

CVE-2026-22644
(5.3 MEDIUM)

EPSS: 0.06%

updated 2026-01-15T15:31:35

1 posts

Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain unauthorized access.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22643
(8.3 HIGH)

EPSS: 0.07%

updated 2026-01-15T15:31:35

1 posts

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22910
(7.5 HIGH)

EPSS: 0.04%

updated 2026-01-15T15:31:30

1 posts

The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access. This represents a high risk to the integrity of the system.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22907
(10.0 CRITICAL)

EPSS: 0.06%

updated 2026-01-15T15:31:30

1 posts

An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22641
(5.0 MEDIUM)

EPSS: 0.02%

updated 2026-01-15T15:31:27

1 posts

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Promet

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22642
(4.2 MEDIUM)

EPSS: 0.03%

updated 2026-01-15T15:31:27

1 posts

An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: - Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22639
(4.3 MEDIUM)

EPSS: 0.03%

updated 2026-01-15T15:31:27

1 posts

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22908
(9.1 CRITICAL)

EPSS: 0.15%

updated 2026-01-15T15:31:27

1 posts

Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22640
(5.5 MEDIUM)

EPSS: 0.05%

updated 2026-01-15T15:31:27

1 posts

An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator exists 2. The Server administrator is either: - Not part of any organization, or - Part of the same org

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22919
(3.8 LOW)

EPSS: 0.03%

updated 2026-01-15T15:31:26

1 posts

An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attacks, leading to the extraction of sensitive data.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22916
(4.3 MEDIUM)

EPSS: 0.04%

updated 2026-01-15T15:31:19

1 posts

An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leading to service disruption or loss of configuration.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22915
(4.3 MEDIUM)

EPSS: 0.03%

updated 2026-01-15T15:31:19

1 posts

An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22914
(4.3 MEDIUM)

EPSS: 0.02%

updated 2026-01-15T15:31:19

1 posts

An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22918
(4.3 MEDIUM)

EPSS: 0.04%

updated 2026-01-15T15:31:19

1 posts

An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leading to the extraction of sensitive data.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22912
(4.3 MEDIUM)

EPSS: 0.07%

updated 2026-01-15T15:31:19

1 posts

Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to various risk including stealing credentials from unsuspecting users.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22913
(4.3 MEDIUM)

EPSS: 0.03%

updated 2026-01-15T15:31:18

1 posts

Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead to the extraction of sensitive data.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

##

CVE-2026-22909
(7.5 HIGH)

EPSS: 0.05%

updated 2026-01-15T15:31:18

1 posts

Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupting system operations.

cR0w@infosec.exchange at 2026-01-15T15:12:33.000Z ##

SICK vulns, bro.

https://github.com/horizon3ai/CVE-2025-64155

updated 2026-01-14T21:37:40.197000

5 posts

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests.

4 repos

https://github.com/Ashwesker/Ashwesker-CVE-2025-64155

https://github.com/purehate/CVE-2025-64155-hunter

https://github.com/cyberdudebivash/CYBERDUDEBIVASH-FortiSIEM-CVE-2025-64155-Scanner

raptor@infosec.exchange at 2026-01-16T18:15:15.000Z ##

CVE-2025-64155: Three Years of Remotely Rooting the #Fortinet #FortiSIEM

https://horizon3.ai/attack-research/disclosures/cve-2025-64155-three-years-of-remotely-rooting-the-fortinet-fortisiem/

##

benzogaga33@mamot.fr at 2026-01-15T10:40:03.000Z ##

Un exploit est disponible pour cette nouvelle faille critique dans Fortinet FortiSIEM : CVE-2025-64155 https://www.it-connect.fr/fortinet-fortisiem-cve-2025-64155/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Fortinet

##

DarkWebInformer@infosec.exchange at 2026-01-14T19:20:59.000Z ##

‼️CVE-2025-64155: Fortinet FortiSIEM Argument Injection to Remote Code Execution

Exploit/PoC: https://github.com/horizon3ai/CVE-2025-64155

CVSS: 9.4
Published: Jan 13, 2026

Writeup: https://horizon3.ai/attack-research/disclosures/cve-2025-64155-three-years-of-remotely-rooting-the-fortinet-fortisiem/

Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-25-772

##

_r_netsec@infosec.exchange at 2026-01-13T18:43:06.000Z ##

CVE-2025-64155: 3 Years of Remotely Rooting the Fortinet FortiSIEM https://horizon3.ai/attack-research/disclosures/cve-2025-64155-three-years-of-remotely-rooting-the-fortinet-fortisiem/

##

cR0w@infosec.exchange at 2026-01-13T18:20:20.000Z ##

RE: https://infosec.exchange/@cR0w/115888888335126115

Well would you look at that. Write-up now available. Go fuck up some FortiShit.

https://horizon3.ai/attack-research/disclosures/cve-2025-64155-three-years-of-remotely-rooting-the-fortinet-fortisiem/

##

CVE-2026-23550
(10.0 CRITICAL)

EPSS: 3.28%

updated 2026-01-14T21:34:10

3 posts

Incorrect Privilege Assignment vulnerability in Modular DS allows Privilege Escalation.This issue affects Modular DS: from n/a through 2.5.1.

https://github.com/TheTorjanCaptain/CVE-2026-23550-PoC

2 repos

https://github.com/cyberdudebivash/CYBERDUDEBIVASH-Modular-DS-CVE-2026-23550-Detector

blog@insicurezzadigitale.com at 2026-01-16T10:07:49.000Z ##

origin-mo: il trucco pigro che ha aperto 40.000 siti WordPress agli hacker

I ricercatori hanno scoperto una vulnerabilità critica nel plugin Modular DS per WordPress che ha permesso a hacker di compromettere oltre 40.000 siti con un metodo sorprendentemente semplice. La vulnerabilità CVE-2026-23550 Il plugin Modular DS, installato su decine di migliaia di siti WordPress, presentava una falla di privilege escalation classificata con un punteggio CVSS di 10.0, il massimo livello di severità. Questa debolezza, identificata come CVE-2026-23550 e catalogata nel […]

https://insicurezzadigitale.com/origin-mo-il-trucco-pigro-che-ha-aperto-40-000-siti-wordpress-agli-hacker/

##

DarkWebInformer@infosec.exchange at 2026-01-16T00:49:24.000Z ##

‼️ 40,000 WordPress Sites Exposed to Risk Due to Modular DS Admin Bypass Vulnerability

CVE-2026-23550: Critical WordPress Modular DS Plugin Flaw Actively Exploited to Gain Admin Access

CVSS: 10
CVE Published: January 14th, 2026

Attacking IP Addresses:

45[.]11[.]89[.]19
185[.]196[.]0[.]11

Reference: https://help.modulards.com/en/article/modular-ds-security-release-modular-connector-252-dm3mv0/

##

beyondmachines1@infosec.exchange at 2026-01-15T20:01:43.000Z ##

Critical Privilege Escalation in Modular DS WordPress Plugin Actively Exploited

Attackers are exploiting a CVSS 10.0 vulnerability in the Modular DS WordPress plugin to gain unauthenticated administrative access and full site control. The flaw, tracked as CVE-2026-23550, allows hackers to bypass authentication by manipulating URL parameters.

**If you are using Modular DS plugin, this is urgent! Updat to version 2.5.2 immediately, because your site is being hacked. If you can't update, disable the plugin. After patching, check your WordPress user list for any unauthorized administrator accounts created recently.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/critical-privilege-escalation-in-modular-ds-wordpress-plugin-actively-exploited-k-y-l-e-j/gD2P6Ple2L

##

CVE-2026-0732
(6.3 MEDIUM)

EPSS: 0.25%

updated 2026-01-14T21:34:06

1 posts

A vulnerability was found in D-Link DI-8200G 17.12.20A1. This affects an unknown function of the file /upgrade_filter.asp. The manipulation of the argument path results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

https://github.com/rupeshsurve04/CVE-2025-67399

##

CVE-2020-36911
(9.8 CRITICAL)

EPSS: 0.69%

updated 2026-01-14T20:15:51.050000

1 posts

Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attackers can generate forged tokens with admin roles and upload custom DLL payloads to execute arbitrary commands on the target system.

secdb at 2026-01-19T00:01:02.377Z ##

📈 CVE Published in last 7 days (2026-01-12 - 2026-01-19)
See more at https://secdb.nttzen.cloud/dashboard

EPSS: 0.02%

updated 2026-01-14T17:16:06.930000

1 posts

An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the UART port of the BK7231N controller (Wi-Fi and BLE module) on the device is open to access

1 repos

cR0w@infosec.exchange at 2026-01-14T17:18:24.000Z ##

I'm not concerned about this as a security concern, but I know people around here like their AQI monitors so this might be handy for folks trying to hack theirs for other functionality.

https://github.com/rupeshsurve04/CVE-2025-67399/blob/main/AIRTH_SMART_HOME_AQI_MONITOR_CVE-2025-67399.pdf

##

CVE-2026-22755
(0 None)

EPSS: 1.12%

updated 2026-01-14T16:26:00.933000

1 posts

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, M

secdb at 2026-01-19T00:01:02.377Z ##

📈 CVE Published in last 7 days (2026-01-12 - 2026-01-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1174

Severity:
- Critical: 102
- High: 430
- Medium: 413
- Low: 33
- None: 196

Status:
- : 19
- Analyzed: 196
- Awaiting Analysis: 638
- Modified: 4
- Received: 135
- Rejected: 35
- Undergoing Analysis: 147

Top CNAs:
- VulnCheck: 188
- kernel.org: 138
- GitHub, Inc.: 124
- Microsoft Corporation: 114
- Wordfence: 92
- MITRE: 91
- Fortinet, Inc.: 30
- VulDB: 30
- SICK AG: 26
- Adobe Systems Incorporated: 25

Top Affected Products:
- UNKNOWN: 948
- Microsoft Windows 11 24h2: 83
- Microsoft Windows 11 25h2: 83
- Microsoft Windows Server 2025: 83
- Microsoft Windows Server 2022 23h2: 77
- Microsoft Windows 11 23h2: 77
- Microsoft Windows Server 2022: 75
- Microsoft Windows 10 22h2: 70
- Microsoft Windows 10 21h2: 70
- Microsoft Windows Server 2019: 69

##

CVE-2026-0406
(0 None)

EPSS: 0.05%

updated 2026-01-14T16:26:00.933000

1 posts

An insufficient input validation vulnerability in the NETGEAR XR1000v2 allows attackers connected to the router's LAN to execute OS command injections.

updated 2026-01-14T16:25:40.430000

1 posts

A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet could enter a non-responsive state, in some cases requiring a hard reset to re-establish services. A malicious actor could leverage this vulnerability to conduct a Denial-of-Service attack on a target network.

cR0w@infosec.exchange at 2026-01-13T18:09:05.000Z ##

HPE

https://www.cve.org/CVERecord?id=CVE-2025-37165

https://www.cve.org/CVERecord?id=CVE-2025-37166

cc: @Dio9sys @da_667 @kajer

https://security.opensuse.org/2026/01/09/inputplumber-lack-of-dbus-auth.html

##

CVE-2025-14338
(0 None)

EPSS: 0.02%

updated 2026-01-14T16:25:12.057000

1 posts

Polkit authentication dis isabled by default and a race condition in the Polkit authorization check in versions before v0.69.0 can lead to the same issues as in CVE-2025-66005.

andersonc0d3@infosec.exchange at 2026-01-09T18:41:59.000Z ##

InputPlumber: Lack of D-Bus Authorization and Input Verification allows UI Input Injection and Denial-of-Service (CVE-2025-66005, CVE-2025-14338)

##

CVE-2026-20805
(5.5 MEDIUM)

EPSS: 6.74%

updated 2026-01-14T13:44:31.180000

8 posts

Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.

2 repos

https://github.com/Uzair-Baig0900/CVE-2026-20805-PoC

https://github.com/fevar54/CVE-2026-20805-POC

youranonnewsirc@nerdculture.de at 2026-01-20T03:22:37.000Z ##

Here's a digest of the latest in technology and cybersecurity:

**Cybersecurity:** Microsoft issued an emergency patch on January 19, 2026, for a critical Windows zero-day vulnerability (CVE-2026-20805) that is currently being actively exploited by attackers.

**Technology:** Elon Musk is seeking up to $134 billion in damages from OpenAI and Microsoft in an escalating AI courtroom dispute, as of January 19, 2026. NASA also began rolling out its Artemis 2 space launch system and Orion spacecraft on January 19, 2026. Additionally, NVIDIA's $20 billion acquisition of Groq's AI inference intellectual property is consolidating power in AI hardware.

##

secdb at 2026-01-19T00:01:02.377Z ##

📈 CVE Published in last 7 days (2026-01-12 - 2026-01-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1174

Severity:
- Critical: 102
- High: 430
- Medium: 413
- Low: 33
- None: 196

Status:
- : 19
- Analyzed: 196
- Awaiting Analysis: 638
- Modified: 4
- Received: 135
- Rejected: 35
- Undergoing Analysis: 147

Top CNAs:
- VulnCheck: 188
- kernel.org: 138
- GitHub, Inc.: 124
- Microsoft Corporation: 114
- Wordfence: 92
- MITRE: 91
- Fortinet, Inc.: 30
- VulDB: 30
- SICK AG: 26
- Adobe Systems Incorporated: 25

Top Affected Products:
- UNKNOWN: 948
- Microsoft Windows 11 24h2: 83
- Microsoft Windows 11 25h2: 83
- Microsoft Windows Server 2025: 83
- Microsoft Windows Server 2022 23h2: 77
- Microsoft Windows 11 23h2: 77
- Microsoft Windows Server 2022: 75
- Microsoft Windows 10 22h2: 70
- Microsoft Windows 10 21h2: 70
- Microsoft Windows Server 2019: 69

##

youranonnewsirc@nerdculture.de at 2026-01-20T03:22:37.000Z ##

Here's a digest of the latest in technology and cybersecurity:

**Cybersecurity:** Microsoft issued an emergency patch on January 19, 2026, for a critical Windows zero-day vulnerability (CVE-2026-20805) that is currently being actively exploited by attackers.

