CRITICAL: CVE-2026-129452 impacts DrayTek Vigor2960 v1.5.1.6 – remote command injection via set_table in /cgi-bin/mainfunction.cgi. Upgrade to 1.5.1.7 to mitigate. https://radar.offseq.com/threat/cve-2026-129452-command-injection-in-draytek-vigor2960-b22dbff9e5b9c920 #OffSeq #CVE2026129452 #Infosec #Vulnerability

CRITICAL: CVE-2026-129452 impacts DrayTek Vigor2960 v1.5.1.6 – remote command injection via set_table in /cgi-bin/mainfunction.cgi. Upgrade to 1.5.1.7 to mitigate. https://radar.offseq.com/threat/cve-2026-129452-command-injection-in-draytek-vigor2960-b22dbff9e5b9c920 #OffSeq #CVE2026129452 #Infosec #Vulnerability

D-Link DIR-850L (FW1.20WWb03) faces CRITICAL vulnerability (CVE-2026-129445, CVSS 9.3) 🛑. Hard-coded credentials in /usr/sbin/consolepwd, exploitable with local access. Public exploit out now. Restrict access while awaiting patch. https://radar.offseq.com/threat/cve-2026-129445-hard-coded-credentials-in-d-link-dir-850l-6fe56440618bd5d3 #OffSeq #CVE #RouterSecurity

D-Link DIR-850L (FW1.20WWb03) faces CRITICAL vulnerability (CVE-2026-129445, CVSS 9.3) 🛑. Hard-coded credentials in /usr/sbin/consolepwd, exploitable with local access. Public exploit out now. Restrict access while awaiting patch. https://radar.offseq.com/threat/cve-2026-129445-hard-coded-credentials-in-d-link-dir-850l-6fe56440618bd5d3 #OffSeq #CVE #RouterSecurity

CVE-2026-129450: DrayTek Vigor2960 v1.5.1.6 suffers CRITICAL path traversal (CVSS 9.4) in /cgi-bin/mainfunction.cgi. Public exploits exist. Upgrade to 1.5.1.7 to mitigate. https://radar.offseq.com/threat/cve-2026-129450-path-traversal-in-draytek-vigor2960-1d86aff4c8daf885 #OffSeq #CVE2026129450 #Vuln #Patch

CVE-2026-129450: DrayTek Vigor2960 v1.5.1.6 suffers CRITICAL path traversal (CVSS 9.4) in /cgi-bin/mainfunction.cgi. Public exploits exist. Upgrade to 1.5.1.7 to mitigate. https://radar.offseq.com/threat/cve-2026-129450-path-traversal-in-draytek-vigor2960-1d86aff4c8daf885 #OffSeq #CVE2026129450 #Vuln #Patch

D-Link DSL-6740C faces CRITICAL risk (CVE-2026-129444, CVSS 10): Hard-coded FTP credentials in /etc/templates/ftpd/ftpd_conf.php enable remote unauthenticated access. Public exploit code available. Restrict FTP & monitor activity. https://radar.offseq.com/threat/cve-2026-129444-hard-coded-credentials-in-d-link-dsl-6740c-159df7f86bfb314f #OffSeq #CVE2026129444 #Vuln

D-Link DSL-6740C faces CRITICAL risk (CVE-2026-129444, CVSS 10): Hard-coded FTP credentials in /etc/templates/ftpd/ftpd_conf.php enable remote unauthenticated access. Public exploit code available. Restrict FTP & monitor activity. https://radar.offseq.com/threat/cve-2026-129444-hard-coded-credentials-in-d-link-dsl-6740c-159df7f86bfb314f #OffSeq #CVE2026129444 #Vuln

CVE-2026-129360: Linux Foundation Magma ≤1.9.0 has a HIGH severity auth bypass via X-Magma-Client-Cert-Serial in Obsidian REST. No patch yet — restrict access & monitor for updates. https://radar.offseq.com/threat/a-weakness-has-been-identified-in-linux-foundation-magma-up-to-190-cve-2026-129360-5c26354459a7a35b #OffSeq #Linux #Vuln #InfoSec

CVE-2026-129360: Linux Foundation Magma ≤1.9.0 has a HIGH severity auth bypass via X-Magma-Client-Cert-Serial in Obsidian REST. No patch yet — restrict access & monitor for updates. https://radar.offseq.com/threat/a-weakness-has-been-identified-in-linux-foundation-magma-up-to-190-cve-2026-129360-5c26354459a7a35b #OffSeq #Linux #Vuln #InfoSec

CVE-2026-129464 (HIGH, CVSS 8.7) in Zr.Admin.NET: Authenticated users can exploit path traversal in /common/DownloadFile to access server files, including JWT secrets 🗝️. Restrict access & monitor logs. https://radar.offseq.com/threat/cve-2026-129464-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-izhaorui-5b2c845a0a46eae4 #OffSeq #PathTraversal #Security

CVE-2026-129464 (HIGH, CVSS 8.7) in Zr.Admin.NET: Authenticated users can exploit path traversal in /common/DownloadFile to access server files, including JWT secrets 🗝️. Restrict access & monitor logs. https://radar.offseq.com/threat/cve-2026-129464-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-izhaorui-5b2c845a0a46eae4 #OffSeq #PathTraversal #Security

CVE-2026-129454 in Zr.Admin.NET (HIGH): Authenticated low-priv users can enumerate /workflow/instance/{instanceId} to access other users' workflow data — forms, applicant details, approval history. Restrict access & monitor activity. https://radar.offseq.com/threat/cve-2026-129454-authorization-bypass-through-user-controlled-key-in-izhaorui-zradminnet-8fab9d4644a6436b #OffSeq #Vuln #InfoSec #DataLeak

