CRITICAL: CVE-2026-12378 — Deserialization of untrusted data in Appointment Booking Calendar & Scheduling Plugins (<=1.1.28) for WordPress. Unauthenticated attackers may achieve RCE. Restrict plugin use & monitor for patches. https://radar.offseq.com/threat/cve-2026-12378-cwe-502-deserialization-of-untruste-7e251cce3409b39a #OffSeq #WordPress #Vuln #RCE

CRITICAL: CVE-2026-12378 — Deserialization of untrusted data in Appointment Booking Calendar & Scheduling Plugins (<=1.1.28) for WordPress. Unauthenticated attackers may achieve RCE. Restrict plugin use & monitor for patches. https://radar.offseq.com/threat/cve-2026-12378-cwe-502-deserialization-of-untruste-7e251cce3409b39a #OffSeq #WordPress #Vuln #RCE

🚨 [CISA-2026:0707] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0707)

CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48908 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48908)
- Name: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JoomShaper
- Product: SP Page Builder
- Notes: https://extensions.joomla.org/extension/sp-page-builder/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48908

⚠️ CVE-2026-55255 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-55255)
- Name: Langflow Authorization Bypass Through User-Controlled Key Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-55255

⚠️ CVE-2026-56290 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56290)
- Name: Joomlack Page Builder Improper Access Control Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Joomlack
- Product: Page Builder
- Notes: https://www.joomlack.fr/en/joomla-extensions/page-builder-ck ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56290

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260707 #cisa20260707 #cve_2026_48908 #cve_2026_55255 #cve_2026_56290 #cve202648908 #cve202655255 #cve202656290

CVE ID: CVE-2026-56290
Vendor: Joomlack
Product: Page Builder
Date Added: 2026-07-07
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56290

CISA has updated the KEV catalogue.

- CVE-2026-56290: Joomlack Page Builder Improper Access Control Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-56290

- CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-55255

- CVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48908

Several industrial vulnerabilities: https://www.cisa.gov/ #infosec #vulnerability #CISA

🚨 [CISA-2026:0707] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0707)

CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48908 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48908)
- Name: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JoomShaper
- Product: SP Page Builder
- Notes: https://extensions.joomla.org/extension/sp-page-builder/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48908

⚠️ CVE-2026-55255 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-55255)
- Name: Langflow Authorization Bypass Through User-Controlled Key Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-55255

⚠️ CVE-2026-56290 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56290)
- Name: Joomlack Page Builder Improper Access Control Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Joomlack
- Product: Page Builder
- Notes: https://www.joomlack.fr/en/joomla-extensions/page-builder-ck ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56290

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260707 #cisa20260707 #cve_2026_48908 #cve_2026_55255 #cve_2026_56290 #cve202648908 #cve202655255 #cve202656290

CVE ID: CVE-2026-56290
Vendor: Joomlack
Product: Page Builder
Date Added: 2026-07-07
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56290

CISA has updated the KEV catalogue.

- CVE-2026-56290: Joomlack Page Builder Improper Access Control Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-56290

- CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-55255

- CVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48908

Several industrial vulnerabilities: https://www.cisa.gov/ #infosec #vulnerability #CISA

CISA Mandates Patching of Exploited Langflow Auth Bypass Flaw

The CISA has stepped in to mandate patching of a critical Langflow Auth Bypass flaw, CVE-2026-55255, that's being exploited by financially motivated threat actors to access sensitive user data. This vulnerability allows attackers to siphon off sensitive data and hijack computing resources with just a crafted request.

https://osintsights.com/cisa-mandates-patching-of-exploited-langflow-auth-bypass-flaw?utm_source=mastodon&utm_medium=social

#Langflow #AuthBypass #Cve202655255 #Cisa #EmergingThreats

🚨 [CISA-2026:0707] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0707)

CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48908 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48908)
- Name: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JoomShaper
- Product: SP Page Builder
- Notes: https://extensions.joomla.org/extension/sp-page-builder/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48908

⚠️ CVE-2026-55255 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-55255)
- Name: Langflow Authorization Bypass Through User-Controlled Key Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-55255

⚠️ CVE-2026-56290 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56290)
- Name: Joomlack Page Builder Improper Access Control Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Joomlack
- Product: Page Builder
- Notes: https://www.joomlack.fr/en/joomla-extensions/page-builder-ck ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56290

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260707 #cisa20260707 #cve_2026_48908 #cve_2026_55255 #cve_2026_56290 #cve202648908 #cve202655255 #cve202656290

CVE ID: CVE-2026-55255
Vendor: Langflow
Product: Langflow
Date Added: 2026-07-07
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-55255

CISA has updated the KEV catalogue.

- CVE-2026-56290: Joomlack Page Builder Improper Access Control Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-56290

- CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-55255

- CVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48908

Several industrial vulnerabilities: https://www.cisa.gov/ #infosec #vulnerability #CISA

🚨 [CISA-2026:0707] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0707)

CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48908 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48908)
- Name: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JoomShaper
- Product: SP Page Builder
- Notes: https://extensions.joomla.org/extension/sp-page-builder/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48908

⚠️ CVE-2026-55255 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-55255)
- Name: Langflow Authorization Bypass Through User-Controlled Key Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-55255

⚠️ CVE-2026-56290 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56290)
- Name: Joomlack Page Builder Improper Access Control Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Joomlack
- Product: Page Builder
- Notes: https://www.joomlack.fr/en/joomla-extensions/page-builder-ck ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56290

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260707 #cisa20260707 #cve_2026_48908 #cve_2026_55255 #cve_2026_56290 #cve202648908 #cve202655255 #cve202656290

CVE ID: CVE-2026-55255
Vendor: Langflow
Product: Langflow
Date Added: 2026-07-07
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-55255

CISA has updated the KEV catalogue.

- CVE-2026-56290: Joomlack Page Builder Improper Access Control Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-56290

- CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-55255

- CVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48908

Several industrial vulnerabilities: https://www.cisa.gov/ #infosec #vulnerability #CISA

CVE-2026-53479 - Critical command injection in Dell PowerProtect Data Domain. High-privilege remote attacker can bypass protections. CVSS 7.2. Patch now. #CVE #Dell #infosec

https://www.valtersit.com/cve/CVE-2026-53479/

Januscape Flaw in Linux KVM’s MMU Code Enables VM Escape on Intel and AMD

A newly disclosed Linux kernel vulnerability, CVE-2026-53359, dubbed Januscape, has exposed a critical weakness in the Linux Kernel-based Virtual...

🔗️ [Thecyberexpress] https://link.is.it/a1LDMj

Januscape: Guest-to-Host Escape in KVM/x86

Januscape (CVE-2026-53359) is a guest-to-host vulnerability that exploits a use-after-free in the shadow MMU emulation of KVM/x86. Guest-side actions alone can trigger the bug and corrupt the shadow page state of the host kernel that runs the guest. Because the vulnerability lives in the shadow MMU code that x86 KVM shares between both Intel (VMX) and AMD (SVM), it is not limited to a single architecture, and to the best of public knowledge, this is the first guest-to-host exploit research triggerable on both Intel and AMD. It threatens the guest-host isolation of multi-tenant x86 public clouds (GCP, AWS, etc.) that accept untrusted guests and expose nested virtualization. In fact, this vulnerability was used as a 0-day in Google kvmCTF.