**Technology:** Elon Musk is seeking up to $134 billion in damages from OpenAI and Microsoft in an escalating AI courtroom dispute, as of January 19, 2026. NASA also began rolling out its Artemis 2 space launch system and Orion spacecraft on January 19, 2026. Additionally, NVIDIA's $20 billion acquisition of Groq's AI inference intellectual property is consolidating power in AI hardware.

##

Mathrubhumi_English@mastodon.social at 2026-01-17T05:36:12.000Z ##

CERT-In issues high-severity alert for Windows 10, Windows 11 and Microsoft Office over CVE-2026-20805 vulnerability. Microsoft confirms exploit in the wild, urges urgent updates. https://english.mathrubhumi.com/technology/is-your-windows-pc-at-risk-indian-govt-issues-urgent-security-alert-vkdh7w9u?utm_source=dlvr.it&utm_medium=mastodon #WindowsSecurity #MicrosoftAlert #CERTIn #CyberSecurity

##

youranonnewsirc@nerdculture.de at 2026-01-14T15:22:47.000Z ##

Here's a summary of the most important world, technology, and cybersecurity news from the last 24-48 hours:

World: A train crash in Thailand killed at least 22 people (Jan 14). US President Trump warned Iran amid protests and reaffirmed his desire to acquire Greenland (Jan 14).

Technology: Big Tech companies are heavily investing in energy infrastructure to power their AI ambitions amidst growing backlash over resource usage (Jan 14). Apple's status as a tech visionary is being questioned amidst the rapid AI advancements (Jan 14).

Cybersecurity: CISA and Microsoft patched an actively exploited Windows information disclosure vulnerability (CVE-2026-20805) (Jan 13-14). The World Economic Forum's 2026 outlook highlights enterprise security facing a "three-front war" from cybercrime, AI misuse, and supply chain attacks (Jan 13).

https://darkwebinformer.com/cisa-kev-catalog/

##

DarkWebInformer@infosec.exchange at 2026-01-14T00:56:14.000Z ##

‼️ CVE-2026-20805: Microsoft Windows Information Disclosure Vulnerability has been added to the CISA KEV Catalog

0-day: Yes
CVSS: 5.5

This vulnerability was patched during January 13th, 2026 Patch Tuesday.

##

cisakevtracker@mastodon.social at 2026-01-13T20:00:59.000Z ##

CVE ID: CVE-2026-20805
Vendor: Microsoft
Product: Windows
Date Added: 2026-01-13
Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-20805 ; https://nvd.nist.gov/vuln/detail/CVE-2026-20805
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-20805

##

cR0w@infosec.exchange at 2026-01-13T18:01:19.000Z ##

The EITW one is in the Desktop Window Manager.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805

##

CVE-2025-66005(CVSS UNKNOWN)

EPSS: 0.01%

updated 2026-01-14T12:31:39

1 posts

Lack of authorization of the InputManager D-Bus interface in InputPlumber versions before v0.63.0 can lead to local Denial-of-Service, information leak or even privilege escalation in the context of the currently active user session.

andersonc0d3@infosec.exchange at 2026-01-09T18:41:59.000Z ##

InputPlumber: Lack of D-Bus Authorization and Input Verification allows UI Input Injection and Denial-of-Service (CVE-2025-66005, CVE-2025-14338)

https://security.opensuse.org/2026/01/09/inputplumber-lack-of-dbus-auth.html

##

https://github.com/barrersoftware/opencode-secure

##

CVE-2026-22812
(8.8 HIGH)

EPSS: 0.03%

updated 2026-01-13T20:35:09

1 posts

*Previously reported via email to support@sst.dev on 2025-11-17 per the security policy in [opencode-sdk-js/SECURITY.md](https://github.com/sst/opencode-sdk-js/blob/main/SECURITY.md). No response received.* ### Summary OpenCode automatically starts an unauthenticated HTTP server that allows any local process—or any website via permissive CORS—to execute arbitrary shell commands with the user's p

6 repos

https://github.com/rohmatariow/CVE-2026-22812-exploit

https://github.com/0xgh057r3c0n/CVE-2026-22812

https://github.com/mad12wader/CVE-2026-22812

https://github.com/Udyz/CVE-2026-22812-Exp

https://github.com/Ashwesker/Ashwesker-CVE-2026-22812

DarkWebInformer@infosec.exchange at 2026-01-17T00:42:45.000Z ##

‼️CVE-2026-22812: OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

PoC/Exploit: https://github.com/rohmatariow/CVE-2026-22812-exploit

CVSS: 8.8
CVE Published: January 12th, 2026
Exploit Published: January 16th, 2026
Advisory: https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh

OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.

##

CVE-2026-22813
(0 None)

EPSS: 0.10%

updated 2026-01-13T19:16:27.190000

1 posts

OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into the DOM. There is no sanitization with DOMPurify or even a CSP on the web interface to prevent JavaScript execution via HTML injection. This means controlling the LLM response for a chat session gets JavaScript execution on the http://localhost:4096 origin. This vulnerability is

beyondmachines1@infosec.exchange at 2026-01-13T12:01:43.000Z ##

OpenCode patches critical RCE flaw in Web UI

OpenCode patched a critical XSS vulnerability (CVE-2026-22813) that allowed malicious websites to execute arbitrary commands on a user's local system by abusing the tool's internal API.

**If you are using OpenCode, update to version 1.1.10 ASAP to disable the vulnerable web UI and API. Avoid clicking untrusted links, check underling URLs and don't click on any links that you haven't crafted but point to your local machine's ports .**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/opencode-patches-critical-rce-flaw-in-web-ui-c-7-g-n-7/gD2P6Ple2L

##

CVE-2025-66177
(8.8 HIGH)

EPSS: 0.03%

updated 2026-01-13T18:32:08

1 posts

There is a Stack overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.

cR0w@infosec.exchange at 2026-01-13T14:31:20.000Z ##

Hikvision

https://www.cve.org/CVERecord?id=CVE-2025-66176

https://www.cve.org/CVERecord?id=CVE-2025-66177

##

CVE-2026-20963
(8.8 HIGH)

EPSS: 0.62%

updated 2026-01-13T18:31:19

1 posts

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

secdb at 2026-01-19T00:01:02.377Z ##

📈 CVE Published in last 7 days (2026-01-12 - 2026-01-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1174

Severity:
- Critical: 102
- High: 430
- Medium: 413
- Low: 33
- None: 196

Status:
- : 19
- Analyzed: 196
- Awaiting Analysis: 638
- Modified: 4
- Received: 135
- Rejected: 35
- Undergoing Analysis: 147

Top CNAs:
- VulnCheck: 188
- kernel.org: 138
- GitHub, Inc.: 124
- Microsoft Corporation: 114
- Wordfence: 92
- MITRE: 91
- Fortinet, Inc.: 30
- VulDB: 30
- SICK AG: 26
- Adobe Systems Incorporated: 25

Top Affected Products:
- UNKNOWN: 948
- Microsoft Windows 11 24h2: 83
- Microsoft Windows 11 25h2: 83
- Microsoft Windows Server 2025: 83
- Microsoft Windows Server 2022 23h2: 77
- Microsoft Windows 11 23h2: 77
- Microsoft Windows Server 2022: 75
- Microsoft Windows 10 22h2: 70
- Microsoft Windows 10 21h2: 70
- Microsoft Windows Server 2019: 69

##

CVE-2026-21265
(6.4 MEDIUM)

EPSS: 0.23%

updated 2026-01-13T18:31:19

updated 2026-01-13T18:31:16

1 posts

An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication or a physical Ethernet port connection to bypass the authentication process and access the admin panel.

cR0w@infosec.exchange at 2026-01-13T17:04:19.000Z ##

Netgear

https://www.cve.org/CVERecord?id=CVE-2025-37165

##

CVE-2025-59922
(7.2 HIGH)

EPSS: 0.05%

updated 2026-01-13T18:31:14

1 posts

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.0 through 7.2.10, FortiClientEMS 7.0 all versions may allow an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands

_r_netsec@infosec.exchange at 2026-01-14T09:43:06.000Z ##

Fortinet Forticlient EMS RCE CVE-2025-59922 and one IMG tag to rule them all https://baldur.dk/blog/fortinet-ems-rce.html

##

CVE-2025-37165
(7.5 HIGH)

EPSS: 0.04%

updated 2026-01-13T18:31:14

1 posts

A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended interfaces. A malicious actor could gain knowledge of internal network configuration details through inspecting impacted packets.

cR0w@infosec.exchange at 2026-01-13T18:09:05.000Z ##

HPE

https://www.cve.org/CVERecord?id=CVE-2025-37166

cc: @Dio9sys @da_667 @kajer

##

CVE-2026-0405(CVSS UNKNOWN)

EPSS: 0.14%

updated 2026-01-13T18:31:14

1 posts

An authentication bypass vulnerability in NETGEAR Orbi devices allows users connected to the local network to access the router web interface as an admin.

cR0w@infosec.exchange at 2026-01-13T17:04:19.000Z ##

Netgear

##

CVE-2026-20931
(8.0 HIGH)

EPSS: 1.06%

updated 2026-01-13T18:31:11

1 posts

External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.

secdb at 2026-01-19T00:01:02.377Z ##

📈 CVE Published in last 7 days (2026-01-12 - 2026-01-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1174

Severity:
- Critical: 102
- High: 430
- Medium: 413
- Low: 33
- None: 196

Status:
- : 19
- Analyzed: 196
- Awaiting Analysis: 638
- Modified: 4
- Received: 135
- Rejected: 35
- Undergoing Analysis: 147

Top CNAs:
- VulnCheck: 188
- kernel.org: 138
- GitHub, Inc.: 124
- Microsoft Corporation: 114
- Wordfence: 92
- MITRE: 91
- Fortinet, Inc.: 30
- VulDB: 30
- SICK AG: 26
- Adobe Systems Incorporated: 25

Top Affected Products:
- UNKNOWN: 948
- Microsoft Windows 11 24h2: 83
- Microsoft Windows 11 25h2: 83
- Microsoft Windows Server 2025: 83
- Microsoft Windows Server 2022 23h2: 77
- Microsoft Windows 11 23h2: 77
- Microsoft Windows Server 2022: 75
- Microsoft Windows 10 22h2: 70
- Microsoft Windows 10 21h2: 70
- Microsoft Windows Server 2019: 69

##

CVE-2026-0403(CVSS UNKNOWN)

EPSS: 0.06%

updated 2026-01-13T18:31:10

1 posts

An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command injections.

cR0w@infosec.exchange at 2026-01-13T17:04:19.000Z ##

Netgear

##

CVE-2026-0404(CVSS UNKNOWN)

EPSS: 0.64%

updated 2026-01-13T18:31:09

2 posts

An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.

secdb at 2026-01-19T00:01:02.377Z ##

📈 CVE Published in last 7 days (2026-01-12 - 2026-01-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1174

Severity:
- Critical: 102
- High: 430
- Medium: 413
- Low: 33
- None: 196

Status:
- : 19
- Analyzed: 196
- Awaiting Analysis: 638
- Modified: 4
- Received: 135
- Rejected: 35
- Undergoing Analysis: 147

Top CNAs:
- VulnCheck: 188
- kernel.org: 138
- GitHub, Inc.: 124
- Microsoft Corporation: 114
- Wordfence: 92
- MITRE: 91
- Fortinet, Inc.: 30
- VulDB: 30
- SICK AG: 26
- Adobe Systems Incorporated: 25

Top Affected Products:
- UNKNOWN: 948
- Microsoft Windows 11 24h2: 83
- Microsoft Windows 11 25h2: 83
- Microsoft Windows Server 2025: 83
- Microsoft Windows Server 2022 23h2: 77
- Microsoft Windows 11 23h2: 77
- Microsoft Windows Server 2022: 75
- Microsoft Windows 10 22h2: 70
- Microsoft Windows 10 21h2: 70
- Microsoft Windows Server 2019: 69

##

cR0w@infosec.exchange at 2026-01-13T17:04:19.000Z ##

Netgear

##

CVE-2026-0408(CVSS UNKNOWN)

EPSS: 0.05%

updated 2026-01-13T18:31:09

1 posts

A path traversal vulnerability in NETGEAR WiFi range extenders allows an attacker with LAN authentication to access the router's IP and review the contents of the dynamically generated webproc file, which records the username and password submitted to the router GUI.

cR0w@infosec.exchange at 2026-01-13T17:04:19.000Z ##

Netgear

https://github.com/zAbuQasem/gogs-CVE-2025-8110

##

CVE-2025-66176
(8.8 HIGH)

EPSS: 0.03%

updated 2026-01-13T18:16:06.060000

1 posts

There is a Stack overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.

updated 2026-01-13T15:15:58.537000

1 posts

Buffer Overflow in the ippprint (Internet Printing Protocol) service in Sagemcom F@st 3686 MAGYAR_4.121.0 allows remote attacker to execute arbitrary code by sending a crafted HTTP request.

secdb at 2026-01-19T00:01:02.377Z ##

📈 CVE Published in last 7 days (2026-01-12 - 2026-01-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1174

Severity:
- Critical: 102
- High: 430
- Medium: 413
- Low: 33
- None: 196

Status:
- : 19
- Analyzed: 196
- Awaiting Analysis: 638
- Modified: 4
- Received: 135
- Rejected: 35
- Undergoing Analysis: 147

Top CNAs:
- VulnCheck: 188
- kernel.org: 138
- GitHub, Inc.: 124
- Microsoft Corporation: 114
- Wordfence: 92
- MITRE: 91
- Fortinet, Inc.: 30
- VulDB: 30
- SICK AG: 26
- Adobe Systems Incorporated: 25

Top Affected Products:
- UNKNOWN: 948
- Microsoft Windows 11 24h2: 83
- Microsoft Windows 11 25h2: 83
- Microsoft Windows Server 2025: 83
- Microsoft Windows Server 2022 23h2: 77
- Microsoft Windows 11 23h2: 77
- Microsoft Windows Server 2022: 75
- Microsoft Windows 10 22h2: 70
- Microsoft Windows 10 21h2: 70
- Microsoft Windows Server 2019: 69