CVE-2026-129454 in Zr.Admin.NET (HIGH): Authenticated low-priv users can enumerate /workflow/instance/{instanceId} to access other users' workflow data — forms, applicant details, approval history. Restrict access & monitor activity. https://radar.offseq.com/threat/cve-2026-129454-authorization-bypass-through-user-controlled-key-in-izhaorui-zradminnet-8fab9d4644a6436b #OffSeq #Vuln #InfoSec #DataLeak

CVE-2026-129354 – CRITICAL stack buffer overflow in D-Link DIR-600L 2.17b02. Remote, unauthenticated RCE possible. Public exploit code released. Isolate affected devices & restrict access; no patch yet. https://radar.offseq.com/threat/a-flaw-has-been-found-in-d-link-dir-600l-217b02-cve-2026-129354-a2adb57d0b15c2f8 #OffSeq #CVE #IoTSecurity

D-Link DIR-600L (v2.17b02) hit by CRITICAL stack-based buffer overflow (CVE-2026-129354) 🛑 Exploit code is public — RCE or DoS possible. No patch yet; restrict access & monitor HNAP traffic. https://radar.offseq.com/threat/cve-2026-129354-stack-based-buffer-overflow-in-d-link-dir-600l-c412d5c008ac0f05 #OffSeq #CVE2026129354 #infosec #routers

CVE-2026-129354 – CRITICAL stack buffer overflow in D-Link DIR-600L 2.17b02. Remote, unauthenticated RCE possible. Public exploit code released. Isolate affected devices & restrict access; no patch yet. https://radar.offseq.com/threat/a-flaw-has-been-found-in-d-link-dir-600l-217b02-cve-2026-129354-a2adb57d0b15c2f8 #OffSeq #CVE #IoTSecurity

D-Link DIR-600L (v2.17b02) hit by CRITICAL stack-based buffer overflow (CVE-2026-129354) 🛑 Exploit code is public — RCE or DoS possible. No patch yet; restrict access & monitor HNAP traffic. https://radar.offseq.com/threat/cve-2026-129354-stack-based-buffer-overflow-in-d-link-dir-600l-c412d5c008ac0f05 #OffSeq #CVE2026129354 #infosec #routers

CW: kritikus PHP RCE (PHP2Shell). Két CVE: CVE-2026-109618, CVE-2026-109619 — távolról, bejelentkezés nélkül kódfuttatás és memória-szivárgás; CISA: aktívan kihasznált. Javítás hivatalosan 8.2–8.5-hez, régebbiekhez csak forrásjavítás/patch. Ellenőrizd a PHP-verziót, indítsd újra a szolgáltatást. https://linuxmint.hu/hir/2026/11/php2shell-avagy-elephpant-a-porcelanboltban
#PHP #CVE2026109618 #CVE2026109619 #Security #OpenSource

CW: sérülékenység részletek

PHP2Shell: kritikus RCE-ek (CVE-2026-109618, CVE-2026-109619; PHP CS­VSS 9.2). Bejelentkezés nélkül, távolról futtatható kód; mod_php‑t különösen veszélyezteti. CISA: aktívan kihasznált. Felfedezésnél MI is segített. Frissítsd a PHP-t (8.2–8.5 javított), indítsd újra a szolgáltatást, és ha okt.17. után volt elérhető PHP, vizsgáld betörés jeleit.

https://linuxmint.hu/hir/2026/11/php2shell-avagy-elephpant-a-porcelanboltban

#PHP #RCE #CVE #Infosec #OpenSource

CW: kritikus PHP RCE (CVE-2026-109618, CVE-2026-109619)

PHP2Shell lehetővé teszi bejelentkezés nélkül távoli kódfuttatást — a támadó a webkiszolgáló PHP-folyamatának jogaival futtathat kódot. Javítások kiadva 8.2–8.5-hez; régebbi ágakhoz backportra vagy disztribúciós csomagra van szükség. Frissíts, indítsd újra a PHP-t, és vizsgáld át a rendszert kompromittálás jelei után. Részletek: https://linuxmint.hu/hir/2026/11/php2shell-avagy-elephpant-a-porcelanboltban

#PHP #RCE #Infosec #OpenSource

Siemens Building Automation and Energy Products Vulnerable to Critical PHP Flaws

Siemens reported that several building automation and energy products are affected by two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution.

**If you use Siemens Energy Engage or Spectrum Power products, update to the latest versions or apply the recommended PHP patches right away to prevent remote code execution. And always make sure to isolate the affected systems behind a firewall and restrict all unnecessary network access.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/siemens-building-automation-and-energy-products-vulnerable-to-critical-php-flaws-3-u-m-h-y/gD2P6Ple2L

D-Link DIR-600L (v2.17, 2.17b02) hit by CRITICAL (CVSS 10) stack-based buffer overflow – CVE-2026-129353. Remote, unauthenticated RCE possible. Public exploit out. Limit external exposure & check for vendor updates. https://radar.offseq.com/threat/cve-2026-129353-stack-based-buffer-overflow-in-d-link-dir-600l-696836f7a0623e09 #OffSeq #CVE2026129353 #infosec #IoT

D-Link DIR-600L (v2.17, 2.17b02) hit by CRITICAL (CVSS 10) stack-based buffer overflow – CVE-2026-129353. Remote, unauthenticated RCE possible. Public exploit out. Limit external exposure & check for vendor updates. https://radar.offseq.com/threat/cve-2026-129353-stack-based-buffer-overflow-in-d-link-dir-600l-696836f7a0623e09 #OffSeq #CVE2026129353 #infosec #IoT