Haven't seen a big splash in the (IT) news yet, but apparently there is a 16 year old vulnerability in KVM which can be used to escape a guest and even take over the host (CVE-2026-53359): https://github.com/V4bel/Januscape. If /dev/kvm is available (world-writable on the host), it can also be used as a LPE to root.

This is kind of bad. REALLY bad.

Januscape Flaw in Linux KVM’s MMU Code Enables VM Escape on Intel and AMD

A newly disclosed Linux kernel vulnerability, CVE-2026-53359, dubbed Januscape, has exposed a critical weakness in the Linux Kernel-based Virtual...

🔗️ [Thecyberexpress] https://link.is.it/a1LDMj

Januscape (CVE-2026-53359) Guest-to-Host Escape in KVM/x86 https://github.com/V4bel/Januscape

Januscape: Guest-to-Host Escape in KVM/x86 [CVE-2026-53359]

Link: https://github.com/V4bel/Januscape
Discussion: https://news.ycombinator.com/item?id=48807908

⚠️ CRITICAL: 16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems

A 16-year-old use-after-free vulnerability in Linux KVM (CVE-2026-53359) allows guest VMs to escape to the host kernel and potentially achieve full code execution on Intel and AMD x86 systems. Exploitation requires root inside the guest and nested virtualization enabled. An unreleased exploit repor…

https://threatnoir.com/focus

#infosec #cybersecurity

Januscape: Guest-to-Host Escape in KVM/x86 [CVE-2026-53359]

Link: https://github.com/V4bel/Januscape
Discussion: https://news.ycombinator.com/item?id=48807908

Januscape: Guest-to-Host Escape in KVM/x86 [CVE-2026-53359] - https://github.com/V4bel/Januscape

#hackernews

Januscape: Guest-to-Host Escape in KVM/x86 [CVE-2026-53359]

https://github.com/V4bel/Januscape

Comments: https://news.ycombinator.com/item?id=48807908

#HackerNews #Januscape #KVM #CVE-2026-53359 #virtualization #security #exploits

Januscape: Guest-to-Host Escape in KVM/x86 [CVE-2026-53359]

https://github.com/V4bel/Januscape

#github

‼️ New Dark Web Informer Blog Post!

Title: A Long-Lived KVM Bug Resurfaces: Shadow Paging Use-After-Free in the Linux Kernel (CVE-2026-53359)

Link: https://darkwebinformer.com/a-long-lived-kvm-bug-resurfaces-shadow-paging-use-after-free-in-the-linux-kernel-cve-2026-53359/

Researchers disclosed a PoC for the Januscape KVM escape (CVE-2026-53359). This use-after-free KVM bug impacts public clouds, allowing host panics and LPE.

#Januscape #KVMEscape #CVE202653359 #CyberSecurity #0day

https://securityonline.info/januscape-kvm-escape-cve-2026-53359-poc/?utm_source=mastodon&utm_medium=jetpack_social

Oh, goodie. KVM Guest-to-Host escape

"Januscape (CVE-2026-53359)" -- https://github.com/V4bel/Januscape

https://www.openwall.com/lists/oss-security/2026/07/06/7

Recent events include heightened geopolitical tensions as the U.S. launched strikes on Iran following attacks in the Strait of Hormuz, pushing oil prices higher. In cybersecurity, Sysdig reported the first end-to-end AI agent ransomware attack, dubbed "JADEPUFFER." Additionally, CISA issued a warning regarding active exploitation of a critical Adobe ColdFusion vulnerability (CVE-2026-48282).

#AnonNews_irc #Cybersecurity #News

Poc for CVE-2026-48282, a path traversal vulnerability in Adobe ColdFusion's Remote Development Service (RDS) https://github.com/imbas007/CVE-2026-48282

CISA Mandates Patching of Exploited Adobe ColdFusion Flaw

Adobe has issued a warning to patch a critical flaw, CVE-2026-48282, in ColdFusion versions 2025.9, 2023.20, and earlier, as attackers have already begun exploiting it just two hours after disclosure. Admins are urged to deploy the updates within 72 hours to prevent code execution on unpatched systems.

https://osintsights.com/cisa-mandates-patching-of-exploited-adobe-coldfusion-flaw?utm_source=mastodon&utm_medium=social

#AdobeColdfusion #Cve202648282 #ExploitedVulnerability #EmergingThreats #PatchManagement

🚨 CVE-2026-48282: PoC Path traversal vulnerability in Adobe ColdFusion's Remote Development Service (RDS) with a CVSS score of 10.0

GitHub: https://github.com/imbas007/CVE-2026-48282

CVE ID: CVE-2026-48282
Vendor: Adobe
Product: ColdFusion
Date Added: 2026-07-07
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48282

📰 Patch Now: Critical Adobe ColdFusion RCE Flaw (CVE-2026-48282) Under Active Exploitation

🚨 CRITICAL FLAW: Adobe ColdFusion vulnerability (CVE-2026-48282) with a 9.8 CVSS score is being actively exploited. Unauthenticated RCE allows full server takeover. Patch immediately! #Adobe #ColdFusion #CyberSecurity #RCE

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/critical-adobe-coldfusion-flaw-actively-exploited-in-the-wild/?utm_source=mastodon&utm_mediu…

Recent events include heightened geopolitical tensions as the U.S. launched strikes on Iran following attacks in the Strait of Hormuz, pushing oil prices higher. In cybersecurity, Sysdig reported the first end-to-end AI agent ransomware attack, dubbed "JADEPUFFER." Additionally, CISA issued a warning regarding active exploitation of a critical Adobe ColdFusion vulnerability (CVE-2026-48282).

#AnonNews_irc #Cybersecurity #News

Poc for CVE-2026-48282, a path traversal vulnerability in Adobe ColdFusion's Remote Development Service (RDS) https://github.com/imbas007/CVE-2026-48282

🚨 CVE-2026-48282: PoC Path traversal vulnerability in Adobe ColdFusion's Remote Development Service (RDS) with a CVSS score of 10.0

GitHub: https://github.com/imbas007/CVE-2026-48282

CVE ID: CVE-2026-48282
Vendor: Adobe
Product: ColdFusion
Date Added: 2026-07-07
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48282

Geopolitical: The NATO Summit commenced in Ankara on July 7, addressing defense spending and new air power deals. Ukraine executed long-range drone strikes on Russia's Omsk refinery on July 7. Cybersecurity: A critical Adobe ColdFusion vulnerability (CVE-2026-48282) is being actively exploited. A Linux 'Bad Epoll' root exploit (CVE-2026-46242) has also been publicly released. Technology: The UN Global Dialogue on AI Governance started July 6 in Geneva. Microsoft announced 4,800 job cuts, notably affecting its Xbox division, on July 6.

#AnonNews_irc #Cybersecurity #News

"Attackers are now exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, according to vulnerability intelligence company KEVIntel.“

https://www.bleepingcomputer.com/news/security/max-severity-adobe-coldfusion-flaw-now-exploited-in-attacks/

‼️ New Dark Web Informer Blog Post!

Title: Adobe ColdFusion flaw CVE-2026-48282 is now being Exploited in the Wild

Link: https://darkwebinformer.com/adobe-coldfusion-flaw-cve-2026-48282-is-now-being-exploited-in-the-wild/

Adobe ColdFusion está sob ataque informático devido a uma vulnerabilidade classificada com o grau máximo de severidade, identificada como CVE-2026-48282. A plataforma de desenvolvimento web está a ser explorada ativamente por agentes maliciosos.

