FediSecfeeds

https://github.com/ylh440104/InfinityCore-Android-CVE-2026-98256

##

CVE-2026-98256
(7.8 HIGH)

EPSS: 0.13%

updated 2026-10-19T10:18:26.607000

1 posts

In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec() race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in __send_signal_locked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace: __send_signal_locked+0xb27/0xba0 do_send_sig_info+0xa7/0x160 do_send_specific+0x76/0xa0 __x64

2 repos

https://github.com/villager1314/CVE-2026-98256-Analysis

harrysintonen@infosec.exchange at 2026-10-16T22:09:52.000Z ##

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

updated 2026-10-18T13:16:35.800000

1 posts

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including super

thehackerwire@mastodon.social at 2026-10-18T01:01:34.000Z ##

🟠 CVE-2026-111884 - High (8.3)

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. A...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111884/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-111882
(8.1 HIGH)

EPSS: 0.39%

updated 2026-10-18T13:16:35.680000

1 posts

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including

thehackerwire@mastodon.social at 2026-10-18T01:01:23.000Z ##

🟠 CVE-2026-111882 - High (8.1)

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attacke...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111882/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-110981
(7.1 HIGH)

The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.

offseq@infosec.exchange at 2026-10-18T09:00:24.000Z ##

CVE-2026-111041 (HIGH): AI Engine WordPress plugin <3.7.9 has a missing authorization flaw. Editors+ can modify any post on the site. Upgrade to 3.7.9+ to fix. Details: https://radar.offseq.com/threat/cve-2026-111041-cwe-862-missing-authorization-in-ai-engine-73ebc0232c3cfd40 #OffSeq #WordPress #Vuln #Infosec

##

CVE-2026-96534
(7.7 HIGH)

EPSS: 0.21%

updated 2026-10-18T12:17:16.807000

1 posts

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.

offseq@infosec.exchange at 2026-10-18T07:30:23.000Z ##

CVE-2026-96534: HIGH severity SQL injection in Modern Events Calendar Lite & Pro (<7.37.0). Minimal privilege users can inject SQL via unsanitized parameter. Upgrade to 7.37.0+ now. Details: https://radar.offseq.com/threat/cve-2026-96534-cwe-89-sql-injection-in-modern-events-calendar-lite-ce764878637d8935 #OffSeq #WordPress #Vuln #SQLi

##

CVE-2026-112005
(7.7 HIGH)

EPSS: 0.57%

updated 2026-10-18T12:17:12.790000

2 posts

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.

thehackerwire@mastodon.social at 2026-10-18T14:19:23.000Z ##

🟠 CVE-2026-112005 - High (7.7)

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-112005/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-10-18T12:00:26.000Z ##

CVE-2026-112005: CRITICAL path traversal in clidey whodb (0.104.0 – 0.134.9). Remote attackers can read/write host files via DuckDB queries — risk of credential theft & file overwrite. Update ASAP! https://radar.offseq.com/threat/cve-2026-112005-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-clidey-359d00841ebcc12f #OffSeq #Infosec #PathTraversal #CVE2026112005

##

CVE-2026-111999
(7.5 HIGH)

EPSS: 0.53%

updated 2026-10-18T12:17:11.870000

1 posts

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and deli

Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.

offseq@infosec.exchange at 2026-10-17T12:00:26.000Z ##

CVE-2026-110889 (HIGH, CVSS 7.5): Gantry 5 Framework ≤5.6.4 leaks sensitive info in error messages. Attackers need no privileges or user interaction. Limit detailed error output & check for fixes. https://radar.offseq.com/threat/cve-2026-110889-generation-of-error-message-containing-sensitive-information-in-gantry-gantry-5-febaba0978056c3c #OffSeq #Vuln #Gantry #AppSec

##

thehackerwire@mastodon.social at 2026-10-17T11:17:40.000Z ##

🟠 CVE-2026-110889 - High (7.5)

Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110889/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-110936
(6.7 MEDIUM)

EPSS: 0.14%

updated 2026-10-17T09:16:28.893000

2 posts

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

ssvc at 2026-10-19T18:21:12.114Z ##

Active Exploitation of CVE-2026-110936 in Siemens Software Center

Siemens has validated that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center.

https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/

Attributed to Romulus multi-platform ClickFix campaign, this advisory contains IOC

#eitw #cve #siemens #threatintel #clickfix #IOC

##

ssvc@infosec.exchange at 2026-10-19T18:21:12.000Z ##

Active Exploitation of CVE-2026-110936 in Siemens Software Center

Siemens has validated that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center.

https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/

Attributed to Romulus multi-platform ClickFix campaign, this advisory contains IOC