##

CVE-2025-8110(CVSS UNKNOWN)

EPSS: 2.13%

updated 2026-01-13T15:04:45

4 posts

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

6 repos

https://github.com/111ddea/goga-cve-2025-8110

https://github.com/rxerium/CVE-2025-8110

https://github.com/Ashwesker/Ashwesker-CVE-2025-8110

https://github.com/freiwi/CVE-2025-8110

https://github.com/tovd-go/CVE-2025-8110

youranonnewsirc@nerdculture.de at 2026-01-13T03:22:47.000Z ##

Latest global tech and cybersecurity news (Jan 12-13, 2026):

The World Economic Forum's 'Global Cybersecurity Outlook 2026' highlights AI, geopolitics, and cyber-fraud as key shapers of risk, with fraud now surpassing ransomware as a top concern. CISA added a Gogs Path Traversal vulnerability (CVE-2025-8110) to its Known Exploited Vulnerabilities Catalog due to active exploitation. A critical vulnerability (CVE-2026-21858) was found in the n8n workflow automation platform, affecting thousands of systems. In technology, Google removed some medical AI Overviews following "alarming" results.

https://darkwebinformer.com/cisa-kev-catalog/

##

DarkWebInformer@infosec.exchange at 2026-01-12T20:16:14.000Z ##

❗️CISA has added 1 vulnerability to the KEV Catalog:

CVE-2025-8110: Gogs Path Traversal Vulnerability

##

cisakevtracker@mastodon.social at 2026-01-12T19:00:56.000Z ##

CVE ID: CVE-2025-8110
Vendor: Gogs
Product: Gogs
Date Added: 2026-01-12
Notes: https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6 ; https://nvd.nist.gov/vuln/detail/CVE-2025-8110
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-8110

##

cR0w@infosec.exchange at 2026-01-12T18:30:58.000Z ##

Remember that Gogs ../ last month? It's now in the KEV Catalog.

http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit

https://nvd.nist.gov/vuln/detail/CVE-2025-8110

##

CVE-2025-15035
(0 None)

EPSS: 0.03%

updated 2026-01-13T14:03:46.203000

1 posts

Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an authenticated adjacent attacker to delete arbitrary server file, leading to possible loss of critical system files and service interruption or degraded functionality.This issue affects Archer AXE75 v1.6: ≤ build 20250107.

cR0w@infosec.exchange at 2026-01-09T17:25:56.000Z ##

TP-Link

https://www.cve.org/CVERecord?id=CVE-2025-15035

https://www.cve.org/CVERecord?id=CVE-2025-69425

##

CVE-2025-69425
(0 None)

EPSS: 0.11%

updated 2026-01-13T14:03:46.203000

1 posts

The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with root privileges. Authentication to this service relies on a hardcoded Time-based One-Time Password (TOTP) secret and an embedded static token. An attacker who extracts these credentials from the appliance or a compromised device can generate valid authentication

cR0w@infosec.exchange at 2026-01-09T16:52:52.000Z ##

RUCKUS

https://www.cve.org/CVERecord?id=CVE-2025-69426

EDIMAX

https://www.cve.org/CVERecord?id=CVE-2025-70161

##

CVE-2025-64090
(10.0 CRITICAL)

EPSS: 0.08%

updated 2026-01-13T14:03:46.203000

1 posts

This vulnerability allows authenticated attackers to execute commands via the hostname of the device.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2026-0731
(5.3 MEDIUM)

EPSS: 0.18%

updated 2026-01-13T14:03:46.203000

1 posts

A vulnerability has been found in TOTOLINK WA1200 5.9c.2914. The impacted element is an unknown function of the file cstecgi.cgi of the component HTTP Request Handler. The manipulation leads to null pointer dereference. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2026-22082
(0 None)

EPSS: 0.17%

updated 2026-01-13T14:03:46.203000

1 posts

This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the use of login credentials as the session ID through its web-based administrative interface. A remote attacker could exploit this vulnerability by intercepting network traffic and capturing the session ID during insecure transmission. Successful exploitation of this vulnerability

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

updated 2026-01-13T14:03:18.990000

2 posts

Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has learned the identity of a legitimate user.

beyondmachines1@infosec.exchange at 2026-01-16T13:01:43.000Z ##

Siemens Patches Critical Authentication Bypass in Industrial Edge Device Kit

Siemens reports a maximum severity critical authentication bypass vulnerability (CVE-2025-40805) in its Industrial Edge Device Kit that allows remote attackers to impersonate users and gain unauthorized access to industrial systems.

**If you are using Siemens Industrial Edge Device Kit, this is urgent and important. Make sure all Industrial Edge Device Kit systems are isolated from the internet and accessible from trusted networks only. Then plan a very quick update, this is a perfect 10 score vulnerability. Even with all the isolation, there may be a way in, so better patch.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/siemens-patches-critical-authentication-bypass-in-industrial-edge-device-kit-7-3-0-2-c/gD2P6Ple2L

##

beyondmachines1@infosec.exchange at 2026-01-16T08:01:43.000Z ##

Siemens Issues Fix for Maximum Severit flaw in Industrial Edge Devices

Siemens disclosed a max severity (10) critical vulnerability (CVE-2025-40805) in its Industrial Edge Devices that allows unauthenticated remote attackers to bypass authentication and impersonate users.

**This is maximum severity, so don't ignore it. Review the advisory to check if you use any of these product lines. Ofcourse, make sure all industrial devices are isolated from the internet and accessible from trusted networks only. Then plan a quick update cycle.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/siemens-issues-fix-for-maximum-severit-flaw-in-industrial-edge-devices-z-5-e-m-b/gD2P6Ple2L

##

CVE-2025-15505
(2.4 LOW)

EPSS: 0.03%

updated 2026-01-13T14:03:18.990000

1 posts

A vulnerability was found in Luxul XWR-600 up to 4.0.1. The affected element is an unknown function of the component Web Administration Interface. The manipulation of the argument Guest Network/Wireless Profile SSID results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did n

cR0w@infosec.exchange at 2026-01-12T14:44:36.000Z ##

UTT

Luxul

https://github.com/cyberdudebivash/CYBERDUDEBIVASH-ServiceNow-AI-Agent-Audit-Script

##

CVE-2025-12420(CVSS UNKNOWN)

EPSS: 0.09%

updated 2026-01-13T03:32:08

8 posts

A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform. ServiceNow has addressed this vulnerability by deploying a relevant security update to hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hos

1 repos

cyberveille@mastobot.ping.moi at 2026-01-19T18:30:04.000Z ##

📢 BodySnatcher (CVE-2025-12420) : usurpation d’identité et détournement d’agents IA via ServiceNow Virtual Agent/Now Assist
📝 Source: appomni.com — Aaron Costel...
📖 cyberveille : https://cyberveille.ch/posts/2026-01-19-bodysnatcher-cve-2025-12420-usurpation-didentite-et-detournement-dagents-ia-via-servicenow-virtual-agent-now-assist/
🌐 source : https://appomni.com/ao-labs/bodysnatcher-agentic-ai-security-vulnerability-in-servicenow/
#CVE_2025_12420 #IA_agentique #Cyberveille

##

undercodenews@mastodon.social at 2026-01-19T10:39:38.000Z ##

Critical ServiceNow Flaw “BodySnatcher” Lets Attackers Hijack Any Account Without MFA

Security researchers have uncovered a severe vulnerability in ServiceNow’s Virtual Agent API and Now Assist AI Agents application, tracked as CVE-2025-12420. Dubbed “BodySnatcher,” this flaw allows unauthenticated attackers to impersonate any ServiceNow user using only their email address. The vulnerability completely bypasses multi-factor authentication (MFA) and single sign-on…

https://undercodenews.com/critical-servicenow-flaw-bodysnatcher-lets-attackers-hijack-any-account-without-mfa/

##

Markcarter@infosec.exchange at 2026-01-16T12:23:06.000Z ##

Fascinating 🛡️ BodySnatcher (CVE-2025-12420): A Broken Authentication and Agentic Hijacking Vulnerability in ServiceNow 🛡️
Key Takeaways
AI agents significantly amplify the impact of traditional security flaws.
A Virtual Agent integration flaw (CVE-2025-12420) allowed unauthenticated attackers to impersonate any ServiceNow user using only an email address, bypassing MFA and SSO.
Virtual Agent APIs can become unintended execution paths for privileged AI workflows.
Internal topics such as AIA-Agent Invoker AutoChat enable AI agents to be executed outside expected deployment constraints.
Point-in-time fixes do not eliminate systemic risk from insecure provider and agent configurations.
Preventing abuse of agentic AI in conversational channels requires:
Strong provider configuration controls, including enforced MFA for account linking
Establishing an agent approval-process
Implementing lifecycle management policies to de-provision unused or stagnant agents.
https://appomni.com/ao-labs/bodysnatcher-agentic-ai-security-vulnerability-in-servicenow/ #InfoSec

##

beyondmachines1@infosec.exchange at 2026-01-14T10:01:43.000Z ##

ServiceNow patches critical AI Platform flaw enabling user impersonation

ServiceNow patched a critical privilege escalation vulnerability (CVE-2025-12420) in its AI platform that allowed unauthenticated attackers to impersonate users and execute unauthorized actions.

**If yoy are using self hosted ServiceNow, this is very important. Make sure the API is isolated from the internet if possible and accessible from trusted networks only. Then patch. If your ServiceNow must be exposed to the internet, this is urgent. Start patching now.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/servicenow-patches-critical-ai-platform-flaw-enabling-user-impersonation-8-5-w-h-p/gD2P6Ple2L

##

youranonnewsirc@nerdculture.de at 2026-01-14T03:22:44.000Z ##

Here's a digest of the most important news from the last 24 hours:

**World:**
US President Donald Trump ordered 25% tariffs on all countries doing business with Iran (Jan 13). The UN warned of alarming child malnutrition in Gaza, with nearly 95,000 cases in 2025.

**Technology:**
Google is set to integrate product purchases within its Gemini AI platform (Jan 13). Meta is reportedly laying off hundreds of employees in its metaverse division (Jan 13).

**Cybersecurity:**
The World Economic Forum's Global Cybersecurity Outlook 2026 highlights cybercrime, AI misuse, and supply chain risks as major threats. ServiceNow patched a critical AI platform flaw (CVE-2025-12420) on January 13, which could allow unauthenticated user impersonation.

https://www.cve.org/CVERecord?id=CVE-2025-12420

##

patrickcmiller@infosec.exchange at 2026-01-13T18:12:00.000Z ##

ServiceNow patches critical AI platform flaw that could allow user impersonation https://cyberscoop.com/servicenow-fixes-critical-ai-vulnerability-cve-2025-12420/

##

jbhall56@infosec.exchange at 2026-01-13T12:54:25.000Z ##

The vulnerability, tracked as CVE-2025-12420, carries a CVSS score of 9.3 out of 10.0. https://thehackernews.com/2026/01/servicenow-patches-critical-ai-platform.html

##

cR0w@infosec.exchange at 2026-01-12T21:59:35.000Z ##

sev:CRIT auth bypass in SNOW.

A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform. ServiceNow has addressed this vulnerability by deploying a relevant security update to hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Additionally, the vulnerability is addressed in the listed Store App versions. We recommend that customers promptly apply an appropriate security update or upgrade if they have not already done so.

https://www.cve.org/CVERecord?id=CVE-2025-69426

EDIMAX

https://www.cve.org/CVERecord?id=CVE-2025-70161

https://www.cve.org/CVERecord?id=CVE-2025-67004

##

CVE-2025-67004
(6.5 MEDIUM)

EPSS: 0.06%

updated 2026-01-12T18:30:29

1 posts

An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directories back after back. It can Disclosure the source code or any other confidential information if weaponize accordingly.

cR0w@infosec.exchange at 2026-01-09T16:58:47.000Z ##

../ in CouchCMS.

##

CVE-2025-55125
(7.8 HIGH)

EPSS: 0.19%

updated 2026-01-12T16:44:01.677000

1 posts

This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file.

cR0w@infosec.exchange at 2026-01-08T16:43:57.000Z ##

CVEs are now published for this.

https://www.cve.org/CVERecord?id=CVE-2025-55125

https://www.cve.org/CVERecord?id=CVE-2025-59468

https://www.cve.org/CVERecord?id=CVE-2025-59469

https://www.cve.org/CVERecord?id=CVE-2025-59470

##

CVE-2025-41006(CVSS UNKNOWN)

1 posts

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style a

linux@activitypub.awakari.com at 2026-01-12T22:15:49.000Z ## Oracle Linux 8 ELSA-2026-0421 libsoup Important CVE-2025-14523 Update The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

#Oracle #Linux #Distribution #- #Security #Advisories

Origin | Interest | Match ##

CVE-2025-61686
(9.1 CRITICAL)

EPSS: 0.09%

updated 2026-01-11T14:53:55

1 posts

If applications use `createFileSessionStorage()` from `@react-router/node` (or `@remix-run/node`/`@remix-run/deno` in Remix v2) with an [**unsigned cookie**](https://reactrouter.com/explanation/sessions-and-cookies#signing-cookies), it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would

2 repos

https://github.com/FlowerWitch/CVE-2025-61686_docker

https://github.com/Kai-One001/React-Router-CVE-2025-61686-

beyondmachines1@infosec.exchange at 2026-01-12T16:01:43.000Z ##

Critical directory traversal vulnerability reported in React Router and Remix

React Router and Remix released patches for a critical directory traversal vulnerability, CVE-2025-61686, which allows attackers to read or write server files via unsigned session cookies.