🔗 https://tugatech.com.pt/t86863-adobe-coldfusion-sob-ataque-informatico-obriga-a-correcao-imediata-de-sistemas

#adobe #ataque 

Max severity Adobe ColdFusion flaw now exploited in attacks

Attackers are now exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, the Canadian Center for Cyber Security...

🔗️ [Bleepingcomputer] https://link.is.it/dtvaMC

CVE-2026-33264: Apache Airflow <3.3.0 has a CRITICAL deserialization flaw. DAG authors can trigger remote code execution on Scheduler/API Server. Upgrade to 3.3.0+ and restrict allowed_deserialization_classes. Details: https://radar.offseq.com/threat/cve-2026-33264-cwe-502-deserialization-of-untruste-8bbc1aa55d6c3415 #OffSeq #Airflow #Infosec #CVE202633264

@tugatech é preciso avisar as pessoas disto: https://discourse.ifin.network/t/cve-2026-11405-multiple-tenda-routers-have-an-admin-backdoor/646

Tenda Routers Expose Admin Access via Hidden Backdoor

Tenda routers have a shocking security flaw: a hidden backdoor that can give attackers full control of your device, allowing them to hijack your admin access. This vulnerability, tracked as CVE-2026-11405, lets hackers easily bypass standard login security and take over your router.

https://osintsights.com/tenda-routers-expose-admin-access-via-hidden-backdoor?utm_source=mastodon&utm_medium=social

#Tenda #Cve202611405 #RouterBackdoor #AdminAccess #EmergingThreats

@tugatech é preciso avisar as pessoas disto: https://discourse.ifin.network/t/cve-2026-11405-multiple-tenda-routers-have-an-admin-backdoor/646

‼️ New Dark Web Informer Blog Post!

Title: When the Password Check Fails, You're In: The Hidden Admin Backdoor in Tenda Router Firmware (CVE-2026-11405)

Link: https://darkwebinformer.com/when-the-password-check-fails-youre-in-the-hidden-admin-backdoor-in-tenda-router-firmware-cve-2026-11405/

CVE-2026-11405 is a Tenda authentication backdoor. It allows full administrative access without valid credentials. Protect your network with these steps.

#CVE202611405 #Tenda #AuthenticationBackdoor #CyberSecurity #RouterSecurity

https://securityonline.info/cve-2026-11405-tenda-authentication-backdoor/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-56843 (CRITICAL, CVSS 9.9): WebPros Plesk <18.0.78.4 has insufficient auth in XML-RPC API, letting low-privileged users access other tenants’ cleartext FTP creds & run code as them. Restrict API access & monitor. https://radar.offseq.com/threat/cve-2026-56843-cwe-522-insufficiently-protected-cr-45d7ae62ed3d3640 #OffSeq #Infosec #Plesk

CVE-2026-56843 (CRITICAL, CVSS 9.9): WebPros Plesk <18.0.78.4 has insufficient auth in XML-RPC API, letting low-privileged users access other tenants’ cleartext FTP creds & run code as them. Restrict API access & monitor. https://radar.offseq.com/threat/cve-2026-56843-cwe-522-insufficiently-protected-cr-45d7ae62ed3d3640 #OffSeq #Infosec #Plesk

CVE-2026-14380 | CRITICAL eval injection in HMBRAND DBI <1.650 lets attackers execute arbitrary Perl code via Profile. Remote code exec possible with exposed DBI::Gofer/ProxyServer. Restrict access & monitor for patches. https://radar.offseq.com/threat/cve-2026-14380-cwe-95-improper-neutralization-of-d-632b564b1d788778 #OffSeq #Perl #Security

CVE-2026-14380 | CRITICAL eval injection in HMBRAND DBI <1.650 lets attackers execute arbitrary Perl code via Profile. Remote code exec possible with exposed DBI::Gofer/ProxyServer. Restrict access & monitor for patches. https://radar.offseq.com/threat/cve-2026-14380-cwe-95-improper-neutralization-of-d-632b564b1d788778 #OffSeq #Perl #Security

topoteretes cognee (<1.2.0) is affected by CVE-2026-58473 (CRITICAL, CVSS 9.3): improper access control lets unauth attackers overwrite LLM provider config & exfiltrate sensitive data. Restrict endpoint, monitor configs. https://radar.offseq.com/threat/cve-2026-58473-missing-authorization-in-topoterete-619eb25f0ae3e3eb #OffSeq #CVE #Infosec

topoteretes cognee (<1.2.0) is affected by CVE-2026-58473 (CRITICAL, CVSS 9.3): improper access control lets unauth attackers overwrite LLM provider config & exfiltrate sensitive data. Restrict endpoint, monitor configs. https://radar.offseq.com/threat/cve-2026-58473-missing-authorization-in-topoterete-619eb25f0ae3e3eb #OffSeq #CVE #Infosec

🚨 [CISA-2026:0707] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0707)

CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48908 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48908)
- Name: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JoomShaper
- Product: SP Page Builder
- Notes: https://extensions.joomla.org/extension/sp-page-builder/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48908

⚠️ CVE-2026-55255 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-55255)
- Name: Langflow Authorization Bypass Through User-Controlled Key Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-55255

⚠️ CVE-2026-56290 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56290)
- Name: Joomlack Page Builder Improper Access Control Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Joomlack
- Product: Page Builder
- Notes: https://www.joomlack.fr/en/joomla-extensions/page-builder-ck ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56290

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260707 #cisa20260707 #cve_2026_48908 #cve_2026_55255 #cve_2026_56290 #cve202648908 #cve202655255 #cve202656290

CVE ID: CVE-2026-48908
Vendor: JoomShaper
Product: SP Page Builder
Date Added: 2026-07-07
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48908

CISA has updated the KEV catalogue.

- CVE-2026-56290: Joomlack Page Builder Improper Access Control Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-56290

- CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-55255

- CVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48908

Several industrial vulnerabilities: https://www.cisa.gov/ #infosec #vulnerability #CISA

🚨 [CISA-2026:0707] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0707)

CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48908 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48908)
- Name: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JoomShaper
- Product: SP Page Builder
- Notes: https://extensions.joomla.org/extension/sp-page-builder/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48908

⚠️ CVE-2026-55255 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-55255)
- Name: Langflow Authorization Bypass Through User-Controlled Key Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-55255

⚠️ CVE-2026-56290 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56290)
- Name: Joomlack Page Builder Improper Access Control Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Joomlack
- Product: Page Builder
- Notes: https://www.joomlack.fr/en/joomla-extensions/page-builder-ck ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56290

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260707 #cisa20260707 #cve_2026_48908 #cve_2026_55255 #cve_2026_56290 #cve202648908 #cve202655255 #cve202656290

CVE ID: CVE-2026-48908
Vendor: JoomShaper
Product: SP Page Builder
Date Added: 2026-07-07
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48908

CISA has updated the KEV catalogue.

- CVE-2026-56290: Joomlack Page Builder Improper Access Control Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-56290

- CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-55255

- CVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48908

Several industrial vulnerabilities: https://www.cisa.gov/ #infosec #vulnerability #CISA

🟠 New security advisory:

CVE-2026-23697 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-23697-vtiger-crm-rce-via-phar-upload-poc

#CVE #ZeroDay #ThreatIntel

BeyondTrust patched a critical pre-authentication vulnerability (CVE-2026-40138, CVE-2026-40139, CVE-2026-40140). Update Remote Support instances now.