CVE-2026-19907: CRITICAL (CVSS 9.8) auth bypass in Shipo WP plugin v1.6 – 1.8.0. Unauthenticated attackers can impersonate admins & gain full site control. Disable affected versions ASAP. More: https://radar.offseq.com/threat/cve-2026-19907-cwe-287-improper-authentication-in-shipo-shipo-924d020ff101b91a #OffSeq #WordPress #CVE202619907 #Infosec

CVE-2026-19907: CRITICAL (CVSS 9.8) auth bypass in Shipo WP plugin v1.6 – 1.8.0. Unauthenticated attackers can impersonate admins & gain full site control. Disable affected versions ASAP. More: https://radar.offseq.com/threat/cve-2026-19907-cwe-287-improper-authentication-in-shipo-shipo-924d020ff101b91a #OffSeq #WordPress #CVE202619907 #Infosec

CRITICAL: CVE-2026-129250 affects Edimax BR6478ACV2 v1.23 – buffer overflow in formPPTPSetup enables RCE/DoS. No patch, public exploit out. Isolate device, restrict access, monitor closely. https://radar.offseq.com/threat/cve-2026-129250-buffer-overflow-in-edimax-br6478acv2-88525ec07286374a #OffSeq #CVE2026129250 #Infosec #RouterVuln

CVE-2026-118182: HIGH severity auth flaw in Duplicate Post WordPress plugin <1.5.8. With slug takeover enabled, users with plugin access can hijack permalinks & replace content. Patch to 1.5.8+ ASAP. https://radar.offseq.com/threat/the-duplicate-post-wordpress-plugin-before-158-does-not-check-that-a-user-duplicating-a-post-is-3d9a3cf265683150 #OffSeq #WordPress #Vuln #Security

AutomatorWP Pro plugin (≤1.4.4) suffers a CRITICAL auth bypass (CVE-2026-126173). Unauth attackers can reset any WP user password and take over accounts if webhooks are misconfigured. Restrict webhook setups now. https://radar.offseq.com/threat/the-automatorwp-pro-plugin-for-wordpress-webhook-addon-is-vulnerable-to-authorization-bypass-in-all-347402ba31c0e215 #OffSeq #WordPress #CVE2026_126173 #Security

Check Point Patches Actively Exploited Zero Day Used in Destructive Attacks

Check Point released emergency patches for a zero-day vulnerability, CVE-2026-123039, which attackers exploited to gain root access and deploy wiper malware. The campaign targeted security gateways by chaining the privilege escalation flaw with previously reported PHP vulnerabilities to compromise dozens of customers.

**If you run Check Point security gateways, update to the latest Jumbo Hotfix Accumulator for your version (such as R81.20 Take 174 or R82.20 Take 14) right away. If you cannot patch immediately, disable the dynamic_server process using the dbset command to prevent attackers from escalating to root privileges.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/check-point-patches-actively-exploited-zero-day-used-in-destructive-attacks-8-l-r-q-3/gD2P6Ple2L

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-123039 – Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability

Actionable threat intelligence on CVE-2026-123039 targeting Check Point gateways and management servers, featuring local socket analysis, daemon hardening, and patch guidance....

https://thecybermind.co/gfdf

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-123039 – Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability

Executive risk and governance perspective on CVE-2026-123039, providing leadership with actionable compliance strategies, asset integrity audits, and boardroom oversight metrics....

https://thecybermind.co/yaps

📰 Check Point Zero-Day Exploited to Gain Root Access, Deploy Wiper

Actively exploited Check Point zero-day (CVE-2026-123039) allows root access on security gateways. Attackers are pivoting to VMware ESXi hosts to deploy destructive wiper malware. CISA added to KEV. Patch now! #CyberSecurity #ThreatIntel #CVE

🔗 https://cyber.netsecops.io/articles/check-point-zero-day-cve-2026-123039-exploited-to-deploy-wiper/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Check Point Patches Actively Exploited Zero Day Used in Destructive Attacks

Check Point released emergency patches for a zero-day vulnerability, CVE-2026-123039, which attackers exploited to gain root access and deploy wiper malware. The campaign targeted security gateways by chaining the privilege escalation flaw with previously reported PHP vulnerabilities to compromise dozens of customers.

**If you run Check Point security gateways, update to the latest Jumbo Hotfix Accumulator for your version (such as R81.20 Take 174 or R82.20 Take 14) right away. If you cannot patch immediately, disable the dynamic_server process using the dbset command to prevent attackers from escalating to root privileges.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/check-point-patches-actively-exploited-zero-day-used-in-destructive-attacks-8-l-r-q-3/gD2P6Ple2L

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-123039 – Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability

Actionable threat intelligence on CVE-2026-123039 targeting Check Point gateways and management servers, featuring local socket analysis, daemon hardening, and patch guidance....

https://thecybermind.co/gfdf

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-123039 – Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability

Executive risk and governance perspective on CVE-2026-123039, providing leadership with actionable compliance strategies, asset integrity audits, and boardroom oversight metrics....

https://thecybermind.co/yaps

🔵 THREAT INTELLIGENCE

Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection

Vulnerability | CRITICAL
CVEs: CVE-2026-114713

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a high-severity security flaw impacting UnrealIRCd, an open-source...

Full analysis:
https://www.yazoul.net/news/article/attackers-exploit-unrealircd-flaw-that-enables-server-level-command-injection/?utm_source=mastodon&utm_medium=social

by Yazoul AI

#ThreatIntel #Malware #SecurityOps

UnrealIRCd, CVE-2026-114713: il manutentore dice di vedere sfruttamento in corso; CISA l'ha messa in KEV il 13/11, scadenza FCEB il 16/11.