**If you are using createFileSessionStorage in React Router and Remix, this is important and urgent. Check if you are using signed cookies for session storage. If not, change that ASAP, and update packages to the latest versions immediately. Ideally, limit file system permissions of your web server process to the bare minimum.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-directory-traversal-vulnerability-patched-in-react-router-and-remix-f-v-1-s-w/gD2P6Ple2L

##

CVE-2026-0841
(8.8 HIGH)

EPSS: 0.11%

updated 2026-01-11T09:30:26

1 posts

A vulnerability was detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formPictureUrl. The manipulation of the argument importpictureurl results in buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

cR0w@infosec.exchange at 2026-01-12T14:44:36.000Z ##

UTT

Luxul

##

CVE-2026-0840
(8.8 HIGH)

EPSS: 0.11%

updated 2026-01-11T09:30:25

1 posts

A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this vulnerability is the function strcpy of the file /goform/formConfigNoticeConfig. The manipulation of the argument timestart leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but

cR0w@infosec.exchange at 2026-01-12T14:44:36.000Z ##

UTT

Luxul

##

CVE-2026-0839
(8.8 HIGH)

EPSS: 0.08%

updated 2026-01-11T06:30:19

1 posts

A weakness has been identified in UTT 进取 520W 1.7.7-180627. Affected is the function strcpy of the file /goform/APSecurity. Executing a manipulation of the argument wepkey1 can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in

cR0w@infosec.exchange at 2026-01-12T14:44:36.000Z ##

UTT

Luxul

##

CVE-2026-0836
(8.8 HIGH)

EPSS: 0.08%

updated 2026-01-11T06:30:19

1 posts

A vulnerability was determined in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formConfigFastDirectionW. This manipulation of the argument ssid causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any

cR0w@infosec.exchange at 2026-01-12T14:44:36.000Z ##

UTT

Luxul

##

CVE-2026-0837
(8.8 HIGH)

EPSS: 0.11%

updated 2026-01-11T06:30:19

1 posts

A vulnerability was identified in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/formFireWall. Such manipulation of the argument GroupName leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

cR0w@infosec.exchange at 2026-01-12T14:44:36.000Z ##

UTT

Luxul

https://github.com/whitej3rry/CVE-2025-65731

##

CVE-2025-65731
(6.8 MEDIUM)

EPSS: 0.03%

updated 2026-01-09T21:32:41

1 posts

An issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6.02CN02) allowing an attacker with physical access to the UART pins to execute arbitrary commands due to presence of root terminal access on a serial interface without proper access control.

1 repos

cR0w@infosec.exchange at 2026-01-08T18:38:52.000Z ##

D-Link

https://www.cve.org/CVERecord?id=CVE-2025-65731

https://github.com/dovezp/CVE-2025-10492-POC

##

CVE-2025-10492
(9.8 CRITICAL)

EPSS: 0.43%

updated 2026-01-09T19:55:26

1 posts

A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.

1 repos

beyondmachines1@infosec.exchange at 2026-01-09T14:01:44.000Z ##

Hitachi Energy patches critical RCE flaw in Asset Suite

Hitachi Energy released a critical update for Asset Suite to patch a remote code execution vulnerability (CVE-2025-10492) caused by improper data handling in the Jaspersoft reporting library.

**Make sure your Hitachi Asset Suite uses only predefined reports and users should not be allowed to upload untrudted reports. If possible, isolate Hitachi Asset Suite to be accessible from trusted networks only and limited number of users. Then plan an update to Asset Suite version 9.8.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/hitachi-energy-patches-critical-rce-flaw-in-asset-suite-w-5-d-c-l/gD2P6Ple2L

##

CVE-2025-70974
(10.0 CRITICAL)

EPSS: 0.08%

updated 2026-01-09T19:33:18

1 posts

Fastjson before 1.2.48 mishandles autoType because, when an `@type` key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 thro

cR0w@infosec.exchange at 2026-01-09T19:46:49.000Z ##

Perfect 10 in Fastjson. 🥳

It's funny that it appears to be a challenging enough bug that it bypassed at least two previous fixes.

https://www.cve.org/CVERecord?id=CVE-2025-70974

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.

##

CVE-2025-69426(CVSS UNKNOWN)

EPSS: 0.05%

updated 2026-01-09T18:31:43

1 posts

The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the configuration disables SCP and pseudo-TTY allocation, an attacker can authenticate using the hardcoded credentials and establish SSH local port fo

cR0w@infosec.exchange at 2026-01-09T16:52:52.000Z ##

RUCKUS

https://www.cve.org/CVERecord?id=CVE-2025-69425

https://www.cve.org/CVERecord?id=CVE-2025-69426

EDIMAX

https://www.cve.org/CVERecord?id=CVE-2025-70161

https://github.com/Afnaan-Ahmed/CVE-2025-14598

##

CVE-2025-14598
(9.8 CRITICAL)

EPSS: 0.04%

updated 2026-01-09T18:31:36

1 posts

BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQL commands to be executed on the backend database.

1 repos

FunctionalProgramming@activitypub.awakari.com at 2026-01-09T12:14:06.000Z ## CVE-2025-14598BeeS Software Solutions BET Portal contains an SQL injection vu... BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected si...

Origin | Interest | Match ##

CVE-2025-64091
(8.6 HIGH)

EPSS: 0.05%

updated 2026-01-09T18:31:35

1 posts

This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2025-64093
(10.0 CRITICAL)

EPSS: 0.29%

updated 2026-01-09T18:31:35

1 posts

Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2025-64092
(7.5 HIGH)

EPSS: 0.08%

updated 2026-01-09T18:31:35

1 posts

This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2026-22081(CVSS UNKNOWN)

EPSS: 0.05%

updated 2026-01-09T12:32:33

1 posts

This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag for session cookies associated with the web-based administrative interface. A remote at-tacker could exploit this vulnerability by capturing session cookies transmitted over an insecure HTTP connection. Successful exploitation of this vulnerability could all

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

https://www.cve.org/CVERecord?id=CVE-2025-7072

##

CVE-2025-7072(CVSS UNKNOWN)

EPSS: 0.16%

updated 2026-01-09T12:32:33

1 posts

The firmware in KAON CG3000TC and CG3000T routers contains hard-coded credentials in clear text (shared across all routers of this model) that an unauthenticated remote attacker could use to execute commands with root privileges. This vulnerability has been fixed in firmware version: 1.00.67 for CG3000TC and 1.00.27 for CG3000T.

cR0w@infosec.exchange at 2026-01-09T14:02:58.000Z ##

Hardcoded creds in KAON routers but it doesn't say what those creds are.

##

CVE-2026-22080(CVSS UNKNOWN)

EPSS: 0.02%

updated 2026-01-09T12:32:32

1 posts

This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of credentials encoded using reversible Base64 encoding through the web-based administrative interface. An attacker on the same network could exploit this vulnerability by intercepting network traffic and capturing the Base64-encoded credentials. Successful exploitat

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2026-22079(CVSS UNKNOWN)

EPSS: 0.02%

updated 2026-01-09T12:32:32

1 posts

This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the plaintext transmission of login credentials during the initial login or post-factory reset setup through the web-based administrative interface. An attacker on the same network could exploit this vulnerability by intercepting network traffic and capturing the credentials transmitt

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

https://github.com/0vercl0k/paracosme

##

CVE-2022-33318
(9.8 CRITICAL)

EPSS: 2.11%

updated 2026-01-09T06:32:08

1 posts

Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows a remote unauthenticated attacker to execute an arbitrary malicious code by sending specially crafted packets to the GENESIS64 server.

1 repos

beyondmachines1@infosec.exchange at 2026-01-16T11:01:44.000Z ##

Mitsubishi Electric and ICONICS Patch Critical Industrial Software Flaws

Mitsubishi Electric and ICONICS patched multiple vulnerabilities in industrial software, including a critical remote code execution flaw (CVE-2022-33318). These bugs allow attackers to take over systems, steal data, or disrupt manufacturing operations across several product lines.

**Review the advisory to check if you are using the affected product lines. As usual, make sure all industrial devices are isolated from the internet and accessible from trusted networks only. Then plan a patch cycle. For older products like MC Works64 and GENESIS32 plan a replacement path, they won't be getting a patch.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/mitsubishi-electric-and-iconics-patch-critical-industrial-software-flaws-4-h-b-q-o/gD2P6Ple2L

##

CVE-2025-12543
(9.6 CRITICAL)

EPSS: 0.15%

updated 2026-01-09T00:30:28

1 posts

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests. As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessio

raptor@infosec.exchange at 2026-01-09T20:42:54.000Z ##

CVE-2025-12543: Host Header Validation Bypass in #Undertow

https://www.endorlabs.com/learn/cve-2025-12543-host-header-validation-bypass-in-undertow

##

CVE-2025-59468
(9.0 None)

EPSS: 0.30%

updated 2026-01-08T21:31:39

1 posts

This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.

cR0w@infosec.exchange at 2026-01-08T16:43:57.000Z ##

CVEs are now published for this.

https://www.cve.org/CVERecord?id=CVE-2025-55125

https://www.cve.org/CVERecord?id=CVE-2025-59468

https://www.cve.org/CVERecord?id=CVE-2025-59469

https://www.cve.org/CVERecord?id=CVE-2025-59470

##

CVE-2025-52691
(10.0 CRITICAL)

EPSS: 13.81%

updated 2026-01-08T21:31:33

5 posts

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

https://github.com/SuJing-cy/CVE-2025-2025-52691-SmarterMail-Exp

10 repos

https://github.com/rxerium/CVE-2025-52691

https://github.com/you-ssef9/CVE-2025-52691

https://github.com/DeathShotXD/CVE-2025-52691-APT-PoC

https://github.com/Ashwesker/Ashwesker-CVE-2025-52691

https://github.com/rimbadirgantara/CVE-2025-52691-poc

https://github.com/nxgn-kd01/smartermail-cve-scanner

https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691

https://github.com/hilwa24/CVE-2025-52691

https://github.com/yt2w/CVE-2025-52691

christopherkunz@chaos.social at 2026-01-15T06:49:23.000Z ##

@ljrk I see your ../../../../../ and raise you one ../../../../../../../../../../../../../../../
https://labs.watchtowr.com/do-smart-people-ever-say-theyre-smart-smartertools-smartermail-pre-auth-rce-cve-2025-52691/

##

nopatience@swecyb.com at 2026-01-13T12:46:33.000Z ##

Timeline of vulnerability (soon to be exploited...) (SmartMail):

2025-12-28: NVD CVE published. [1]
2026-01-08: Vulnerability deepdive and PoC published. [2]
2026-01-12: Reconnaissance for instances detected. [3]
2026-01-xx: Exploitation? ...

[1]: https://nvd.nist.gov/vuln/detail/CVE-2025-52691
[2]: https://labs.watchtowr.com/do-smart-people-ever-say-theyre-smart-smartertools-smartermail-pre-auth-rce-cve-2025-52691/
[3]: https://www.labs.greynoise.io/grimoire/2026-01-13-smartermail-version-enumeration/

##

hrbrmstr@mastodon.social at 2026-01-13T11:49:19.000Z ##

We've been working on a new AI-driven + human-in-the-loop threat signals detector and this morning it flagged this path that we have not seen before in the grid in the past 90d `/api/v1/licensing/about`. It turns out it's an unauth’d version check for SmarterTools SmarterMail.

updated 2026-01-08T18:09:49.800000

1 posts

WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user interaction.

hotarubiko@infosec.exchange at 2026-01-15T03:28:58.000Z ##

CVE-2025-14346: WHILL electric wheelchairs models C2 and F are vulnerable to takeover over bluetooth.

Reminds me of how PGDrives Rnet systems can be controlled remotely but in that case it requires a device be plugged in to the control bus.

##

CVE-2025-14631
(0 None)

EPSS: 0.02%

updated 2026-01-08T18:08:54.147000

1 posts

A NULL Pointer Dereference vulnerability in TP-Link Archer BE400 V1(802.11 modules) allows an adjacent attacker to cause a denial-of-service (DoS) by triggering a device reboot. This issue affects Archer BE400: xi 1.1.0 Build 20250710 rel.14914.

ChrisShort@hachyderm.io at 2026-01-16T20:09:44.000Z ##

CyRC Discovers Critical WLAN Vulnerabilities in ASUS and TP-Link Routers (CVE-2025-14631) | Black Duck Blog #devopsish https://www.blackduck.com/blog/cyrc-discovers-asus-tplink-wlan-vulnerabilities.html

##

CVE-2026-21877
(9.9 CRITICAL)

EPSS: 0.03%

updated 2026-01-08T18:08:18.457000

3 posts

n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted u

1 repos

https://github.com/Ashwesker/Ashwesker-CVE-2026-21877

beyondmachines1@infosec.exchange at 2026-01-09T16:01:43.000Z ##

Another critical RCE flaw reported in n8n automation platform

n8n patched another critical remote code execution vulnerability, CVE-2026-21877, which allows authenticated users to bypass sandboxes and take full control of automation servers. Over 100,000 instances are potentially exposed.

**Make sure all automation servers are isolated from the internet and accessible from trusted networks only. Update n8n to version 1.121.3 immediately and restrict workflow creation rights to a small group of trusted administrators to prevent unauthorized code execution.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/another-critical-rce-flaw-reported-in-n8n-automation-platform-m-8-g-u-s/gD2P6Ple2L

##

christopherkunz@chaos.social at 2026-01-09T12:00:20.000Z ##

Uh... how is https://github.com/n8n-io/n8n/security/advisories/GHSA-v364-rw7m-3263 (CVE-2026-21877) a 10.0 with PR:L? That is not possible, either it's a 9.9 or it has PR:N.

##

Hackread@mstdn.social at 2026-01-08T20:09:35.000Z ##

n8n users need to update immediately after a CVSS 10.0 (CVE-2026-21877) authenticated remote code execution flaw was found that could let an attacker take over the system. Update to version 1.121.3 or higher and restrict privileges now.

Read: https://hackread.com/n8n-users-patch-full-system-takeover-vulnerability/

#n8n #Cybersecurity #Vulnerability #Infosec

##

CVE-2025-38352
(7.4 HIGH)

EPSS: 0.06%

updated 2026-01-08T16:28:23.960000

2 posts

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that

5 repos

https://github.com/farazsth98/chronomaly

https://github.com/Soikoth3010/chronomaly

https://github.com/Crime2/poc-CVE-2025-38352

https://github.com/farazsth98/poc-CVE-2025-38352

https://github.com/Soikoth3010/soikoth3010.github.io

DarkWebInformer@infosec.exchange at 2026-01-12T17:52:24.000Z ##

❗️Chronomaly: Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable Linux kernels v5.10.x.