#BeyondTrust #Vulnerability #CVE202640138 #CyberSecurity #RemoteSupport

https://securityonline.info/cve-2026-40138-beyondtrust-pre-authentication-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

BeyondTrust patched a critical pre-authentication vulnerability (CVE-2026-40138, CVE-2026-40139, CVE-2026-40140). Update Remote Support instances now.

#BeyondTrust #Vulnerability #CVE202640138 #CyberSecurity #RemoteSupport

https://securityonline.info/cve-2026-40138-beyondtrust-pre-authentication-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

‼️ New Dark Web Informer Blog Post!

Title: Pre-Auth Access-Control Bypass in BeyondTrust Remote Support and PRA (CVE-2026-40138)

Link: https://darkwebinformer.com/pre-auth-access-control-bypass-in-beyondtrust-remote-support-and-pra-cve-2026-40138/

BeyondTrust patched a critical pre-authentication vulnerability (CVE-2026-40138, CVE-2026-40139, CVE-2026-40140). Update Remote Support instances now.

#BeyondTrust #Vulnerability #CVE202640138 #CyberSecurity #RemoteSupport

https://securityonline.info/cve-2026-40138-beyondtrust-pre-authentication-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

CRITICAL: Gitea Docker (<1.26.3) is vulnerable to auth bypass (CVE-2026-20896) — attackers can access repos & secrets by spoofing a username header. Actively exploited! Patch to 1.26.3+ & restrict access now. https://radar.offseq.com/threat/critical-gitea-flaw-under-active-exploitation-rese-c58d67a324be5e40 #OffSeq #Gitea #Vuln #Infosec

🚨 Critical Gitea flaw CVE-2026-20896 is being probed in the wild

Researchers warn that attackers are targeting a critical Gitea Docker image flaw that can allow authentication bypass with a single HTTP header.

The issue affects official Gitea Docker images up to 1.26.2 when reverse-proxy authentication is enabled.

The vulnerable default trusted any source IP as a reverse proxy, meaning an attacker who could reach the container’s HTTP port could spoof X-WEBAUTH-USER and impersonate a known or guessable user.

Gitea patched the issue in 1.26.3 / 1.26.4, and a public PoC/checker is now available.

Sysdig says the first in-the-wild probing was seen 13 days after disclosure.

Observed IP: 159[.]26[.]98[.]241

CRITICAL: Gitea Docker (<1.26.3) is vulnerable to auth bypass (CVE-2026-20896) — attackers can access repos & secrets by spoofing a username header. Actively exploited! Patch to 1.26.3+ & restrict access now. https://radar.offseq.com/threat/critical-gitea-flaw-under-active-exploitation-rese-c58d67a324be5e40 #OffSeq #Gitea #Vuln #Infosec

🚨 Critical Gitea flaw CVE-2026-20896 is being probed in the wild

Researchers warn that attackers are targeting a critical Gitea Docker image flaw that can allow authentication bypass with a single HTTP header.

The issue affects official Gitea Docker images up to 1.26.2 when reverse-proxy authentication is enabled.

The vulnerable default trusted any source IP as a reverse proxy, meaning an attacker who could reach the container’s HTTP port could spoof X-WEBAUTH-USER and impersonate a known or guessable user.

Gitea patched the issue in 1.26.3 / 1.26.4, and a public PoC/checker is now available.

Sysdig says the first in-the-wild probing was seen 13 days after disclosure.

Observed IP: 159[.]26[.]98[.]241

Gitea Docker Images Vulnerable to Critical Authentication Bypass, Already Attacked

Gitea patched a critical authentication bypass vulnerability (CVE-2026-20896) in its Docker images that allows attackers to impersonate any user with a single HTTP header. The flaw is being exploited in the wild.

**If you self-host Gitea, first make sure it's isolated from the internet and reachable only from trusted networks, then update to version 1.26.3 or later ASAP. If you can't update immediately, edit your app.ini to change REVERSE_PROXY_TRUSTED_PROXIES from * to your actual reverse proxy's specific IP address, and rotate all credentials and secrets stored in your repositories.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/gitea-docker-images-vulnerable-to-critical-authentication-bypass-already-attacked-c-9-8-p-p/gD2P6Ple2L

🔴 CVE-2026-20896 - Critical (9.8)

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20896/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71364 - High (8.1)

picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce methods, allowing remote code execution. Attackers can craft malicious pickle files embedding this built-in function that ev...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71364/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-12375 (CRITICAL): uncanny-automator-pro v7.3.0.5 distributed with a hidden backdoor due to vendor supply chain compromise. Attackers can gain admin access & exfiltrate secrets. Remove/disable this version now. https://radar.offseq.com/threat/cve-2026-12375-cwe-912-hidden-functionality-in-unc-f847b0208ffd2506 #OffSeq #WordPress #SupplyChain

CVE-2026-4375: CRITICAL code injection (CWE-94) in DoLeads Integrator & wp2epub WordPress plugins ≤0.65 allows RCE by unauthorized users. No patch yet — restrict plugin installs & monitor for changes. https://radar.offseq.com/threat/cve-2026-4375-cwe-94-improper-control-of-generatio-71c36276dd5a5ffb #OffSeq #WordPress #CVE20264375

Dell PowerProtect Data Domain is affected by CRITICAL path traversal (CVE-2026-53481, CVSS 9.8). Remote, unauthenticated attackers can gain full system control. No patch yet — monitor Dell advisories. https://radar.offseq.com/threat/cve-2026-53481-cwe-22-improper-limitation-of-a-pat-89b94eec9af59b79 #OffSeq #Dell #CVE202653481 #infosec

🟠 CVE-2026-57985 - High (7.6)

Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57985/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-34037: CRITICAL auth bypass in coollabsio coolify (=4.0.0-beta.464). Privileged users can clone resources into other teams, risking cross-tenant data exposure. Fix: upgrade to 4.0.0-beta.464. https://radar.offseq.com/threat/cve-2026-34037-cwe-639-authorization-bypass-throug-4bc62cd3de2ba764 #OffSeq #Vuln #coolify #Infosec

🟠 CVE-2026-58290 - High (7.5)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58290/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56645 - High (8.8)

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42200 - High (8.8)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scripts() method in app/Actions/Database/StartPostgresql.php) filename han...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42200/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-53913 | CRITICAL | Apache Camel Keycloak: Default KeycloakSecurityPolicy skips token verification, enabling unauthenticated access and possible RCE on 4.15.0 – 4.18.2 & 4.19.0 – 4.20.x. Upgrade to 4.21.0/4.18.3. https://radar.offseq.com/threat/cve-2026-53913-cwe-287-improper-authentication-in--29482412e19e3f00 #OffSeq #ApacheCamel #CVE202653913

🟠 CVE-2026-57992 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57992/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58287 - High (8.3)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58293 - High (8.1)

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58293/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58295 - High (8.3)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58295/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-14345 - Critical (9.8)

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsan...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14345/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58284 - High (8.3)

Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

WatchGuard Patches Third Critical IKEv2 RCE in Firebox Appliances

WatchGuard patched a critical pre-authentication RCE vulnerability (CVE-2026-13368) in Firebox appliances. The vulnerability allows unauthenticated attackers to gain administrative control. Legacy T15 and T35 models currently do not have a patch.