Il modulo labeled-response non fa escaping del tag IRCv3 "label": un utente qualsiasi, su una rete con due o più server linkati, può iniettare comandi server-to-server con autorità di server.

Colpite le 6.0.0 fino alla 6.2.7.1 esclusa. Fix 6.2.7.1 del 7/11, con hot-patch senza riavvio. Nessun IOC.

#infosec #blueteam https://thehackernews.com/2026/11/attackers-exploit-unrealircd-flaw-that.html

📰 CISA Warns of Actively Exploited Critical Flaw in UnrealIRCd

CISA adds critical UnrealIRCd flaw (CVE-2026-114713) to KEV catalog. The command injection bug allows server-level command execution and is actively exploited. Update to version 6.2.7.1 immediately. #CVE #UnrealIRCd #ThreatIntel

🔗 https://cyber.netsecops.io/articles/cisa-warns-of-actively-exploited-unrealircd-flaw-cve-2026-114713/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Exploiters Target UnrealIRCd Servers with High-Severity Flaw

UnrealIRCd servers are under attack by exploiters who are taking advantage of a high-severity flaw, CVE-2026-114713, that allows them to inject malicious commands with server-level privileges. The vulnerability has a CVSS score of 8.6 and can be exploited by any user on a network with linked servers.

https://osintsights.com/exploiters-target-unrealircd-servers-with-high-severity-flaw?utm_source=mastodon&utm_medium=social

#Unrealircd #Cve2026114713 #CommandInjection #ServerVulnerability #Exploit

🚨 Critical Red Hat Quay Vulnerability (CVE-2026-123710 | CVSS 9.8)

An unauthenticated authorization bypass in the /keys endpoint lets attackers upload rogue signing keys and hijack private container repositories.

https://denizhalil.com/2026/11/14/red-hat-quay-cve-2026-123710-vulnerability-analysis/

#CyberSecurity #InfoSec #RedHat

Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html

Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html

NoisyTCP: Linux Kernel TCP Pre-Auth Remote Corruption (CVE-2026-99288)

Hyunwoo Kim이 Linux Kernel의 인증 전 원격 취약점 NoisyTCP(CVE-2026-99288)를 공개했다. TCP 수신 처리 간 경합으로 커널 패닉과 원격 서비스 거부가 발생할 수 있으며, 컨테이너에서 실행 중인 서버가 공격받아도 호스트 전체가 중단될 수 있다. 취약점은 2015년 10월 3일 도입돼 2026년 11월 3일 수정됐으며, 테스트에서 VM은 약 5초~2분, 조용한 물리 서버는 약 14시간 만에 공격이 재현됐다. 공격자의 TCP 패킷이 직접 도달하고 RX 큐가 둘 이상이거나 RPS가 활성화된 서버가 영향을 받으며, 작성자는 패치 적용을 우선 권고한다. 원격 코드...

https://github.com/V4bel/NoisyTCP

prepared statements prevents SQLi. But it also helped me to exploit a 22 years old PostgreSQL 0-day RCE (CVE-2026-6460) https://mehmetince.net/part-3-6-how-i-ended-up-turning-a-22-year-old-postgresql-type-confusion-primitive-into-rce-cve-2026-6460/

prepared statements prevents SQLi. But it also helped me to exploit a 22 years old PostgreSQL 0-day RCE (CVE-2026-6460) https://mehmetince.net/part-3-6-how-i-ended-up-turning-a-22-year-old-postgresql-type-confusion-primitive-into-rce-cve-2026-6460/

Karen IT Security Response Center (@ksrc) Advisory

Advisory ID: KSRC-2026-11153

A #critical #SQL injection #vulnerability has been identified in the Auth API of Synology DiskStation Manager (#DSM). Tracked as CVE-2026-76954, the flaw allows a #remote, unauthenticated attacker to read or write arbitrary files on the device and to conduct denial-of-service attacks.

The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical) by Synology (vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No authentication or user interaction is required. Fixed DSM builds were released under Synology security advisory SA-26:19.

https://ksrc.karenit.net/blog/security-alert/unauthenticated-sql-injection-in-synology-dsm-auth-api

#cve #cyberSecurity #staysafe #StayInformed #StayProtected

Karen IT Security Response Center (@ksrc) Advisory

Advisory ID: KSRC-2026-11153

A #critical #SQL injection #vulnerability has been identified in the Auth API of Synology DiskStation Manager (#DSM). Tracked as CVE-2026-76954, the flaw allows a #remote, unauthenticated attacker to read or write arbitrary files on the device and to conduct denial-of-service attacks.

The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical) by Synology (vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No authentication or user interaction is required. Fixed DSM builds were released under Synology security advisory SA-26:19.

https://ksrc.karenit.net/blog/security-alert/unauthenticated-sql-injection-in-synology-dsm-auth-api

#cve #cyberSecurity #staysafe #StayInformed #StayProtected

🐧 SIGINT // Ubuntu Watch — 2026-11-15

A critical TCP use-after-free in the kernel is network-reachable, and Ubuntu kernels are already shipping. The nftables mitigation guidance from Red Hat and Ubuntu buys time, but patch and reboot, and verify with uname -r. Live-patch users should confirm coverage first.

🔗 https://www.rescana.com/post/linux-kernel-tcp-cve-2026-98432-use-after-free-prepare-now

#Ubuntu #Linux #infosec

🏆 New Achievement! 4EverAble2Shell, 4EverIn Trouble!