GitHub: https://github.com/farazsth98/chronomaly

##

Android@activitypub.awakari.com at 2026-01-07T14:40:40.000Z ## Chronomaly — PoC Exploit Released for Android/Linux Kernel Vulnerability CVE-2025-38352 https://cybersecuritynews.com/chronomaly-exploit/ Commentaires : voir le flux Atom ouvrir dans le navigateur

#kernel #noyau_linux #android #faille #programmation_concurrente #exploit

Origin | Interest | Match ##

CVE-2025-69258
(9.8 CRITICAL)

EPSS: 0.15%

updated 2026-01-08T15:31:28

3 posts

A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installations.

DarkWebInformer@infosec.exchange at 2026-01-12T19:06:17.000Z ##

‼️Trend Micro Apex Central Multiple Vulnerabilities

CVE:

CVE-2025-69258 (CVSS: 9.8)
CVE-2025-69259 (CVSS: 7.5)
CVE-2025-69260 (CVSS: 7.5)

CWE: CWE-1285, CWE-306, CWE-641

PoC/Writeup: https://www.tenable.com/security/research/tra-2026-01

Disclosure Date: January 7. 2026

Disclosure: https://success.trendmicro.com/en-US/solution/KA-0022071

##

technadu@infosec.exchange at 2026-01-09T10:10:46.000Z ##

PoC exploits are now public for CVE-2025-69258 in Trend Micro Apex Central (on-premise), a vulnerability that could allow unauthenticated RCE on affected systems.

A patch is available, and there are no confirmed exploitation reports so far. Public PoCs, however, tend to accelerate attacker interest.

Follow @technadu for objective and technically grounded infosec updates.

Source: https://www.helpnetsecurity.com/2026/01/08/trend-micro-apex-central-cve-2025-69258-rce-poc/

#Infosec #VulnerabilityDisclosure #PatchManagement #RCE #EnterpriseSecurity #ThreatLandscape

##

beyondmachines1@infosec.exchange at 2026-01-09T08:01:42.000Z ##

Critical flaws and public exploits released for Trend Micro Apex Central on-premise management

Trend Micro patched a critical remote code execution vulnerability (CVE-2025-69258) in Apex Central that allows attackers to gain SYSTEM privileges. Public exploit code is now available, making immediate patching of on-premise installations vital.

**Make sure all Apex Central servers are isolated from the internet and accessible from trusted networks only. Install Critical Patch Build 7190 as soon as possible.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-flaws-and-public-exploits-released-for-trend-micro-apex-central-on-premise-management-g-t-o-p-0/gD2P6Ple2L

##

CVE-2025-37164
(10.0 CRITICAL)

EPSS: 84.85%

updated 2026-01-08T00:32:16

1 posts

A remote code execution issue exists in HPE OneView.

https://github.com/g0vguy/CVE-2025-37164-PoC

3 repos

https://github.com/rxerium/CVE-2025-37164

https://github.com/LACHHAB-Anas/Exploit_CVE-2025-37164

Hackread@mstdn.social at 2026-01-10T14:02:18.000Z ##

CISA urges emergency patching after a critical HPE OneView vulnerability (CVE-2025-37164) with active exploitation - Check your versions and update to OneView v11.00 or later now.

Read: https://hackread.com/cisa-emergency-patching-exploit-hpe-oneview-flaw/

#Cybersecurity #HPE #OneView #CISA #Vulnerability

##

CVE-2009-0556
(8.8 HIGH)

EPSS: 78.49%

updated 2026-01-07T21:32:42

1 posts

Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."

beyondmachines1@infosec.exchange at 2026-01-09T12:01:43.000Z ##

CISA warns of active attacks legacy PowerPoint flaw

CISA is warning about active exploitation of CVE-2009-0556, a critical memory corruption vulnerability in legacy Microsoft PowerPoint (2000-2003 versions) that allows attackers to execute malware and move laterally through networks via malicious .ppt files.

**If you're still running legacy Microsoft Office (2000-2003 or 2004 for Mac), remove it and upgrade immediately to a supported version. This 15-year-old PowerPoint flaw is being actively exploited to install malware. If upgrading isn't possible right away, remove PowerPoint from these old systems and avoid opening any .ppt files.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-warns-of-active-attacks-legacy-powerpoint-flaw-c-b-1-9-i/gD2P6Ple2L

##

CVE-2025-69277
(4.5 MEDIUM)

EPSS: 0.02%

updated 2026-01-07T17:16:02.003000

1 posts

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

Ubuntu@activitypub.awakari.com at 2026-01-08T16:59:39.000Z ## Ubuntu 22.04 LTS: Critical Info Exposure in libsodium CVE-2025-69277 Sodium could be made to expose sensitive information.

#Ubuntu #Linux #Distribution #- #Security #Advisories

Origin | Interest | Match ##

CVE-2026-0628
(8.8 HIGH)

EPSS: 0.02%

updated 2026-01-07T15:31:20

1 posts

Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)

1 repos

https://github.com/fevar54/CVE-2026-0628-POC

AAKL@infosec.exchange at 2026-01-13T16:21:11.000Z ##

Microsoft's Security Guide has added one new entry:

January 2026 Release Notes: Chromium: CVE-2026-0628 Insufficient policy enforcement in WebView tag https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-0628 #Microsoft #infosec #Chromium #Chrome #Edge

##

CVE-2026-21440(CVSS UNKNOWN)

EPSS: 0.10%

updated 2026-01-03T00:32:10

1 posts

### Summary **Description** A Path Traversal (CWE-22) vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next

3 repos

https://github.com/Ashwesker/Ashwesker-CVE-2026-21440

https://github.com/k0nnect/cve-2026-21440-writeup-poc

https://github.com/you-ssef9/CVE-2026-21440

DarkWebInformer@infosec.exchange at 2026-01-11T00:27:42.000Z ##

❗️CVE-2026-21440: A critical path traversal vulnerability affecting the AdonisJS framework, specifically its multipart file upload handling.

PoC Exploit: https://github.com/Ashwesker/Ashwesker-CVE-2026-21440

▪️CVSS: 9.2
▪️CVE Published: January 2nd, 2026
▪️Exploit Published: January 5th, 2026

Details:

AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6. This issue has been patched in @adonisjs/bodyparser versions 10.1.2 and 11.0.0-next.6.

##

CVE-2025-13836
(9.1 CRITICAL)

EPSS: 0.09%

updated 2025-12-30T15:30:26

1 posts

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

linux@activitypub.awakari.com at 2026-01-12T11:47:18.000Z ## Ubuntu: Python Important Denial Of Service Issue USN-7951-1 CVE-2025-13836 Python could be made to crash if it received specially crafted network traffic.

#Ubuntu #Linux #Distribution #- #Security #Advisories

Origin | Interest | Match ##

CVE-2025-14847
(7.5 HIGH)

EPSS: 22.64%

updated 2025-12-30T00:32:58

8 posts

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Ser

https://github.com/onewinner/CVE-2025-14847

38 repos

https://github.com/vfa-tuannt/CVE-2025-14847

https://github.com/demetriusford/mongobleed

https://github.com/14mb1v45h/CYBERDUDEBIVASH-MONGODB-DETECTOR-v2026

https://github.com/waheeb71/CVE-2025-14847

https://github.com/sakthivel10q/CVE-2025-14847

https://github.com/AdolfBharath/mongobleed

https://github.com/Systemhaus-Schulz/MongoBleed-CVE-2025-14847

https://github.com/peakcyber-security/CVE-2025-14847

https://github.com/CadGoose/MongoBleed-CVE-2025-14847-Fully-Automated-scanner

https://github.com/keraattin/Mongobleed-Detector-CVE-2025-14847

https://github.com/Rishi-kaul/CVE-2025-14847-MongoBleed

https://github.com/joshuavanderpoll/CVE-2025-14847

https://github.com/pedrocruz2202/pedrocruz2202.github.io

https://github.com/Black1hp/mongobleed-scanner

https://github.com/amnnrth/CVE-2025-14847

https://github.com/tunahantekeoglu/MongoDeepDive

https://github.com/FurkanKAYAPINAR/CVE-2025-14847-MongoBleed-Exploit

https://github.com/ProbiusOfficial/CVE-2025-14847

https://github.com/Ashwesker/Ashwesker-CVE-2025-14847

https://github.com/AmadoBatista/mongobleed

https://github.com/lincemorado97/CVE-2025-14847

https://github.com/JemHadar/MongoBleed-DFIR-Triage-Script-CVE-2025-14847

https://github.com/sahar042/CVE-2025-14847

https://github.com/NoNameError/MongoBLEED---CVE-2025-14847-POC-

https://github.com/kuyrathdaro/cve-2025-14847

https://github.com/Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847

https://github.com/nma-io/mongobleed

https://github.com/cybertechajju/CVE-2025-14847_Expolit

https://github.com/franksec42/mongobleed-exploit-CVE-2025-14847

https://github.com/chinaxploiter/CVE-2025-14847-PoC

https://github.com/KingHacker353/CVE-2025-14847_Expolit

https://github.com/ElJoamy/MongoBleed-exploit

https://github.com/alexcyberx/CVE-2025-14847_Expolit

https://github.com/pedrocruz2202/mongobleed-scanner

https://github.com/j0lt-github/mongobleedburp

https://github.com/sakthivel10q/sakthivel10q.github.io

https://github.com/saereya/CVE-2025-14847---MongoBleed

MongoDB@activitypub.awakari.com at 2026-01-10T07:36:00.000Z ## MongoBleed Vulnerability Allows Attackers to Read Data from MongoDB's Heap Memory MongoDB recently patched CVE-2025-14847, a vulnerability affecting multiple supported and legacy MongoDB Server...

#Common #Vulnerabilities #and #Exposures #MongoDB #Compression #Cloud #Security #AI, #ML #&

Origin | Interest | Match ##

MongoDB@activitypub.awakari.com at 2026-01-10T07:36:00.000Z ## MongoBleed Vulnerability Allows Attackers to Read Data from MongoDB's Heap Memory MongoDB recently patched CVE-2025-14847, a vulnerability affecting multiple supported and legacy MongoDB Server...

#Compression #Common #Vulnerabilities #and #Exposures #Cloud #Security #MongoDB #AI, #ML #&

Origin | Interest | Match ##

cR0w@infosec.exchange at 2026-01-13T20:52:25.000Z ##

Did PANW just take a couple months off? They're just now publishing a threat brief on MongoBleed? Maybe that's why we haven't seen any advisories from them. Can't wait to see what's been sitting EITW in their queues.

https://unit42.paloaltonetworks.com/mongobleed-cve-2025-14847/

##

MongoDB@activitypub.awakari.com at 2026-01-06T19:36:57.000Z ## Urgent Security Update: Patching “Mongobleed” (CVE-2025-14847) in Percona Server for MongoDB At Percona, our mission has always been to provide the community with truly open-source, enterprise-...

#MongoDB #Percona #Software #mongobleed #percona #server #for #MongoDB

Origin | Interest | Match ##

MongoDB@activitypub.awakari.com at 2026-01-10T07:36:00.000Z ## MongoBleed Vulnerability Allows Attackers to Read Data from MongoDB's Heap Memory MongoDB recently patched CVE-2025-14847, a vulnerability affecting multiple supported and legacy MongoDB Server...

#Compression #MongoDB #Cloud #Security #Common #Vulnerabilities #and #Exposures #AI, #ML #&

Origin | Interest | Match ##

MongoDB@activitypub.awakari.com at 2026-01-10T07:36:00.000Z ## MongoBleed Vulnerability Allows Attackers to Read Data from MongoDB's Heap Memory MongoDB recently patched CVE-2025-14847, a vulnerability affecting multiple supported and legacy MongoDB Server...

#MongoDB #Cloud #Security #Compression #Common #Vulnerabilities #and #Exposures #AI, #ML #&

Origin | Interest | Match ##

MongoDB@activitypub.awakari.com at 2026-01-10T07:36:00.000Z ## MongoBleed Vulnerability Allows Attackers to Read Data From MongoDB's Heap Memory MongoDB recently patched CVE-2025-14847, a vulnerability affecting multiple supported and legacy MongoDB Server...

#Compression #MongoDB #Cloud #Security #Common #Vulnerabilities #and #Exposures #AI, #ML #&

Origin | Interest | Match ##

MongoDB@activitypub.awakari.com at 2026-01-10T07:36:00.000Z ## MongoBleed Vulnerability Allows Attackers to Read Data From MongoDB's Heap Memory MongoDB recently patched CVE-2025-14847, a vulnerability affecting multiple supported and legacy MongoDB Server...

#MongoDB #Cloud #Security #Compression #Common #Vulnerabilities #and #Exposures #AI, #ML #&

Origin | Interest | Match ##

CVE-2025-13699
(7.0 None)

EPSS: 0.12%

updated 2025-12-24T00:30:22

1 posts

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of view names. T

cR0w@infosec.exchange at 2026-01-13T17:00:58.000Z ##

https://www.youtube.com/watch?v=nPLV7lGbmT4

https://www.cve.org/CVERecord?id=CVE-2025-13699

https://www.cve.org/CVERecord?id=CVE-2025-21490

https://www.cve.org/CVERecord?id=CVE-2025-30693

https://www.cve.org/CVERecord?id=CVE-2025-30722

##

CVE-2024-50349
(4.7 MEDIUM)

EPSS: 0.39%

updated 2025-12-18T16:42:54.610000

1 posts

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts

linux@activitypub.awakari.com at 2026-01-15T19:36:02.000Z ## Ubuntu 18.04: Git Critical Credential Issues USN-7964-1 CVE-2024-50349 Several security issues were fixed in Git.

#Ubuntu #Linux #Distribution #- #Security #Advisories

Origin | Interest | Match ##

CVE-2025-20393
(10.0 CRITICAL)

EPSS: 3.91%

updated 2025-12-17T21:30:47

2 posts

Cisco is aware of a potential vulnerability.  Cisco is currently investigating and will update these details as appropriate as more information becomes available.