**If you use WatchGuard Firebox firewalls, read the advisory in detail. Plan a very quick update to Fireware OS 2026.2.1 or 12.12.1. If you run legacy T15/T35 models, disable external LDAP authentication for IKEv2 as a temporary fix, and if you're on version 11.x, migrate to supported hardware since no patch is coming.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/watchguard-patches-third-critical-ikev2-rce-in-firebox-appliances-l-z-o-j-u/gD2P6Ple2L

🟠 CVE-2025-71343 - High (8.1)

picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in the reduce method. Attackers can craft malicious pickle files with embedded code that evades detection but execu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71343/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-43865 (CRITICAL): Apache Camel Hazelcast component deserializes untrusted data by default, enabling RCE if attacker accesses the cluster. Patch: 4.21.0, 4.18.3, or 4.14.8. Harden configs if upgrade isn't possible. https://radar.offseq.com/threat/cve-2026-43865-cwe-502-deserialization-of-untruste-d2e34a1a7ce10b73 #OffSeq #CVE #ApacheCamel

🟠 CVE-2026-22555 - High (8.1)

Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22555/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71347 - High (8.1)

picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.param_eval function in reduce methods, allowing attackers to bypass security checks. Remote attackers can embed undetected code in pickle files that exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71347/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4967 - High (7.5)

In IMS, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4967/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-13768 - Critical (10)

Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13768/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-59509 (CRITICAL): cve-search POST /fetch_cve_data allows unauth'd access to arbitrary MongoDB collections, exposing admin creds for offline cracking. Restrict endpoint, monitor activity, check vendor updates. https://radar.offseq.com/threat/ghsa-3fmp-59v6-4qw2-ddbb46f84ba1bbe2 #OffSeq #infosec #CVE202659509

CVE-2026-14803: HIGH severity vuln in Mojo::JSON <9.47 — pure-Perl decoder allows uncontrolled recursion. Apps may face DoS if Cpanel::JSON::XS isn’t enabled. Install XS module or limit JSON depth. https://radar.offseq.com/threat/cve-2026-14803-cwe-674-uncontrolled-recursion-in-s-622d5e94b9c3bd9b #OffSeq #infosec #Perl #DoS

🟠 CVE-2025-71373 - High (8.1)

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Adiss Biloop v6.1.1: CRITICAL CVE-2026-12686 enables authenticated users to bypass authorization via manipulated company ID, exposing cross-tenant data. Monitor logs and limit exposure while awaiting patch. https://radar.offseq.com/threat/cve-2026-12686-cwe-639-authorization-bypass-throug-3166bcbbfec7c2c9 #OffSeq #CVE202612686 #infosec #vuln

CVE-2026-48614 - Critical arbitrary file write as root in Plesk XML API. CVSS 9.9. No patch available. Apply workarounds immediately. #CVE #Plesk #infosec

https://www.valtersit.com/cve/CVE-2026-48614/

🟠 CVE-2025-71342 - High (8.1)

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes during pickle.load, enabling remote code execution in PyTorch ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71342/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71369 - High (8.1)

picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basichandlers in reduce methods, allowing attackers to bypass safety checks. Remote attackers can embed undetected malicious code in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71369/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71362 - High (8.1)

picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbitrary strings. Attackers can embed malicious code in pickle files that executes when loaded from untrusted sources.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71356 - High (8.1)

picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pickle files. Attackers can embed undetected code in pickle files that executes remote code when loaded ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71356/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58424 - High (8.9)

Permanent Fork PR Workflow Approval Gate Bypass

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58424/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58423 - High (7.7)

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58423/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28699 - High (8.1)

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28699/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4321 - Critical (9.8)

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency Destekz allows SQL Injection.

This issue affects Destekz: through 02062026. NOTE: The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4321/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9085 - High (8.8)

Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing.

This issue affects Pardus-Parental-Control: from ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9085/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6509 - High (7.8)

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Privilege Escalation.

This issue affects Pardus Update: from &lt;=0.6.3 before 0.6.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6509/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-14570: HIGH severity in TIMLEGGE Crypt::DSA (<1.22) — insufficiently random values in DSA signing allow attackers to recover private keys using lattice attacks. Replace all affected keys and upgrade to 1.22+. https://radar.offseq.com/threat/cve-2026-14570-cwe-330-use-of-insufficiently-rando-539cd2ae349f5a7a #OffSeq #Vuln #Perl #Crypto

SQL injection (MEDIUM, CVE-2026-14751) in mjperpinosa stumasy: All versions at risk via Notes_controller::search_scratch_data. No patch yet, public exploit exists. Sanitize field_name & restrict access. Details: https://radar.offseq.com/threat/cve-2026-14751-sql-injection-in-mjperpinosa-stumas-6dc8c79135cda9b5 #OffSeq #SQLInjection #Vulnerability #AppSec

CVE-2026-14807: CRITICAL hard-coded credentials in PROG MIS ERP App allow unauthenticated remote access to source code & DB creds. No patch available — restrict access & monitor activity. CVSS 9.3 https://radar.offseq.com/threat/cve-2026-14807-cwe-798-use-of-hard-coded-credentia-f736ee8ed603a6fe #OffSeq #CVE202614807 #ERP #infosec

PROG MIS Prog Management System hit with CRITICAL vuln (CVE-2026-14808): unauthenticated attackers can access DB user & password. No patch yet — limit access & monitor systems. Details: https://radar.offseq.com/threat/cve-2026-14808-cwe-497-exposure-of-sensitive-syste-326a6d8e79a35bf1 #OffSeq #CVE202614808 #Vuln #InfoSec

CVE-2026-59510: ail-framework ≤6.9.0 has a HIGH path traversal flaw 🗂️. Authenticated attackers can access sensitive files outside the PDF dir. Restrict PDF ops access & monitor activity. Patch when released. https://radar.offseq.com/threat/cve-2026-59510-cwe-22-improper-limitation-of-a-pat-adb7f29895187030 #OffSeq #vulnerability #pathtraversal

🟠 CVE-2026-12250 - High (7.9)

Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Domain Joiner allows Excavation.

This issue affects Pardus Domain Joiner: from 0.5.2 before 0.5.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-14738 (MEDIUM, CVSS 6.3) impacts exo-explore exo ≤1.0.71. Weak hash in Vision Feature Cache, remote exploit released, high complexity. Patch pending. Review deployments & monitor for updates. https://radar.offseq.com/threat/cve-2026-14738-use-of-weak-hash-in-exo-explore-exo-d776a3211767a5cf #OffSeq #Vulnerability #CVE202614738 #Infosec

UTT HiPER 1250GW (v3.2.7-210907-180535) hit by HIGH severity stack buffer overflow (CVE-2026-14721). Remote code execution possible via 'ssid' in /goform/ConfigWirelessBase_5g. No patch — restrict access. https://radar.offseq.com/threat/cve-2026-14721-stack-based-buffer-overflow-in-utt--61b09d8093b25eb2 #OffSeq #CVE #Infosec #NetSec

🟠 CVE-2026-14721 - High (8.8)

A vulnerability has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. This affects an unknown function of the file /goform/ConfigWirelessBase_5g of the component Web Endpoint. The manipulation of the argument ssid leads to stack-based buff...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14721/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-14781 (MEDIUM): Red Hat Build of Keycloak flaw in OIDC broker email_verified claim sync. If trustEmail=true & userinfo enabled, attacker can mark emails as verified. Review config & monitor fixes. https://radar.offseq.com/threat/cve-2026-14781-improper-validation-of-consistency--d19be74f7ead5808 #OffSeq #Keycloak #Vuln #IAM