This court finds N-able GUILTY of shipping an RCE-ready zero-day, chaining CVE-2026-90436 — an Apache Axis flaw scoring a blistering 9.8 — with an unspecified hole in N-central's Legacy API. Exhibit A: researcher Sean Bales, visibly aggrieved, dropped full PoC code on GitHub within hours of N-able patching his previous disclosures. Exhibit B: threat actors began active exploitation the same day. (1/2)

🏆 New Achievement! 4EverAble2Shell, 4EverIn Trouble!

This court finds N-able GUILTY of shipping an RCE-ready zero-day, chaining CVE-2026-90436 — an Apache Axis flaw scoring a blistering 9.8 — with an unspecified hole in N-central's Legacy API. Exhibit A: researcher Sean Bales, visibly aggrieved, dropped full PoC code on GitHub within hours of N-able patching his previous disclosures. Exhibit B: threat actors began active exploitation the same day. (1/2)

Karen IT Security Response Center (@ksrc) Advisory

Advisory ID: KSRC-2026-11151

A #critical #authorization bypass vulnerability has been identified in the #MISP Modules website component. Tracked as CVE-2026-127016, the flaw allows an unauthenticated #remote attacker to fully manage external tools when the optional #administrator authentication is enabled.

The #vulnerability has been assigned a CVSS v4.0 score of 9.2 (Critical). An attacker with network access to the @misp Modules website can add, delete, enable/disable, and reconfigure external tools, including the ability to modify API keys and ingestion URLs. The issue affects misp-modules versions up to and including 3.1.4.

https://ksrc.karenit.net/blog/security-alert/missing-authorization-on-external-tool-management-in-misp-modules

#cve #cyberSecurity #staysafe #StayInformed #StayProtected

🚨 A critical MISP Modules authorization flaw can let unauthenticated attackers modify external tool configurations; CVE-2026-127016

PoC: https://github.com/fumioryoto/CVE-2026-127016

The vulnerability affects the MISP Modules website component, where external tool management endpoints fail to enforce the configured administrator authentication policy.

An unauthenticated attacker with network access can add or remove tools, toggle their status, and modify settings including API keys and ingestion URLs.

MISP Modules | Missing Authorization:

• CVSS: 9.2 Critical
• Affected: MISP Modules ≤ 3.1.4
• Attack: Remote, unauthenticated
• Impact: External tool configuration tampering, API key changes, ingestion URL modification
• CWE: CWE-862 Missing Authorization

The issue only applies when ADMIN_PASSWORD is configured; installations without an admin password intentionally allow open management access.

Karen IT Security Response Center (@ksrc) Advisory

Advisory ID: KSRC-2026-11151

A #critical #authorization bypass vulnerability has been identified in the #MISP Modules website component. Tracked as CVE-2026-127016, the flaw allows an unauthenticated #remote attacker to fully manage external tools when the optional #administrator authentication is enabled.

The #vulnerability has been assigned a CVSS v4.0 score of 9.2 (Critical). An attacker with network access to the @misp Modules website can add, delete, enable/disable, and reconfigure external tools, including the ability to modify API keys and ingestion URLs. The issue affects misp-modules versions up to and including 3.1.4.

https://ksrc.karenit.net/blog/security-alert/missing-authorization-on-external-tool-management-in-misp-modules

#cve #cyberSecurity #staysafe #StayInformed #StayProtected

🚨 A critical MISP Modules authorization flaw can let unauthenticated attackers modify external tool configurations; CVE-2026-127016

PoC: https://github.com/fumioryoto/CVE-2026-127016

The vulnerability affects the MISP Modules website component, where external tool management endpoints fail to enforce the configured administrator authentication policy.

An unauthenticated attacker with network access can add or remove tools, toggle their status, and modify settings including API keys and ingestion URLs.

MISP Modules | Missing Authorization:

• CVSS: 9.2 Critical
• Affected: MISP Modules ≤ 3.1.4
• Attack: Remote, unauthenticated
• Impact: External tool configuration tampering, API key changes, ingestion URL modification
• CWE: CWE-862 Missing Authorization

The issue only applies when ADMIN_PASSWORD is configured; installations without an admin password intentionally allow open management access.

CVE-2026-92745 cockpit-machines: local attacker can read process args and leak the RHSM offline token, risking subscription account access. CVSS 5, no patch yet. Restrict local access and watch for updates. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-92745/

CVE-2026-91203: symlink race in Cockpit Files lets local attackers redirect privileged chown/chmod to arbitrary files. CVSS 6, no patch yet. Audit your exposure before deploying. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-91203/

📢 [VULN] CVE-2026-124194 : Zero-Day dans Outlook expose des hachages NTLM

Microsoft a corrigé CVE-2026-124194, une vulnérabilité zero-day activement exploitée dans Microsoft Outlook qui peut exposer les informations d’authentification NTLMv2 d’un utilisateur lorsqu’un fichier de message spécialement conçu est ouvert.

🔗 https://socprime.com/fr/blog/cve-2026-124194-zero-day-microsoft-outlook-exploite-pour-voler-les-hachages-ntlm/
💬 discussion : https://infosec.pub/post/54945012
#ZeroDay #Vulnérabilité #Cyberveille

CVE-2026-124194: lo zero-day di Outlook che ruba l’hash NTLMv2 aprendo un file Office

https://spcnet.it/cve-2026-124194-lo-zero-day-di-outlook-che-ruba-lhash-ntlmv2-aprendo-un-file-office/

CVE-2026-124194: Outlook NTLM Zero-Day Explained

https://thecybersecguru.com/news/cve-2026-124194-outlook-ntlm-zero-day/

CVE-2026-124194: Outlook NTLM Zero-Day Explained

https://thecybersecguru.com/news/cve-2026-124194-outlook-ntlm-zero-day/

tvOS 27.2.1 update and HomeView Software 27.2 fix Bluetooth pairing bypasses and Brotli flaw CVE-2026-111497, which CISA lists as exploited.