7 repos

https://github.com/Ashwesker/Ashwesker-CVE-2025-20393

https://github.com/KingHacker353/CVE-2025-20393

https://github.com/StasonJatham/cisco-sa-sma-attack-N9bf4

https://github.com/cyberleelawat/CVE-2025-20393

https://github.com/MRH701/mrh701.github.io

https://github.com/cyberdudebivash/CYBERDUDEBIVASH-Cisco-AsyncOS-CVE-2025-20393-Scanner

https://github.com/MRH701/cisco-sa-sma-attack-N9bf4

youranonnewsirc@nerdculture.de at 2026-01-17T15:22:35.000Z ##

Here's a brief on the latest global, tech, and cybersecurity news from the last 24 hours:

Global: Uganda's Yoweri Museveni was declared winner of the presidential election. Over 100 people have died in torrential rains and floods across Southern Africa.

Tech: OpenAI is reportedly considering introducing ads to ChatGPT. Google filed to appeal a decision in its search monopoly case, and new generative AI features are rolling out for Gmail.

Cybersecurity: Cisco patched a zero-day vulnerability (CVE-2025-20393) exploited by a China-linked APT (Jan 16). A new PayPal phishing scam uses verified invoices with fake support numbers, and the GhostPoster browser malware, active for five years, was exposed.

https://github.com/Ashwesker/Ashwesker-CVE-2025-64113

##

AAKL@infosec.exchange at 2026-01-15T16:25:01.000Z ##

Updated Cisco advisory. "Rudolph, the red-nosed reindeer ...." 🎵 🎶 🎧

"There are no workarounds identified that directly mitigate the risk concerning this attack campaign, but administrators can view and follow the guidance provided in the Recommendations section of this advisory."

Cisco: CVE-2025-20393, critical: Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4

There are three other entries for today:

- Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-9TDh2kx

- Cisco Identity Services Engine Cross-Site Scripting Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-964cdxW5

- Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-pi-stored-xss-GEkX8yWK @TalosSecurity #infosec #Cisco #vulnerability

@cR0w

##

CVE-2025-64113
(0 None)

EPSS: 0.02%

updated 2025-12-12T15:19:07.567000

1 posts

Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than network access, no specific preconditions need to be fulfilled for a server to be vulnerable. This issue is fixed in version 4.9.1.81.

1 repos

GEBIRGE@infosec.exchange at 2026-01-13T20:20:19.000Z ##

Here's my analysis of the recent-ish 9.3 Critical in #Emby (CVE-2025-64113).

Sadly, the vulnerability turned out to be pretty boring, but I've tried to make the best of it.

https://gebir.ge/blog/its-not-mine-cve-2025-64113/

##

CVE-2025-66039
(0 None)

EPSS: 0.05%

updated 2025-12-12T15:19:07.567000

1 posts

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.

5 repos

https://github.com/cyberleelawat/FreePBX-Multiple-CVEs-2025

https://github.com/jhow019/jhow019.github.io

https://github.com/rxerium/FreePBX-Vulns-December-25

https://github.com/BimBoxH4/CVE-2025-66039_CVE-2025-61675_CVE-2025-61678_reePBX

https://github.com/jhow019/FreePBX-Vulns-December-25

AAKL@infosec.exchange at 2026-01-13T16:42:31.000Z ##

New.

Picus: Critical FreePBX Vulnerabilities: CVE-2025-66039, CVE-2025-61675, CVE-2025-61675 https://www.picussecurity.com/resource/blog/critical-freepbx-vulnerabilities-cve-2025-66039-cve-2025-61675-cve-2025-61675 #infosec #vilnerability #threatresearch #opensource

##

CVE-2025-55182
(10.0 CRITICAL)

EPSS: 62.33%

updated 2025-12-09T16:53:25

1 posts

### Impact There is an unauthenticated remote code execution vulnerability in React Server Components. We recommend upgrading immediately. The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of: * [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) * [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) * [react-s

https://github.com/pax-k/react2shell-CVE-2025-55182-full-rce-script

100 repos

https://github.com/chrahman/react2shell-CVE-2025-55182-full-rce-script

https://github.com/assetnote/react2shell-scanner

https://github.com/acheong08/CVE-2025-55182-poc

https://github.com/Rsatan/Next.js-Exploit-Tool

https://github.com/momika233/CVE-2025-55182-bypass

https://github.com/ynsmroztas/NextRce

https://github.com/shamo0/react2shell-PoC

https://github.com/alsaut1/react2shell-lab

https://github.com/Ashwesker/Ashwesker-CVE-2025-55182

https://github.com/vijay-shirhatti/RSC-Detect-CVE-2025-55182

https://github.com/xalgord/React2Shell

https://github.com/XiaomingX/CVE-2025-55182-poc

https://github.com/xcanwin/CVE-2025-55182-React-RCE

https://github.com/SainiONHacks/CVE-2025-55182-Scanner

https://github.com/websecuritylabs/React2Shell-Library

https://github.com/zr0n/react2shell

https://github.com/Security-Phoenix-demo/react2shell-scanner-rce-react-next-CVE-2025-55182-CVE-2025-66478

https://github.com/CymulateResearch/React2Shell-Scanner

https://github.com/pyroxenites/Nextjs_RCE_Exploit_Tool

https://github.com/mrknow001/RSC_Detector

https://github.com/Dh4v4l8/CVE-2025-55182-poc-tool

https://github.com/yanoshercohen/React2Shell_CVE-2025-55182

https://github.com/Saturate/CVE-2025-55182-Scanner

https://github.com/xkillbit/cve-2025-55182-scanner

https://github.com/santihabib/CVE-2025-55182-analysis

https://github.com/Spritualkb/CVE-2025-55182-exp

https://github.com/aliclub0x00/CVE-2025-55182-POC-NEXTJS

https://github.com/fBUZk2BH/RSC-Detect-CVE-2025-55182

https://github.com/LemonTeatw1/CVE-2025-55182-exploit

https://github.com/sickwell/CVE-2025-55182

https://github.com/cybertechajju/R2C-CVE-2025-55182-66478

https://github.com/theman001/CVE-2025-55182

https://github.com/AdityaBhatt3010/React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web

https://github.com/kavienanj/CVE-2025-55182

https://github.com/sho-luv/React2Shell

https://github.com/jf0x3a/CVE-2025-55182-exploit

https://github.com/dwisiswant0/CVE-2025-55182

https://github.com/zack0x01/vuln-app-CVE-2025-55182

https://github.com/Chocapikk/CVE-2025-55182

https://github.com/freeqaz/react2shell

https://github.com/kOaDT/poc-cve-2025-55182

https://github.com/songsanggggg/CVE-2025-55182

https://github.com/zack0x01/CVE-2025-55182-advanced-scanner-

https://github.com/GelukCrab/React-Server-Components-RCE

https://github.com/whiteov3rflow/CVE-2025-55182-poc

https://github.com/c0rydoras/CVE-2025-55182

https://github.com/im-ezboy/CVE-2025-55182-zoomeye

https://github.com/tobiasGuta/Next.js-RSC-RCE-Scanner-Burp-Suite-Extension

https://github.com/subhdotsol/CVE-2025-55182

https://github.com/ThemeHackers/CVE-2025-55182

https://github.com/l4rm4nd/CVE-2025-55182

https://github.com/ejpir/CVE-2025-55182-bypass

https://github.com/timsonner/React2Shell-CVE-2025-55182

https://github.com/VeilVulp/RscScan-cve-2025-55182

https://github.com/sumanrox/rschunter

https://github.com/hidden-investigations/react2shell-scanner

https://github.com/BeichenDream/CVE-2025-55182-GodzillaMemoryShell

https://github.com/BankkRoll/Quickcheck-CVE-2025-55182-React-and-CVE-2025-66478-Next.js

https://github.com/theori-io/reactguard

https://github.com/Pizz33/CVE-2025-55182-burpscanner

https://github.com/kondukto-io/vulnerable-next-js-poc

https://github.com/heiheishushu/rsc_detect_CVE-2025-55182

https://github.com/fullhunt/react2shell-test-server

https://github.com/logesh-GIT001/CVE-2025-55182

https://github.com/msanft/CVE-2025-55182

https://github.com/surajhacx/react2shellpoc

https://github.com/onlylovetx/CVE-2025-55182-CVE-2025-66478-Exploit-GUI

https://github.com/hoosin/CVE-2025-55182

https://github.com/techgaun/cve-2025-55182-scanner

https://github.com/Cillian-Collins/CVE-2025-55182

https://github.com/MrR0b0t19/CVE-2025-55182-shellinteractive

https://github.com/BlackTechX011/React2Shell

https://github.com/CirqueiraDev/MassExploit-CVE-2025-55182

https://github.com/anuththara2007-W/CVE-2025-55182-Exploit-extension

https://github.com/RuoJi6/CVE-2025-55182-RCE-shell

https://github.com/sudo-Yangziran/CVE-2025-55182POC

https://github.com/ejpir/CVE-2025-55182-research

https://github.com/nehkark/CVE-2025-55182

https://github.com/hualy13/CVE-2025-55182

https://github.com/shyambhanushali/React2Shell

https://github.com/StealthMoud/CVE-2025-55182-Scanner

https://github.com/alfazhossain/CVE-2025-55182-Exploiter

https://github.com/EynaExp/CVE-2025-55182-POC

https://github.com/emredavut/CVE-2025-55182

https://github.com/ZihxS/check-react-rce-cve-2025-55182

https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc

https://github.com/M4xSec/CVE-2025-55182-React2Shell-RCE-Shell

https://github.com/zzhorc/CVE-2025-55182

https://github.com/keklick1337/CVE-2025-55182-golang-PoC

https://github.com/MoLeft/React2Shell-Toolbox

https://github.com/Cr4at0r/Next.js-RCE-Scanner-BurpSuite-Extension-

https://github.com/Updatelap/CVE-2025-55182

https://github.com/yz9yt/React2Shell-CTF

https://github.com/gensecaihq/react2shell-scanner

https://github.com/hackersatyamrastogi/react2shell-ultimate

https://github.com/AliHzSec/CVE-2025-55182

https://github.com/Faithtiannn/CVE-2025-55182

https://github.com/fatguru/CVE-2025-55182-scanner

https://github.com/TrixSec/CVE-2025-55182-Scanner

threatresearch@infosec.exchange at 2026-01-12T22:27:57.000Z ##

I had a chance last week to chat with Benjamin Read of #Wiz. Last month, Read and other members of his team published a deep dive into the #React2Shell
(CVE-2025-55182) vulnerability, and I was curious to see what has been hitting my honeypot, so I took a closer look.

This is doing some weird stuff, friends.

As is normally the case with exploits targeting internet-facing devices, once the exploit becomes known, it ends up in the automated scanners used by threat actors and security researchers. What I've seen over the past week is a combination of both.

In just a few hours of operation, I identified a small number of source IP addresses exploiting React2Shell by pointing the vulnerable system at URLs hosting BASH scripts. These scripts are really familiar to anyone who routinely looks at honeypot data - they contain a series of commands that pull down and execute malicious payloads.

And as I've seen in the past, some of these payloads use racially inflammatory language in their malware. It's weird and gross, but unfortunately, really common.

But while most of these payloads were "the usual suspects" - remote shells, cryptocurrency miners - there was one payload that stuck out.

It's an exploit file, based on this proof-of-concept [https://github.com/iotwar/FIVEM-POC/blob/main/fivem-poc.py] designed to DDoS a modded server running "FiveM," a popular version of the game Grand Theft Auto V.

Let that one sink in: among the earliest adopters of a brand new exploit are...people trying to mess with other people's online game servers.

I've long said that exploits like these are the canaries in the datacenter coal mine. After all, if an attacker can force your server to run a cryptominer (or a game DDoS tool), they can force it to run far more malicious code.

I guess someone, or a group of someones, just want to ruin everyone's good time, no matter how or what form that takes. And they'll do it in the most offensive way possible.

Anyway, patch your servers, please, if only to stick it to these people who want to be the reason we can't have nice things.

#PoC #exploit #CVE_2025_55182 #DDoS #FiveM #REACT #Bash #cryptominer #malware

##

CVE-2025-66471(CVSS UNKNOWN)

EPSS: 0.03%

updated 2025-12-05T18:33:09

1 posts

### Impact urllib3's [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding

Ubuntu@activitypub.awakari.com at 2026-01-12T23:08:08.000Z ## Ubuntu: urllib3 Critical DoS Regression USN-7927-2 CVE-2025-66471 USN-7927-1 introduced a regression in urllib3

#Ubuntu #Linux #Distribution #- #Security #Advisories

Origin | Interest | Match ##

CVE-2025-64126
(10.0 CRITICAL)

EPSS: 5.60%

updated 2025-12-01T15:39:53.100000

1 posts

An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthenticated attacker to inject arbitrary commands.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2025-64129
(7.6 HIGH)

EPSS: 0.17%

updated 2025-11-26T18:31:15

1 posts

Zenitel TCIV-3+ is vulnerable to an out-of-bounds write vulnerability, which could allow a remote attacker to crash the device.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2025-64127
(10.0 CRITICAL)

EPSS: 5.60%

updated 2025-11-26T18:31:15

1 posts

An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to execute arbitrary commands remotely.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2025-64130
(9.8 CRITICAL)

EPSS: 0.15%

updated 2025-11-26T18:31:15

1 posts

Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the victim's browser.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2025-64128
(10.0 CRITICAL)

EPSS: 5.60%

updated 2025-11-26T18:31:15

1 posts

An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, which could permit attackers to append arbitrary data. This could allow an unauthenticated attacker to inject arbitrary commands.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2025-64446
(9.8 CRITICAL)

EPSS: 88.85%

updated 2025-11-19T15:32:36

1 posts

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

https://github.com/sxyrxyy/CVE-2025-64446-FortiWeb-CGI-Bypass-PoC

12 repos

https://github.com/verylazytech/CVE-2025-64446

https://github.com/fevar54/CVE-2025-64446-PoC---FortiWeb-Path-Traversal

https://github.com/soltanali0/CVE-2025-64446-Exploit

https://github.com/AN5I/cve-2025-64446-fortiweb-exploit

https://github.com/Death112233/CVE-2025-64446-

https://github.com/sensepost/CVE-2025-64446

https://github.com/lincemorado97/CVE-2025-64446_CVE-2025-58034

https://github.com/mrk336/Silent-WebStorm-Fortinet-s-Hidden-Exploits

https://github.com/lequoca/fortinet-fortiweb-cve-2025-64446-58034

https://github.com/Ashwesker/Ashwesker-CVE-2025-64446

https://github.com/D3crypT0r/CVE-2025-64446

technadu@infosec.exchange at 2026-01-15T13:03:28.000Z ##

Sicarii RaaS uses Israeli/Jewish iconography — but researchers say it’s likely deceptive branding.