SQL injection (MEDIUM severity) found in itsourcecode Hospital Management System 1.0 via 'editid' in /patientorder.php (CVE-2026-14703). No patch yet — enforce input validation & parameterized queries. https://radar.offseq.com/threat/cve-2026-14703-sql-injection-in-itsourcecode-hospi-f942c28e535ca531 #OffSeq #SQLInjection #Vuln #HealthcareIT

CVE-2026-14691 (MEDIUM): SourceCodester Multi-Vendor Online Grocery Management System 1.0 is vulnerable to remote code injection via update_settings_info in SystemSettings.php. Exploit is public. Monitor & restrict access until fix released. https://radar.offseq.com/threat/cve-2026-14691-code-injection-in-sourcecodester-mu-dfa4f0d89d3ba2d7 #OffSeq #Vuln #AppSec

🟠 CVE-2026-14637 - High (8.2)

A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affected element is the function getCartItems in the library application/libraries/ShoppingCart.php. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14637/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14534 - High (8.8)

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickli...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14534/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14535 - High (8.8)

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsafe. This...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14535/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-53360: Linux kernel KVM SEV-SNP HIGH vuln allows SEV-SNP guests OOB read/write on host heap memory 🐧. Heap corruption & info leaks possible. Patch status unclear — avoid untrusted guests & check advisories. https://radar.offseq.com/threat/ghsa-4pq2-jh73-g3hw-1f03f05c22f6fb26 #OffSeq #Linux #Vuln

Geopolitical: The NATO Summit commenced in Ankara on July 7, addressing defense spending and new air power deals. Ukraine executed long-range drone strikes on Russia's Omsk refinery on July 7. Cybersecurity: A critical Adobe ColdFusion vulnerability (CVE-2026-48282) is being actively exploited. A Linux 'Bad Epoll' root exploit (CVE-2026-46242) has also been publicly released. Technology: The UN Global Dialogue on AI Governance started July 6 in Geneva. Microsoft announced 4,800 job cuts, notably affecting its Xbox division, on July 6.

#AnonNews_irc #Cybersecurity #News

⚠️ CRITICAL: Proof-of-Concept Exploit Released for Linux ‘Bad Epoll’ Root Access Vulnerability

A public proof-of-concept exploit is now available for CVE-2026-46242, a race-condition use-after-free bug in the Linux kernel epoll facility that allows unprivileged local processes to escalate to root. This affects kernel versions 6.4 and newer, including Android devices. Any system running vulne…

https://threatnoir.com/focus

#infosec #cybersecurity

The new Linux kernel threat that outsmarted AI: Bad Epoll! 🚨

Discover the deep technical mechanics of CVE-2026-46242, how it escapes Chrome's sandbox to gain root, and its critical impact on Android/Linux systems. 👇

🔗 https://denizhalil.com/2026/07/06/bad-epoll-cve-2026-46242-linux-kernel-flaw/

#linux #CyberSecurity #CVE202646242

📰 New 'Bad Epoll' Linux Kernel Zero-Day (CVE-2026-46242) Grants Full Root Access

🚨 CRITICAL ZERO-DAY: 'Bad Epoll' (CVE-2026-46242) in Linux Kernel allows any local user to gain full root access. The use-after-free bug affects servers, desktops & Android. PoC exists. Patch immediately! 🐧💥 #Linux #CyberSecurity #ZeroDay #Infosec

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/bad-epoll-linux-kernel-zero-day-allows-root-access/?utm_source=mastodon&utm…

A critical Bad Epoll vulnerability (CVE-2026-46242) allows local users to gain root access on Linux and Android devices. Patch your systems immediately.

#LinuxSecurity #BadEpoll #CyberSecurity #ZeroDay #CVE202646242

https://meterpreter.org/bad-epoll-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

Here's a summary of the latest geopolitical, technology, and cybersecurity news:

Geopolitics: Russian President Putin and U.S. President Trump held a 90-minute call on July 4th. Russia claims to have captured Kostyantynivka in eastern Donetsk, Ukraine.
Technology: Grok 4.5 has entered private beta at SpaceX/Tesla. Meta plans to rent out its AI computing power. Micron is expanding high-bandwidth memory (HBM) production in Japan. Five Eyes alliance warns AI-fueled cyberattacks are "months away."
Cybersecurity: A critical "Bad Epoll" Linux kernel flaw (CVE-2026-46242) allows root access on Linux/Android. AI-automated JadePuffer ransomware has been detected. Lazarus Group is pushing 108 malicious packages.

#AnonNews_irc #Cybersecurity #News

Bad Epoll: Inside CVE-2026-46242, the Race Condition an AI Model Read Right Past

https://thecybersecguru.com/exploits/cve-2026-46242-bad-epoll-linux-vulnerability/

Bad Epoll (CVE-2026-46242) https://lobste.rs/s/drf6my #linux #security
https://github.com/J-jaeyoung/bad-epoll

🚨 Bad Epoll (CVE-2026-46242) has been identified as a notable vulnerability.

In the Linux kernel, the following vulnerability has been resolved:

eventpoll: fix ep_remove struct eventpoll / struct file UAF

ℹ️ Additional information on ZEN SecDB:

- BadEpoll: https://secdb.nttzen.cloud/updates/79198418-b310-4e40-80cd-d98ba3da0b2a/bad-epoll-vulnerability
- CVE details, sightings and advisories: https://secdb.nttzen.cloud/cve/detail/CVE-2026-46242

#InfoSec #BadEpoll #CVE202646242 #Linux #Kernel
#NTTDATA #Zen #SecDB #VulnerabilityIntelligence #Security

New “Bad Epoll” Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android

A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets an ordinary user with no special access…
#NewsBeep #News #US #USA #UnitedStates #UnitedStatesOfAmerica #Technology
https://www.newsbeep.com/us/742153/

🟠 CVE-2026-12252 - High (7.8)

In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These cla...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12252/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-54424 - High (8.4)

An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54424/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71353 - High (8.1)

picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get function in reduce methods. Attackers can craft pickle files with embedded code that evades picklescan detection and executes arbitr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71353/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71345 - High (8.1)

picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_autograd_prof function. Attackers can embed undetected code in pickle files that executes during deserialization, enabling remote code ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71345/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71367 - High (8.1)

picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using _operator.attrgetter in reduce methods to execut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71367/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71366 - High (8.1)

picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pickle files, allowing attackers to bypass safety checks. Remote attackers can embed undetected code in pickle files to achieve arbit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71366/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71360 - High (8.1)

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71360/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71380 - High (8.8)

The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71380/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71375 - High (8.1)

picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. Attackers can craft malicious pickle payloads using _operator.methodcaller that evade detection and execute arbitr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71375/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71372 - High (8.1)

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded, bypa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71372/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71359 - High (8.1)

picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code execution. Attackers can craft pickle files embedding dangerous code that evades pickles...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71359/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57974 - High (8.8)

Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57986 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57986/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58283 - High (8.1)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58282 - High (8.1)

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58276 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58276/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-58289 - Critical (9)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58288 - High (8.3)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58286 - High (8.1)

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58285 - High (8.3)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58285/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58299 - High (7.5)

Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58299/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58294 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58294/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58292 - High (7.5)

Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58292/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57975 - High (7.5)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57975/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-12481 - High (8.8)