#Apple #tvOS #AppleTV #HomeView #Bluetooth #Brotli #CyberSecurity #InfoSec

https://securityonline.info/tvos-27-2-1-update-homeview-27-2/?utm_source=mastodon&utm_medium=jetpack_social

tvOS 27.2.1 update and HomeView Software 27.2 fix Bluetooth pairing bypasses and Brotli flaw CVE-2026-111497, which CISA lists as exploited.

#Apple #tvOS #AppleTV #HomeView #Bluetooth #Brotli #CyberSecurity #InfoSec

https://securityonline.info/tvos-27-2-1-update-homeview-27-2/?utm_source=mastodon&utm_medium=jetpack_social

🔵 THREAT INTELLIGENCE

Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)

Vulnerability | CRITICAL
CVEs: CVE-2026-102895

CVE-2026-102895 is a trivial authentication-bypass vulnerability. GPUStack is also an attractive target. It is open-source software that manages...

Full analysis:
https://www.yazoul.net/news/article/exploit-attempts-for-gpustack-authentication-bypass-cve-2026-102895-thu-nov-12th/?utm_source=mastodon&utm_medium=social

by Yazoul AI

#CyberSecurity #APT #CyberNews

CW: kritikus PHP RCE (PHP2Shell). Két CVE: CVE-2026-109618, CVE-2026-109619 — távolról, bejelentkezés nélkül kódfuttatás és memória-szivárgás; CISA: aktívan kihasznált. Javítás hivatalosan 8.2–8.5-hez, régebbiekhez csak forrásjavítás/patch. Ellenőrizd a PHP-verziót, indítsd újra a szolgáltatást. https://linuxmint.hu/hir/2026/11/php2shell-avagy-elephpant-a-porcelanboltban
#PHP #CVE2026109618 #CVE2026109619 #Security #OpenSource

CW: sérülékenység részletek

PHP2Shell: kritikus RCE-ek (CVE-2026-109618, CVE-2026-109619; PHP CS­VSS 9.2). Bejelentkezés nélkül, távolról futtatható kód; mod_php‑t különösen veszélyezteti. CISA: aktívan kihasznált. Felfedezésnél MI is segített. Frissítsd a PHP-t (8.2–8.5 javított), indítsd újra a szolgáltatást, és ha okt.17. után volt elérhető PHP, vizsgáld betörés jeleit.

https://linuxmint.hu/hir/2026/11/php2shell-avagy-elephpant-a-porcelanboltban

#PHP #RCE #CVE #Infosec #OpenSource

CW: kritikus PHP RCE (CVE-2026-109618, CVE-2026-109619)

PHP2Shell lehetővé teszi bejelentkezés nélkül távoli kódfuttatást — a támadó a webkiszolgáló PHP-folyamatának jogaival futtathat kódot. Javítások kiadva 8.2–8.5-hez; régebbi ágakhoz backportra vagy disztribúciós csomagra van szükség. Frissíts, indítsd újra a PHP-t, és vizsgáld át a rendszert kompromittálás jelei után. Részletek: https://linuxmint.hu/hir/2026/11/php2shell-avagy-elephpant-a-porcelanboltban

#PHP #RCE #Infosec #OpenSource

Siemens Building Automation and Energy Products Vulnerable to Critical PHP Flaws

Siemens reported that several building automation and energy products are affected by two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution.

**If you use Siemens Energy Engage or Spectrum Power products, update to the latest versions or apply the recommended PHP patches right away to prevent remote code execution. And always make sure to isolate the affected systems behind a firewall and restrict all unnecessary network access.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/siemens-building-automation-and-energy-products-vulnerable-to-critical-php-flaws-3-u-m-h-y/gD2P6Ple2L

CVE-2026-74985: HIGH severity privilege escalation in Microsoft Enterprise Policies v4.0 🛡️ No patch or active exploitation reported. Review MSRC for updates and monitor permissions. https://radar.offseq.com/threat/privilege-escalation-in-the-enterprise-policies-component-5ed155f1bb128f0f #OffSeq #Microsoft #Vuln #PrivilegeEscalation

Meta's red team and Nik Tsytsarkin have published a technical write-up into a bug that allowed sandboxed apps to record audio via the microphone without the proper permissions or being logged.

This was patched back in August

https://rtx.meta.security/exploitation/2026/11/09/CVE-2026-65339.html

Meta's red team and Nik Tsytsarkin have published a technical write-up into a bug that allowed sandboxed apps to record audio via the microphone without the proper permissions or being logged.

This was patched back in August

https://rtx.meta.security/exploitation/2026/11/09/CVE-2026-65339.html

CVE-2026-11548: IBM WebSphere HTTP request smuggling, CVSS 4.8. Patch status unconfirmed, so verify your version now. #CVE #infosec #IBM https://www.valtersit.com/cve/CVE-2026-11548/

NvRoot (CVE-2026-47591) where in neocloud multi-tenant GPU environments, rent = root. Essentially it's a dirty page cache LPE using GPUs as catalyzer https://stealthium.io/blog/nvroot

NvRoot (CVE-2026-47591) where in neocloud multi-tenant GPU environments, rent = root. Essentially it's a dirty page cache LPE using GPUs as catalyzer https://stealthium.io/blog/nvroot

CVE-2026-63448 in Suricata SMB parser: unbounded transaction growth on one-sided flows can degrade or stall inspection. CVSS 5.9. Fixed in 7.0.17 and 8.0.6, patch now. #CVE #infosec #Suricata https://www.valtersit.com/cve/CVE-2026-63448/