• Geo-fencing to avoid Israeli systems
• CVE-2025-64446 exploitation
• Data theft + destructive ransomware

https://www.technadu.com/sicarii-ransomware-a-deceptive-new-ransomware-as-a-service-threat-using-hebrew-iconography/618284/

What’s your assessment of attribution through branding?

#Infosec #Ransomware #ThreatIntelligence

##

CVE-2025-12817
(3.1 LOW)

EPSS: 0.06%

updated 2025-11-13T15:30:37

1 posts

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

PostgreSQL@activitypub.awakari.com at 2026-01-14T15:27:54.000Z ## Oracle Linux 8: ELSA-2026-0524 PostgreSQL 15 Moderate DoS CVE-2025-12817 The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

#Oracle #Linux #Distribution #- #Security #Advisories

Origin | Interest | Match ##

CVE-2025-12818
(5.9 MEDIUM)

EPSS: 0.07%

updated 2025-11-13T15:30:37

1 posts

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

linux@activitypub.awakari.com at 2026-01-12T22:14:42.000Z ## Oracle Linux 9: ELSA-2026-0458 libpq Moderate Threat CVE-2025-12818 The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

#Oracle #Linux #Distribution #- #Security #Advisories

Origin | Interest | Match ##

CVE-2025-40778
(8.6 HIGH)

EPSS: 0.00%

updated 2025-11-05T00:32:31

1 posts

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

2 repos

https://github.com/sirbuvladste/BIND-9-Cache-Poisoning-PoC---CVE-2025-40778

https://github.com/nehkark/CVE-2025-40778

cR0w@infosec.exchange at 2026-01-14T19:49:28.000Z ##

Nor is there one for CVE-2025-40778.

https://my.f5.com/manage/s/article/K000157334

##

CVE-2025-8677
(7.5 HIGH)

EPSS: 0.04%

updated 2025-11-04T22:16:44.973000

1 posts

Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

cR0w@infosec.exchange at 2026-01-14T19:48:48.000Z ##

Still no fix in BIG-IP DNS for CVE-2025-8677.

https://my.f5.com/manage/s/article/K000157317

##

EPSS: 55.37%

updated 2025-10-30T19:52:49.873000

1 posts

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

jbhall56@infosec.exchange at 2026-01-09T12:57:40.000Z ##

The three bugs, tracked as CVE-2025-22224, CVE-2025-22225 and CVE-2025-22226, and named ESXicape, allow privileged attackers to execute arbitrary code and escape the VM to compromise the hypervisor itself. https://www.securityweek.com/exploit-for-vmware-zero-day-flaws-likely-built-a-year-before-public-disclosure/

##

CVE-2025-39993
(0 None)

EPSS: 0.07%

updated 2025-10-29T14:15:51.747000

1 posts

In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465 CPU: 2 PID: 4465

linux@activitypub.awakari.com at 2026-01-14T15:27:46.000Z ## Oracle Linux 8: ELSA-2026-0444 Kernel Important DoS CVE-2025-39993 The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

#Oracle #Linux #Distribution #- #Security #Advisories

Origin | Interest | Match ##

CVE-2021-44228
(10.0 CRITICAL)

EPSS: 94.47%

updated 2025-10-27T17:40:33.680000

1 posts

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is en

https://github.com/sec13b/CVE-2021-44228-POC

100 repos

https://github.com/lucab85/log4j-cve-2021-44228

https://github.com/f0ng/log4j2burpscanner

https://github.com/Azeemering/CVE-2021-44228-DFIR-Notes

https://github.com/1lann/log4shelldetect

https://github.com/corelight/cve-2021-44228

https://github.com/dwisiswant0/look4jar

https://github.com/thomaspatzke/Log4Pot

https://github.com/mergebase/log4j-detector

https://github.com/darkarnium/Log4j-CVE-Detect

https://github.com/NorthwaveSecurity/log4jcheck

https://github.com/tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce

https://github.com/qingtengyun/cve-2021-44228-qingteng-online-patch

https://github.com/mr-r3b00t/CVE-2021-44228

https://github.com/christophetd/log4shell-vulnerable-app

https://github.com/logpresso/CVE-2021-44228-Scanner

https://github.com/hackinghippo/log4shell_ioc_ips

https://github.com/infiniroot/nginx-mitigate-log4shell

https://github.com/irgoncalves/f5-waf-enforce-sig-CVE-2021-44228

https://github.com/mufeedvh/log4jail

https://github.com/BinaryDefense/log4j-honeypot-flask

https://github.com/r3kind1e/Log4Shell-obfuscated-payloads-generator

https://github.com/fullhunt/log4j-scan

https://github.com/0xInfection/LogMePwn

https://github.com/cisagov/log4j-scanner

https://github.com/yahoo/check-log4j

https://github.com/blake-fm/vcenter-log4j

https://github.com/Malwar3Ninja/Exploitation-of-Log4j2-CVE-2021-44228

https://github.com/Puliczek/CVE-2021-44228-PoC-log4j-bypass-words

https://github.com/jas502n/Log4j2-CVE-2021-44228

https://github.com/julian911015/Log4j-Scanner-Exploit

https://github.com/back2root/log4shell-rex

https://github.com/CrackerCat/CVE-2021-44228-Log4j-Payloads

https://github.com/0xDexter0us/Log4J-Scanner

https://github.com/pedrohavay/exploit-CVE-2021-44228

https://github.com/greymd/CVE-2021-44228

https://github.com/tippexs/nginx-njs-waf-cve2021-44228

https://github.com/corretto/hotpatch-for-apache-log4j2

https://github.com/toramanemre/apache-solr-log4j-CVE-2021-44228

https://github.com/mzlogin/CVE-2021-44228-Demo

https://github.com/puzzlepeaches/Log4jUnifi

https://github.com/aws-samples/kubernetes-log4j-cve-2021-44228-node-agent

https://github.com/nccgroup/log4j-jndi-be-gone

https://github.com/cyberxml/log4j-poc

https://github.com/LiveOverflow/log4shell

https://github.com/kubearmor/log4j-CVE-2021-44228

https://github.com/NCSC-NL/log4shell

https://github.com/giterlizzi/nmap-log4shell

https://github.com/puzzlepeaches/Log4jHorizon

https://github.com/sassoftware/loguccino

https://github.com/wortell/log4j

https://github.com/fireeye/CVE-2021-44228

https://github.com/takito1812/log4j-detect

https://github.com/korteke/log4shell-demo

https://github.com/claranet/ansible-role-log4shell

https://github.com/thecyberneh/Log4j-RCE-Exploiter

https://github.com/leonjza/log4jpwn

https://github.com/TaroballzChen/CVE-2021-44228-log4jVulnScanner-metasploit

https://github.com/boundaryx/cloudrasp-log4j2

https://github.com/ssl/scan4log4j

https://github.com/future-client/CVE-2021-44228

https://github.com/qingtengyun/cve-2021-44228-qingteng-patch

https://github.com/AlexandreHeroux/Fix-CVE-2021-44228

https://github.com/Jeromeyoung/log4j2burpscanner

https://github.com/faisalfs10x/Log4j2-CVE-2021-44228-revshell

https://github.com/CodeShield-Security/Log4JShell-Bytecode-Detector

https://github.com/fox-it/log4j-finder

https://github.com/kozmer/log4j-shell-poc

https://github.com/MalwareTech/Log4jTools

https://github.com/marcourbano/CVE-2021-44228

https://github.com/NS-Sp4ce/Vm4J

https://github.com/roxas-tan/CVE-2021-44228

https://github.com/DragonSurvivalEU/RCE

https://github.com/mubix/CVE-2021-44228-Log4Shell-Hashes

https://github.com/HyCraftHD/Log4J-RCE-Proof-Of-Concept

https://github.com/HynekPetrak/log4shell-finder

https://github.com/sunnyvale-it/CVE-2021-44228-PoC

https://github.com/Kadantte/CVE-2021-44228-poc

https://github.com/stripe/log4j-remediation-tools

https://github.com/RedDrip7/Log4Shell_CVE-2021-44228_related_attacks_IOCs

https://github.com/bigsizeme/Log4j-check

https://github.com/KosmX/CVE-2021-44228-example

https://github.com/Diverto/nse-log4shell

https://github.com/alexbakker/log4shell-tools

https://github.com/irgoncalves/f5-waf-quick-patch-cve-2021-44228

https://github.com/rubo77/log4j_checker_beta

https://github.com/toramanemre/log4j-rce-detect-waf-bypass

https://github.com/alexandre-lavoie/python-log4rce

https://github.com/puzzlepeaches/Log4jCenter

https://github.com/lfama/log4j_checker

https://github.com/Adikso/minecraft-log4j-honeypot

https://github.com/redhuntlabs/Log4JHunt

https://github.com/CERTCC/CVE-2021-44228_scanner

https://github.com/momos1337/Log4j-RCE

https://github.com/simonis/Log4jPatch

https://github.com/justakazh/Log4j-CVE-2021-44228

https://github.com/twseptian/spring-boot-log4j-cve-2021-44228-docker-lab

https://github.com/Nanitor/log4fix

https://github.com/shamo0/CVE-2021-44228

https://github.com/mr-vill4in/log4j-fuzzer

nono@toot.paris at 2026-01-08T21:46:36.000Z ##

Cloudflare has even bragged on their blog¹ about how they run data analytics on all of the web requests going through their system. This data may be collected for government surveillance purposes as well.

1: https://blog.cloudflare.com/exploitation-of-cve-2021-44228-before-public-disclosure-and-evolution-of-waf-evasion-patterns/

##

CVE-2025-54236
(9.1 CRITICAL)

EPSS: 57.72%

updated 2025-10-27T15:13:10

1 posts

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.

https://github.com/wubinworks/magento2-session-reaper-patch

3 repos

https://github.com/amalpvatayam67/day01-sessionreaper-lab

https://github.com/Baba01hacker666/cve-2025-54236

hackmag@infosec.exchange at 2026-01-16T09:08:29.000Z ##

⚪ Adobe Commerce and Magento Vulnerability Enables Account Takeover

🗨️ Adobe has disclosed a critical bug (CVE-2025-54236) that affects the Commerce and Magento platforms. Researchers have dubbed this vulnerability SessionReaper and describe it as one of the most serious in…

🔗 https://hackmag.com/news/sessionreaper?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

🔗 https://hackmag.com/news/cve-2025-21043?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

##

CVE-2025-21043
(8.8 HIGH)

EPSS: 11.37%

updated 2025-10-22T00:34:27

2 posts

Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.

hackmag at 2026-01-19T12:37:17.478Z ##

⚪ Samsung patches a 0‑day exploited in attacks against Android users

🗨️ Samsung has patched a zero-day RCE vulnerability that was already being exploited in attacks against devices running Android.

https://github.com/RonF98/CVE-2024-43451-POC

##

updated 2025-10-22T00:33:11

1 posts

NTLM Hash Disclosure Spoofing Vulnerability

1 repos

oversecurity@mastodon.social at 2026-01-14T09:40:05.000Z ##

German Manufacturing Under Phishing Attacks: Tracking a Stealthy AsyncRATCampaign

Learn about a new phishing campaign targeting German manufacturing companies using CVE-2024-43451.

🔗️ [Any] https://link.is.it/F0JDjf

##

CVE-2025-59830
(7.5 HIGH)

EPSS: 0.07%

updated 2025-10-10T16:43:14.337000

1 posts

Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default conf

Ubuntu@activitypub.awakari.com at 2026-01-15T08:19:37.000Z ## Ubuntu 25.10: Rack Critical DoS Risk Fix USN-7960-1 CVE-2025-59830 Several security issues were fixed in Rack.

#Ubuntu #Linux #Distribution #- #Security #Advisories

Origin | Interest | Match ##

CVE-2025-59816
(7.3 HIGH)

EPSS: 0.10%

updated 2025-09-26T14:32:19.853000

1 posts

This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including user credentials. User passwords are stored in plaintext, significantly increasing the severity of this issue.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2025-59815
(9.1 CRITICAL)

EPSS: 0.06%

updated 2025-09-25T21:30:37

1 posts

This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, granting shell access. Exploitation can compromise the device’s availability, confidentiality, and integrity.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2025-59817
(9.1 CRITICAL)

EPSS: 0.04%

updated 2025-09-25T21:30:37

1 posts

This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges, successful exploitation grants full control over the device, potentially compromising its availability, confidentiality, and integrity.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2025-59814
(9.8 CRITICAL)

EPSS: 0.08%

updated 2025-09-25T21:30:36

1 posts

This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read the entire contents of the Billing Admin database.

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

https://github.com/Nurjaman2004/jsPDF-Bulk-Detector-CVE-2025-68428-

EPSS: 0.03%

updated 2025-07-01T15:32:11

1 posts

A vulnerability was found in code-projects Product Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/edit_user.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

2 repos

https://github.com/12nio/CVE-2025-68428_PoC

DarkWebInformer@infosec.exchange at 2026-01-11T02:00:20.000Z ##

❗️CVE-2025-68428: Critical Path Traversal in jsPDF

GitHub: https://github.com/12nio/CVE-2025-68428_PoC

CVSS: 9.2
CVE Published: January 5th, 2026
Exploit Published: January 8th, 2026

News source: https://www.bleepingcomputer.com/news/security/critical-jspdf-flaw-lets-hackers-steal-secrets-via-generated-pdfs/

##

CVE-2025-2104
(4.3 MEDIUM)

EPSS: 0.10%

updated 2025-03-13T06:30:39

2 posts

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insufficient validation on the pagelayer_save_content() function in all versions up to, and including, 1.9.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to bypass post moderation and publish posts to the site.