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12481/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57984 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57984/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57983 - High (8.7)

Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57983/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57981 - High (8.8)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57981/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-14544 - Critical (9.8)

A flaw was found in HPLIP (HP Linux Imaging and Printing Software). This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to escalate privileges or achieve arbitrary code execution. This can occur through an integer ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14544/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14352 - High (7.5)

The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-9725 - Critical (9.1)

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, whic...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9725/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-48931 in Node.js, GitHub rate limiting, age verification bypass PoC. [3/3]

🟠 CVE-2026-14327 - High (7.5)

The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14327/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41106 - Critical (9.3)

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

O Control Web Panel sofre uma falha crítica que exige atualização urgente nos servidores. A vulnerabilidade CVE-2026-57517 permite a execução remota de código sem autenticação prévia. 🚨

🔗 https://tugatech.com.pt/t86933-control-web-panel-sofre-falha-critica-e-exige-atualizacao-urgente-nos-servidores

#control #falha #nos #urgente #web 

O Control Web Panel sofre uma falha crítica que exige atualização urgente nos servidores. A vulnerabilidade CVE-2026-57517 permite a execução remota de código sem autenticação prévia. 🚨

🔗 https://tugatech.com.pt/t86933-control-web-panel-sofre-falha-critica-e-exige-atualizacao-urgente-nos-servidores

#control #falha #nos #urgente #web 

📈 CVE Published in last 7 days (2026-06-29 - 2026-06-29)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 195
- High: 612
- Medium: 729
- Low: 114
- None: 230

Status:
- UNKNOWN: 68
- Analyzed: 534
- Awaiting Analysis: 109
- Deferred: 568
- Modified: 39
- Received: 443
- Rejected: 6
- Undergoing Analysis: 113

CISA KEVs:
- CISA-2026:0629 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0629)
- CISA-2026:0701 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0701)

Top CNAs:
- Chrome: 434
- VulnCheck: 177
- VulDB: 162
- Patchstack: 125
- Wordfence: 96
- GitHub, Inc.: 81
- N/A: 68
- Microsoft Corporation: 49
- IBM Corporation: 43
- Gitea Limited: 40

Top Affected Products:
- UNKNOWN: 1234
- Google Chrome: 401
- Geovision Inc. Geowebplayer: 16
- Imagemagick: 13
- Langflow: 11
- Nvidia Nemo Megatron Bridge: 11
- Adobe Coldfusion: 10
- Uvnc Ultravnc: 9
- Apache Activemq: 9
- Ibm Websphere Application Server: 8

Top EPSS Score:
- CVE-2026-27771 - 40.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27771)
- CVE-2026-13773 - 3.41 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13773)
- CVE-2026-56413 - 3.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56413)
- CVE-2026-56415 - 3.07 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56415)
- CVE-2026-56782 - 3.02 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56782)
- CVE-2026-13545 - 2.71 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13545)
- CVE-2026-58452 - 2.42 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58452)
- CVE-2026-58453 - 1.69 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58453)
- CVE-2026-56700 - 1.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56700)
- CVE-2026-58457 - 1.67 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58457)

#ZEN #SecDB #InfoSec

CRITICAL: Ubiquiti UniFi OS hit by 7 flaws, incl. CVE-2026-50746 (command injection) in UniFi Connect ≤3.4.16. Exploitable w/ network access, no user interaction. Update to 3.4.20+ ASAP. No in-the-wild exploits yet. https://radar.offseq.com/threat/ubiquiti-warns-of-new-max-severity-unifi-os-vulner-d14602d3f7d74505 #OffSeq #Ubiquiti #Infosec #CVE202650746

CRITICAL: Ubiquiti UniFi OS hit by 7 flaws, incl. CVE-2026-50746 (command injection) in UniFi Connect ≤3.4.16. Exploitable w/ network access, no user interaction. Update to 3.4.20+ ASAP. No in-the-wild exploits yet. https://radar.offseq.com/threat/ubiquiti-warns-of-new-max-severity-unifi-os-vulner-d14602d3f7d74505 #OffSeq #Ubiquiti #Infosec #CVE202650746

Ubiquiti's UniFi security advisory 066 patches 25 flaws, including a critical command injection (CVE-2026-50746) scoring 10.0. Update your devices now.

#Ubiquiti #UniFi #UniFiOS #UniFiProtect #CommandInjection #CyberSecurity

https://securityonline.info/unifi-security-advisory-066/?utm_source=mastodon&utm_medium=jetpack_social

🤖 Researchers at runZero say AI-assisted testing found 7 security flaws in the FatFs FAT/exFAT filesystem library (CVE-2026-6682 to CVE-2026-6688), potentially exposing millions of embedded devices via malicious USB drives/SD cards—and sometimes OTA update paths. 🔓📉 https://cyberinsider.com/ai-helps-find-flaws-in-fatfs-library-used-in-millions-of-devices/ #cybersecurity #IoT #vulnerabilities #embedded

🤖 Researchers at runZero say AI-assisted testing found 7 security flaws in the FatFs FAT/exFAT filesystem library (CVE-2026-6682 to CVE-2026-6688), potentially exposing millions of embedded devices via malicious USB drives/SD cards—and sometimes OTA update paths. 🔓📉 https://cyberinsider.com/ai-helps-find-flaws-in-fatfs-library-used-in-millions-of-devices/ #cybersecurity #IoT #vulnerabilities #embedded

🧩 Runzero warnt: Eine KI-gestützte Suche fand eine gefährliche Lücke im FatFs-Treiber. Schon das Anschließen eines USB-Sticks soll genügen, um über CVE-2026-6682 (CVSS 7,6) Schadcode einzuschleusen. Patch derzeit unklar. Angriff auch via manipulierte OTA-Updates möglich. 🔥
https://www.golem.de/news/angriff-per-usb-stick-ki-findet-gefaehrliche-luecke-in-populaerem-fatfs-treiber-2607-210484.html
#Security #IoT #Embedded #USB #CVE #Vulnerability

Dirty Clone – kolejny sposób na roota pod Linuksem

Nie tak dawno pisaliśmy o serii podatności Dirty Frag występujących w większości nowoczesnych dystrybucji Linuksa. I choć mogłoby się wydawać, że deweloperzy naprawili błędy, to najnowsze badania pokazują, że problem nie został jednak wyeliminowany. W jądrze pozostała bowiem niezałatana luka, którą badacze z JFrog ochrzcili mianem Dirty Clone (CVE-2026-43503). Podobnie...

#Aktualności #Eskalacja #Hacking #Kernel #Linux #LocalRoot #Lpe #PageCache

https://sekurak.pl/dirty-clone-kolejny-sposob-na-roota-pod-linuksem/

Dissecting and Exploiting Linux LPE Variant: DirtyClone (CVE-2026-43503) https://lobste.rs/s/adgyhb #linux #security
https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/

🚨 CVE-2026-10104 PoC published

GitHub: https://github.com/Ravi-lk/CVE-2026-10104-POC

A PoC is available for an authenticated stored XSS issue in Product Video Gallery for WooCommerce.

The flaw affects older versions of the WordPress plugin and can allow JavaScript execution on public product pages after a user with product-editing access injects the payload.

Fixed in 1.5.1.9.