CVE-2026-63448 in Suricata SMB parser: unbounded transaction growth on one-sided flows can degrade or stall inspection. CVSS 5.9. Fixed in 7.0.17 and 8.0.6, patch now. #CVE #infosec #Suricata https://www.valtersit.com/cve/CVE-2026-63448/

CVE-2026-52745: SQL injection in CordysCRM (CVSS 5.3) via the account-pool sort parameter before 1.7.0. Blind SQLi enables data exfiltration. Patch still under review, so restrict access and monitor input until fixed. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-52745/

CVE-2026-77528 Autobahn Python: decompression bomb bypasses maxMessagePayloadSize, letting unauthenticated clients blow past message limits. CVSS 5.3. Patch still under review, so pin and monitor. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-77528/

CVE-2026-85272: path traversal in Open edX safe_extractall (startswith vs path components) lets course staff execute code via crafted tar.gz import. CVSS 4.3, unpatched. Restrict import perms and update now. #CVE #infosec #OpenEdX https://www.valtersit.com/cve/CVE-2026-85272/

CVE-2026-81182 SysReptor: unauthenticated file disclosure via public note share links (CVSS 4.2). Patch under review, so restrict shared notes now. #CVE #infosec #SysReptor (216 characters) https://www.valtersit.com/cve/CVE-2026-81182/

CVE-2026-77385 in Kyoo: missing catalog-level authorization lets a registered user with core.play access transcoder paths outside the intended catalog. CVSS 4.3. Patch is under review - watch for 5.1.0. Details: #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-77385/

CVE-2026-69186: c-ares DNS response parsing flaw (CVSS 5.3) lets attackers force disproportionate heap allocation via spoofed ANCOUNT/NSCOUNT/ARCOUNT, risking memory corruption. Fixed in 1.34.7. Update now. #CVE #infosec #c-ares https://www.valtersit.com/cve/CVE-2026-69186/

CVE-2026-93750 in http-cache-semantics through 4.2.0: flawed Vary header wildcard validation lets attackers pull cached responses meant for other users, leaking sensitive data. CVSS 5.9, unpatched. Audit your dependencies now. https://www.valtersit.com/cve/CVE-2026-93750/

CVE-2026-91201 DocsGPT leaks OAuth session tokens via unvalidated origin in callback-status endpoint, letting attackers hijack cloud storage connectors. CVSS 5.4. No fix yet, patch under review - limit OAuth use until updated. #CVE #infosec https://www.valtersit.com/cve/CVE-2026-91201/

CVE-2026-93870: CSRF in Cotonti's ratings plugin AJAX handler through 1.0.0 lets attackers forge rating POSTs for logged-in users. CVSS 4.3, patch status unknown. Validate tokens and update now. #CVE #cybersecurity https://www.valtersit.com/cve/CVE-2026-93870/

CVE-2026-93873 Cotonti CSRF in contact plugin lets attackers forge messages via victims' sessions. CVSS 4.3, patch status unknown. Update Cotonti and validate CSRF tokens now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-93873/

CVE-2026-93869: Open redirect in Cotonti 1.0.0 via regex missing an end-of-string anchor in cot_url_check(), letting attackers bypass the redirect guard to phishing hosts. CVSS 6.1, no patch known. Update immediately. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-93869/

CVE-2026-11540: IBM WebSphere 9.0/8.5 FileTransfer servlet leaks file system info to remote attackers. CVSS 5.3, no patch confirmed. Restrict servlet access and track IBM's fix. #CVE #infosec #IBM https://www.valtersit.com/cve/CVE-2026-11540/

CVE-2026-11539: auth bypass in IBM WebSphere 9.0/8.5 via the SOAP/JMX connector, CVSS 5.3. No patch confirmed yet. Review your exposure and restrict connector access now. #CVE #infosec #IBM https://www.valtersit.com/cve/CVE-2026-11539/

CVE-2026-11710: IBM WebSphere 8.5 HTTP request smuggling via Content-Length header mishandling. CVSS 6.5, no patch yet. Check your exposure and apply mitigations. #CVE #infosec #IBM https://www.valtersit.com/cve/CVE-2026-11710/

CVE-2026-90891: ASRock Polychrome SYNC/RGB improper access control lets local attackers force an OS reboot via crafted IOCTL. CVSS 5.5, unpatched - patch now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-90891/

CVE-2026-90890: ASRock Polychrome SYNC/RGB driver untrusted pointer dereference lets local attackers crash the OS via crafted IOCTL. CVSS 5.5, no patch confirmed yet. Check for updates and restrict local access now. #CVE #infosec #ASRock https://www.valtersit.com/cve/CVE-2026-90890/

CVE-2026-4103: stored XSS in Publisher and Developer Portal via insufficient HTML sanitization, letting malicious JavaScript run in the browser when API docs are viewed. CVSS 6.4, patch status unknown. Treat as unpatched and update immediately. https://www.valtersit.com/cve/CVE-2026-4103/

CVE-2026-19542 glibc tdelete stack overflow via deep trees, crashes apps. CVSS 5.6, patch under review. Track and update glibc as soon as fixes land. #CVE #infosec #glibc https://www.valtersit.com/cve/CVE-2026-19542/

🏆 New Achievement! Have You Tried Turning Off Your Zero-Day?

Thank you for contacting Outlook Support. I see here your ticket mentions "unauthenticated attackers silently connecting to attacker-controlled network locations without any warning." Great news — I've located the issue! It's CVE-2026-1241, a network-spoofing zero-day with a CVSS of 6.5, confirmed actively exploited by CISA, which means we've escalated your case to Priority: Already Happening. (1/2)

🏆 New Achievement! Have You Tried Turning Off Your Zero-Day?