1 repos

https://github.com/Ashwesker/Ashwesker-CVE-2025-21042

hackmag at 2026-01-19T12:37:17.478Z ##

⚪ Samsung patches a 0‑day exploited in attacks against Android users

🗨️ Samsung has patched a zero-day RCE vulnerability that was already being exploited in attacks against devices running Android.

🔗 https://hackmag.com/news/cve-2025-21043?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

🔗 https://hackmag.com/news/cve-2025-21043?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

##

hackmag@infosec.exchange at 2026-01-19T12:37:17.000Z ##

⚪ Samsung patches a 0‑day exploited in attacks against Android users

🗨️ Samsung has patched a zero-day RCE vulnerability that was already being exploited in attacks against devices running Android.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21265

##

CVE-2023-31096
(7.8 HIGH)

EPSS: 0.02%

updated 2024-11-21T08:01:24.497000

1 posts

An issue was discovered in Broadcom) LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 (aka AGRSM64.sys). There is Local Privilege Escalation to SYSTEM via a Stack Overflow in RTLCopyMemory (IOCTL 0x1b2150). An attacker can exploit this to elevate privileges from a medium-integrity process to SYSTEM. This can also be used to bypass kernel-level protections such as AV or PPL, because exploi

cR0w@infosec.exchange at 2026-01-13T18:04:31.000Z ##

The publicly disclosed ones are expiring Secure Boot cert:

and an old one that was published in 2023 but is apparently now applicable to all Windows systems with the Agere Soft Modem installed, even if it isn't in use.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-31096

https://www.cve.org/CVERecord?id=CVE-2023-31096

##

CVE-2020-8554
(6.3 MEDIUM)

EPSS: 24.78%

updated 2024-11-21T05:39:01.370000

1 posts

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to simil

5 repos

https://github.com/jrmurray000/CVE-2020-8554

https://github.com/Dviejopomata/CVE-2020-8554

https://github.com/twistlock/k8s-cve-2020-8554-mitigations

https://github.com/rancher/externalip-webhook

https://github.com/alebedev87/gatekeeper-cve-2020-8554

raesene@infosec.exchange at 2026-01-14T09:43:23.000Z ##

For anyone who's been to one of my #Kubernetes #Security talks over the last couple of years, you may have seen me mention "the unpatchable 4", which is a set of Kubernetes CVEs for which there are no patches, you need to mitigate them with configuration or architecture choices.

I've been meaning to write more about them, and finally got a chance so here's the first in a mini-series of posts looking at the CVEs and the underlying reasons they occur. This time it's CVE-2020-8554.

https://securitylabs.datadoghq.com/articles/unpatchable-kubernetes-vulnerabilities-cve-2020-8554/

##

CVE-2017-18349
(9.8 CRITICAL)

EPSS: 90.83%

updated 2024-11-21T03:19:54.190000

1 posts

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.

https://github.com/h0cksr/Fastjson--CVE-2017-18349-

1 repos

cR0w@infosec.exchange at 2026-01-09T19:46:49.000Z ##

Perfect 10 in Fastjson. 🥳

It's funny that it appears to be a challenging enough bug that it bypassed at least two previous fixes.

https://www.cve.org/CVERecord?id=CVE-2025-70974

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.

##

CVE-2022-25845
(8.1 HIGH)

EPSS: 88.82%

updated 2024-05-15T06:28:36

1 posts

The package com.alibaba:fastjson before 1.2.83 is vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

6 repos

https://github.com/nerowander/CVE-2022-25845-exploit

https://github.com/cuijiung/fastjson-CVE-2022-25845

https://github.com/scabench/fastjson-tp1fn1

https://github.com/hosch3n/FastjsonVulns

https://github.com/luelueking/CVE-2022-25845-In-Spring

https://github.com/ph0ebus/CVE-2022-25845-In-Spring

cR0w@infosec.exchange at 2026-01-09T19:46:49.000Z ##

Perfect 10 in Fastjson. 🥳

It's funny that it appears to be a challenging enough bug that it bypassed at least two previous fixes.

https://www.cve.org/CVERecord?id=CVE-2025-70974

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.

##

CVE-2023-38408
(9.8 CRITICAL)

EPSS: 69.19%

updated 2024-04-19T05:07:56

1 posts

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

8 repos

https://github.com/kali-mx/CVE-2023-38408

https://github.com/classic130/CVE-2023-38408

https://github.com/mrtacojr/CVE-2023-38408

https://github.com/wxrdnx/CVE-2023-38408

https://github.com/fazilbaig1/cve_2023_38408_scanner

2 posts

N/A

nixpkgssecuritychanges@social.gerbet.me at 2026-01-19T18:05:21.000Z ##

Security Advisory: SQLite database externally accessible with the default settings of Tandoor Recipes module (CVE-2026-23838)

3 posts

N/A

pentesttools at 2026-01-19T12:31:55.109Z ##

Ever named your own CVE? We sure did. 😏

Meet PTT-2025-021 (aka CVE-2025-63261).

A vulnerability in AWStats hiding inside cPanel.

One misplaced "|" flips log analysis into command execution.

No magic. Just unsafe open() and legacy code trusting input.

On our blog, we walk through how we traced it, proved it, and why this vulnerability class still bites.

Special thanks to Matei Badanoiu for the research. 👏

See the full attack path in Part 1: https://pentest-tools.com/blog/cpanel-cve-ptt-2025-021-part-1

##

pentesttools@infosec.exchange at 2026-01-19T12:31:55.000Z ##

Ever named your own CVE? We sure did. 😏

Meet PTT-2025-021 (aka CVE-2025-63261).

A vulnerability in AWStats hiding inside cPanel.

One misplaced "|" flips log analysis into command execution.

No magic. Just unsafe open() and legacy code trusting input.

On our blog, we walk through how we traced it, proved it, and why this vulnerability class still bites.

Special thanks to Matei Badanoiu for the research. 👏

See the full attack path in Part 1: https://pentest-tools.com/blog/cpanel-cve-ptt-2025-021-part-1

##

pentesttools@infosec.exchange at 2026-01-09T12:36:00.000Z ##

Our researchers at Pentest-Tools.com just found a new RCE in cPanel (CVE-2025-63261). 🔧

We discovered that a classic Unsafe Perl Open in AWStats allows command execution. The application fails to sanitize input before the open() call, so a well-placed pipe | character tricks the system into spawning a shell instead of reading a file.

This exploit requires zero actual plumbing. 🪠

Read Part 1 of the technical breakdown by Matei Badanoiu: https://pentest-tools.com/blog/cpanel-cve-ptt-2025-021-part-1

#infosec #cybersecurity #cPanel #RCE #vulnerability #PentestTools

##

CVE-2026-22858
(0 None)

EPSS: 0.04%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-14T18:38:50.000Z ##

FreeRDP

Edit to add more.

##

CVE-2026-22856
(0 None)

EPSS: 0.04%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-14T18:38:50.000Z ##

FreeRDP

Edit to add more.

##

CVE-2026-22854
(0 None)

EPSS: 0.04%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-14T18:38:50.000Z ##

FreeRDP

Edit to add more.

##

CVE-2026-22855
(0 None)

EPSS: 0.04%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-14T18:38:50.000Z ##

FreeRDP

Edit to add more.

##

CVE-2026-22853
(0 None)

EPSS: 0.04%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-14T18:38:50.000Z ##

FreeRDP

Edit to add more.

##

CVE-2026-22851
(0 None)

EPSS: 0.04%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-14T18:38:50.000Z ##

FreeRDP

Edit to add more.

##

CVE-2026-22262
(0 None)

EPSS: 0.00%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-14T17:13:52.000Z ##

Suricata

##

CVE-2026-22260
(0 None)

EPSS: 0.00%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-14T17:13:52.000Z ##

Suricata

##

CVE-2026-22264
(0 None)

EPSS: 0.00%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-14T17:13:52.000Z ##

Suricata

##

CVE-2026-22263
(0 None)

EPSS: 0.00%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-14T17:13:52.000Z ##

Suricata

##

CVE-2026-22259
(0 None)

EPSS: 0.00%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-14T17:13:52.000Z ##

Suricata

##

CVE-2026-22258
(0 None)

EPSS: 0.00%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-14T17:13:52.000Z ##

Suricata

##

CVE-2026-22261
(0 None)

EPSS: 0.00%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-14T17:13:52.000Z ##

Suricata

##

CVE-2025-49844
(0 None)

EPSS: 6.88%

1 posts

N/A

https://github.com/saneki/cve-2025-49844

18 repos

https://github.com/Zain3311/CVE-2025-49844

https://github.com/imbas007/CVE-2025-49844-Vulnerability-Scanner

https://github.com/ksnnd32/redis_exploit

https://github.com/pedrorichil/CVE-2025-49844

https://github.com/raminfp/redis_exploit

https://github.com/angelusrivera/CVE-2025-49844

https://github.com/elyasbassir/CVE-2025-49844

https://github.com/lastvocher/redis-CVE-2025-49844

https://github.com/hzhsec/redis-cve_2025_49844

https://github.com/dwisiswant0/CVE-2025-49844

https://github.com/Mufti22/CVE-2025-49844-RediShell-Vulnerability-Scanner

https://github.com/Yuri08loveElaina/CVE-2025-49844

https://github.com/gopinaath/CVE-2025-49844-discovery

https://github.com/Network-Sec/CVE-2025-49844-RediShell-AI-made-Revshell

https://github.com/srozb/reditrap

https://github.com/MiclelsonCN/CVE-2025-49844_POC

https://github.com/Ashwesker/Ashwesker-CVE-2025-49844

cR0w@infosec.exchange at 2026-01-14T14:21:58.000Z ##

Redis Lua vuln impacts BIG-IP Next and no patches are available.

https://my.f5.com/manage/s/article/K000159544

https://www.cve.org/CVERecord?id=CVE-2025-49844

##

CVE-2025-61675
(0 None)

EPSS: 0.04%

1 posts

N/A

5 repos

https://github.com/cyberleelawat/FreePBX-Multiple-CVEs-2025

https://github.com/jhow019/jhow019.github.io

https://github.com/rxerium/FreePBX-Vulns-December-25

https://github.com/BimBoxH4/CVE-2025-66039_CVE-2025-61675_CVE-2025-61678_reePBX

https://github.com/jhow019/FreePBX-Vulns-December-25

AAKL@infosec.exchange at 2026-01-13T16:42:31.000Z ##

New.

Picus: Critical FreePBX Vulnerabilities: CVE-2025-66039, CVE-2025-61675, CVE-2025-61675 https://www.picussecurity.com/resource/blog/critical-freepbx-vulnerabilities-cve-2025-66039-cve-2025-61675-cve-2025-61675 #infosec #vilnerability #threatresearch #opensource

##

CVE-2025-5017
(0 None)

EPSS: 0.00%

1 posts

N/A

hackmag@infosec.exchange at 2026-01-12T20:15:45.000Z ##

⚪ August Windows updates may block app installations

🗨️ Microsoft reported that the Windows security updates for August 2025 may trigger unexpected User Account Control (UAC) prompts and cause problems with app installations. The bug affects users without administrator…

🔗 https://hackmag.com/news/cve-2025-50173-problem?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

##

CVE-2026-21897
(0 None)

EPSS: 0.05%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-12T14:39:00.000Z ##

Space Hacking ( NASA Cryptolib ) 🚀

##

CVE-2026-21900
(0 None)

EPSS: 0.06%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-12T14:39:00.000Z ##

Space Hacking ( NASA Cryptolib ) 🚀

##

CVE-2026-22027
(0 None)

EPSS: 0.02%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-12T14:39:00.000Z ##

Space Hacking ( NASA Cryptolib ) 🚀

##

CVE-2026-21899
(0 None)

EPSS: 0.06%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-12T14:39:00.000Z ##

Space Hacking ( NASA Cryptolib ) 🚀

##

CVE-2026-22697
(0 None)

EPSS: 0.10%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-12T14:39:00.000Z ##

Space Hacking ( NASA Cryptolib ) 🚀

##

CVE-2026-22025
(0 None)

EPSS: 0.05%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-12T14:39:00.000Z ##

Space Hacking ( NASA Cryptolib ) 🚀

https://github.com/daytriftnewgen/CVE-2026-21876

##

CVE-2026-21876
(0 None)

EPSS: 0.04%

3 posts

N/A

1 repos

beyondmachines1@infosec.exchange at 2026-01-10T09:01:07.000Z ##

OWASP CRS Patches Critical Multipart Charset Validation Bypass

OWASP CRS released patches for a critical vulnerability (CVE-2026-21876) that allows attackers to bypass charset validation in multipart requests. By placing malicious payloads in early request parts, attackers can slip UTF-7/16/32 encoded XSS attacks past the WAF.

**If you are using WAF OWASP Core Rule Set to version 4.22.0 or 3.3.8 this is important. Update the Core rule 922110 ASAP. Don't not rely on default settings for rule 922110 until you have applied these patches. Attackers can easily hide malicious scripts in multi-part uploads.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/owasp-crs-patches-critical-multipart-charset-validation-bypass-6-n-o-8-z/gD2P6Ple2L

##

_r_netsec@infosec.exchange at 2026-01-08T20:28:06.000Z ##

CVE-2026-21876: OWASP Modsecurity CRS WAF bypass blogpost is out! https://coreruleset.org/20260106/cve-2026-21876-critical-multipart-charset-bypass-fixed-in-crs-4.22.0-and-3.3.8/

##

_r_netsec@infosec.exchange at 2026-01-08T19:58:06.000Z ##

Critical (9.3 CVSS) OWASP ModSecurity CRS WAF bypass advisory and walkthrough is out! https://coreruleset.org/20260106/cve-2026-21876-critical-multipart-charset-bypass-fixed-in-crs-4.22.0-and-3.3.8/

##

CVE-2025-59819
(0 None)

EPSS: 0.00%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel

##

CVE-2025-59818
(0 None)

EPSS: 0.00%

1 posts

N/A

cR0w@infosec.exchange at 2026-01-09T14:14:27.000Z ##

Tenda

D-Link

TOTOLINK

Zenitel