📈 CVE Published in last 7 days (2026-06-29 - 2026-06-29)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 195
- High: 612
- Medium: 729
- Low: 114
- None: 230

Status:
- UNKNOWN: 68
- Analyzed: 534
- Awaiting Analysis: 109
- Deferred: 568
- Modified: 39
- Received: 443
- Rejected: 6
- Undergoing Analysis: 113

CISA KEVs:
- CISA-2026:0629 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0629)
- CISA-2026:0701 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0701)

Top CNAs:
- Chrome: 434
- VulnCheck: 177
- VulDB: 162
- Patchstack: 125
- Wordfence: 96
- GitHub, Inc.: 81
- N/A: 68
- Microsoft Corporation: 49
- IBM Corporation: 43
- Gitea Limited: 40

Top Affected Products:
- UNKNOWN: 1234
- Google Chrome: 401
- Geovision Inc. Geowebplayer: 16
- Imagemagick: 13
- Langflow: 11
- Nvidia Nemo Megatron Bridge: 11
- Adobe Coldfusion: 10
- Uvnc Ultravnc: 9
- Apache Activemq: 9
- Ibm Websphere Application Server: 8

Top EPSS Score:
- CVE-2026-27771 - 40.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27771)
- CVE-2026-13773 - 3.41 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13773)
- CVE-2026-56413 - 3.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56413)
- CVE-2026-56415 - 3.07 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56415)
- CVE-2026-56782 - 3.02 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56782)
- CVE-2026-13545 - 2.71 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13545)
- CVE-2026-58452 - 2.42 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58452)
- CVE-2026-58453 - 1.69 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58453)
- CVE-2026-56700 - 1.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56700)
- CVE-2026-58457 - 1.67 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58457)

#ZEN #SecDB #InfoSec

Here's a brief on recent geopolitical, technology, and cybersecurity developments:

Geopolitically, Russia claims control of Kostyantynivka in Ukraine, and Presidents Putin and Trump discussed Ukraine ahead of the upcoming NATO summit. In technology, Amazon launched its satellite internet service to compete with Starlink, and Alibaba banned Anthropic AI usage amidst a data dispute. Cybersecurity noted a US government entity paid $1 million in a data-theft extortion, while a critical SharePoint RCE (CVE-2026-45659) is actively exploited. AI-powered phishing and scams are also targeting the World Cup 2026.

#AnonNews_irc #Cybersecurity #News

Geopolitical: US-Iran talks paused for funeral (July 4-5, 2026). Ukraine's Zelenskiy and Trump discussed the Russia-Ukraine war.

Technology: SK Telecom plans a 15GW AI data center in Asia (July 5, 2026). OpenAI reportedly eyes US government equity.

Cybersecurity: CISA urged patching an actively exploited SharePoint RCE (CVE-2026-45659) by July 4, 2026. Ransomware attacks typically spike during US holidays. A Homeland Security network (HSIN) breach was reported.

#AnonNews_irc #Cybersecurity #News

BMC patches Control-M command injection flaw CVE-2026-10539, an unauthenticated remote command injection bug rated CVSS 9.5.

#ControlM #CVE202610539 #BMC #CommandInjection

https://securityonline.info/control-m-cve-2026-10539-command-injection/?utm_source=mastodon&utm_medium=jetpack_social

📈 CVE Published in last 7 days (2026-06-29 - 2026-06-29)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 195
- High: 612
- Medium: 729
- Low: 114
- None: 230

Status:
- UNKNOWN: 68
- Analyzed: 534
- Awaiting Analysis: 109
- Deferred: 568
- Modified: 39
- Received: 443
- Rejected: 6
- Undergoing Analysis: 113

CISA KEVs:
- CISA-2026:0629 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0629)
- CISA-2026:0701 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0701)

Top CNAs:
- Chrome: 434
- VulnCheck: 177
- VulDB: 162
- Patchstack: 125
- Wordfence: 96
- GitHub, Inc.: 81
- N/A: 68
- Microsoft Corporation: 49
- IBM Corporation: 43
- Gitea Limited: 40

Top Affected Products:
- UNKNOWN: 1234
- Google Chrome: 401
- Geovision Inc. Geowebplayer: 16
- Imagemagick: 13
- Langflow: 11
- Nvidia Nemo Megatron Bridge: 11
- Adobe Coldfusion: 10
- Uvnc Ultravnc: 9
- Apache Activemq: 9
- Ibm Websphere Application Server: 8

Top EPSS Score:
- CVE-2026-27771 - 40.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27771)
- CVE-2026-13773 - 3.41 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13773)
- CVE-2026-56413 - 3.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56413)
- CVE-2026-56415 - 3.07 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56415)
- CVE-2026-56782 - 3.02 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56782)
- CVE-2026-13545 - 2.71 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13545)
- CVE-2026-58452 - 2.42 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58452)
- CVE-2026-58453 - 1.69 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58453)
- CVE-2026-56700 - 1.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56700)
- CVE-2026-58457 - 1.67 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58457)

#ZEN #SecDB #InfoSec

At least Cisco is undeterred by the news slump over the long July 4 holiday. This is a new advisory:

High-severity CVE-2026-20191: Cisco Catalyst Center Arbitrary File Read Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-catc-file-read-wLH2vf8X @TalosSecurity #infosec #Cisco #vulnerability

CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451) https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451/

📰 CitrixBleed-Like Flaw (CVE-2026-8451) Exploited Within 24 Hours

New CitrixBleed-like flaw CVE-2026-8451 in NetScaler is being exploited in the wild less than 24 hours after disclosure! The bug can leak sensitive memory. Patch and terminate all sessions NOW. 🚨 #Citrix #NetScaler #CyberSecurity #CVE

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/new-citrixbleed-like-flaw-cve-2026-8451-exploited-within-24-hours-of-disclosure/?utm_source=mastodon&utm_…

CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451) https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451/

📈 CVE Published in last 7 days (2026-06-29 - 2026-06-29)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 195
- High: 612
- Medium: 729
- Low: 114
- None: 230

Status:
- UNKNOWN: 68
- Analyzed: 534
- Awaiting Analysis: 109
- Deferred: 568
- Modified: 39
- Received: 443
- Rejected: 6
- Undergoing Analysis: 113

CISA KEVs:
- CISA-2026:0629 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0629)
- CISA-2026:0701 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0701)

Top CNAs:
- Chrome: 434
- VulnCheck: 177
- VulDB: 162
- Patchstack: 125
- Wordfence: 96
- GitHub, Inc.: 81
- N/A: 68
- Microsoft Corporation: 49
- IBM Corporation: 43
- Gitea Limited: 40

Top Affected Products:
- UNKNOWN: 1234
- Google Chrome: 401
- Geovision Inc. Geowebplayer: 16
- Imagemagick: 13
- Langflow: 11
- Nvidia Nemo Megatron Bridge: 11
- Adobe Coldfusion: 10
- Uvnc Ultravnc: 9
- Apache Activemq: 9
- Ibm Websphere Application Server: 8

Top EPSS Score:
- CVE-2026-27771 - 40.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27771)
- CVE-2026-13773 - 3.41 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13773)
- CVE-2026-56413 - 3.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56413)
- CVE-2026-56415 - 3.07 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56415)
- CVE-2026-56782 - 3.02 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56782)
- CVE-2026-13545 - 2.71 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13545)
- CVE-2026-58452 - 2.42 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58452)
- CVE-2026-58453 - 1.69 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58453)
- CVE-2026-56700 - 1.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56700)
- CVE-2026-58457 - 1.67 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58457)