Thank you for contacting Outlook Support. I see here your ticket mentions "unauthenticated attackers silently connecting to attacker-controlled network locations without any warning." Great news — I've located the issue! It's CVE-2026-1241, a network-spoofing zero-day with a CVSS of 6.5, confirmed actively exploited by CISA, which means we've escalated your case to Priority: Already Happening. (1/2)

Mark Gadala-Maria (@markgadala)

Next.js의 심각도 9.1 취약점 CVE-2025-29927은 인증 미들웨어를 우회해 보호된 영역에 접근할 수 있게 한다. 보안·접근 제어를 미들웨어에 의존하는 애플리케이션이 영향 대상이다.

https://x.com/markgadala/status/2121813706929488182

#nextjs #security #vulnerability #authentication #middleware

🚨 A Next.js middleware flaw can let unauthenticated attackers bypass authorization checks; CVE-2025-29927

PoC: https://github.com/alinaclark672377250/CVE-2025-29927-POC

The vulnerability affects applications that rely on Next.js middleware for access control. By abusing the x-middleware-subrequest header, an attacker can cause middleware checks to be skipped and potentially reach protected routes without authentication.

Next.js Middleware | Authorization Bypass:

• CVSS: 9.1 Critical
• Attack: Remote, unauthenticated
• Affected: Next.js 11.1.4–12.3.4, 13.x < 13.5.9, 14.x < 14.2.25, 15.x < 15.2.3
• Fixed: 12.3.5, 13.5.9, 14.2.25, 15.2.3
• Impact: Bypass of middleware-based authorization controls

The repository demonstrates the header-based bypass against a protected route.

🚨 A Next.js middleware flaw can let unauthenticated attackers bypass authorization checks; CVE-2025-29927

PoC: https://github.com/alinaclark672377250/CVE-2025-29927-POC

The vulnerability affects applications that rely on Next.js middleware for access control. By abusing the x-middleware-subrequest header, an attacker can cause middleware checks to be skipped and potentially reach protected routes without authentication.

Next.js Middleware | Authorization Bypass:

• CVSS: 9.1 Critical
• Attack: Remote, unauthenticated
• Affected: Next.js 11.1.4–12.3.4, 13.x < 13.5.9, 14.x < 14.2.25, 15.x < 15.2.3
• Fixed: 12.3.5, 13.5.9, 14.2.25, 15.2.3
• Impact: Bypass of middleware-based authorization controls

The repository demonstrates the header-based bypass against a protected route.

🚨 A Windows Common Log File System flaw can let a local attacker escalate privileges to SYSTEM; CVE-2023-28252

PoC: https://github.com/Joe1sn/CVE_2023_28252

The vulnerability is a heap-based buffer overflow in the Windows CLFS driver. Successful exploitation can allow a local attacker to elevate privileges and execute code with SYSTEM-level permissions.

Microsoft patched the flaw in April 2023, and CISA added it to the Known Exploited Vulnerabilities catalog the same day.

Windows CLFS | Local Privilege Escalation:

• CVSS: 7.8 High
• Attack: Local
• Impact: Privilege escalation to SYSTEM
• CWE: CWE-122 Heap-based Buffer Overflow
• Status: Actively exploited in the wild / patched by Microsoft

The PoC demonstrates exploitation of the vulnerable CLFS driver on affected Windows systems.

🚨 A Windows Common Log File System flaw can let a local attacker escalate privileges to SYSTEM; CVE-2023-28252

PoC: https://github.com/Joe1sn/CVE_2023_28252

The vulnerability is a heap-based buffer overflow in the Windows CLFS driver. Successful exploitation can allow a local attacker to elevate privileges and execute code with SYSTEM-level permissions.

Microsoft patched the flaw in April 2023, and CISA added it to the Known Exploited Vulnerabilities catalog the same day.

Windows CLFS | Local Privilege Escalation:

• CVSS: 7.8 High
• Attack: Local
• Impact: Privilege escalation to SYSTEM
• CWE: CWE-122 Heap-based Buffer Overflow
• Status: Actively exploited in the wild / patched by Microsoft

The PoC demonstrates exploitation of the vulnerable CLFS driver on affected Windows systems.

Wow. I don't know whether this is the most ridiculous expectation of URL decoding or just REALLY bad input data.

I've had probes for paths including the string "%%32%65"

Which decodes as "%2e"

Which decodes as "."

Is someone REALLY expecting double-decoding issues to let them bypass filters? 🤨

Edit: Went to add it to my list of "malicious probes" that get Fail2banned and… it's already in my config! Apparently it's CVE-2021-42013 in Apache!

Skyfall Attack: Microarchitectural Data Sampling on AMD

ETH Zurich와 Google 연구진은 AMD 프로세서에서 격리된 데이터를 추출하는 데이터 샘플링 공격 SKYFALL을 공개했다. 이 공격은 캐시 주소 해시 충돌과 기존 방어의 누락을 이용해 SEV-SNP 가상 머신의 상태, 복호화된 마이크로코드 패치, System Management Mode(SMM) 메모리를 읽는다. 실험에서는 SMM의 대상 필드를 100% 정확도로 복구했으며, AMD는 CVE-2026-40671을 부여하고 마이크로코드 업데이트를 배포했다. 기밀 가상 머신 공격에는 악성 호스트나 하이퍼바이저 권한이 필요하며, 디스크 암호화 키 복구 실험에는 키가 레지스터에 있을 때 VM 종료를 유발하도록 수정한...

https://skyfall-attack.github.io/