#eitw #cve #siemens #threatintel #clickfix #IOC

##

CVE-2026-108123
(7.5 HIGH)

EPSS: 0.32%

updated 2026-10-17T06:30:40

1 posts

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, expo

thehackerwire@mastodon.social at 2026-10-17T06:04:32.000Z ##

🟠 CVE-2026-108123 - High (7.5)

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-108123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-104736
(9.8 CRITICAL)

EPSS: 0.44%

updated 2026-10-17T06:30:32

2 posts

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper:

2 repos

https://github.com/murrez/CVE-2026-104736

https://github.com/BIBILZERODAY/CVE-2026-104736---Proof-of-Concept-PoC-Exploit-Details

updated 2026-10-16T21:33:07

2 posts

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports t

offseq@infosec.exchange at 2026-10-17T01:30:25.000Z ##

ZoneMinder <1.38.3 has a CRITICAL command injection (CVE-2026-102608). Attackers with monitor-create/edit perms can exploit export events to run commands as web server user. Upgrade to 1.38.3 ASAP. https://radar.offseq.com/threat/prior-to-1383-downloadevents-manually-wraps-a-monitor-name-value-in-single-quotes-instead-of-using-6dc81b7d0d96a70c #OffSeq #ZoneMinder #Infosec #CVE2026102608

##

thehackerwire@mastodon.social at 2026-10-16T20:47:20.000Z ##

🔴 CVE-2026-102608 - Critical (9)

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102608/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-102917
(7.8 HIGH)

EPSS: 0.10%

updated 2026-10-16T21:32:58

1 posts

IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.

thehackerwire@mastodon.social at 2026-10-17T12:35:38.000Z ##

🟠 CVE-2026-102917 - High (7.8)

IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102917/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-102764
(9.8 CRITICAL)

EPSS: 1.18%

updated 2026-10-16T21:32:46

9 posts

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

1 repos

https://github.com/Worthes/CVE-2026-102764-Proof-of-concept

netsecio@mastodon.social at 2026-10-19T16:46:40.000Z ##

📰 China-Linked Group Exploits BeyondTrust Zero-Day in Espionage Attacks

A China-linked group, Armory Castle, is actively exploiting a critical zero-day (CVE-2026-102764) in BeyondTrust Remote Support appliances to gain root access and steal credentials. Patching is urgent. #CyberSecurity #ThreatIntel #ZeroDay #CVE

🔗 https://cyber.netsecops.io/articles/china-linked-hackers-exploit-beyondtrust-zero-day-in-espionage-campaign/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

##

cyberveille@mastobot.ping.moi at 2026-10-19T15:00:05.000Z ##

📢 [VULN] CVE-2026-102764 : Zero-Day dans BeyondTrust exploité

BeyondTrust a divulgué CVE-2026-102764, une vulnérabilité critique dans Remote Support (RS) qui a été exploitée comme une zero-day par un acteur de cyberespionnage soupçonné d’avoir des liens avec la Chine.

🔗 https://socprime.com/fr/blog/cve-2026-102764-beyondtrust-zero-day-exploite/
💬 discussion : https://infosec.pub/post/53799565
#ZeroDay #Vulnérabilité #Cyberveille

##

threatnoir@infosec.exchange at 2026-10-18T05:15:06.000Z ##

2026-W42 — Weekly Threat Roundup

🔓 Chinese APT Armory Castle exploited a BeyondTrust zero-day (CVE-2026-102764) since August, deploying custom webshells and credential harvesters across remote support infrastructure.
🏭 A ConnectWise Cloud Backup supply-chain compromise granted attackers admin access to 173 Microsoft 365 tenants…

https://threatnoir.com/weekly/2026-w42

#infosec #cybersecurity #threatintel

🤖 AI generated summary

##

youranonnewsirc@nerdculture.de at 2026-10-16T22:26:20.000Z ##

Geopolitical tensions rise: US-Ukraine ties fray over Starlink restrictions and Patriot missile shortages (Oct 16). Tech breakthrough: Microsoft unveils MAI-Base-2, a 2.8T parameter AI model with 12x DeepSeek gain (Oct 15). Cybersecurity critical: Chinese APT exploited BeyondTrust zero-day (CVE-2026-102764). Cisco warns of exploited Secure Email Gateway flaw (CVE-2026-76519).

#Cybersecurity #Geopolitics #AI

##

censys@infosec.exchange at 2026-10-16T19:19:05.000Z ##

🚨 Rapid Response | BeyondTrust Remote Support/Privileged Remote Access Zero-Day (CVE-2026-102764) (CVSS 9.3) is a critical vulnerability.

The flaw allows unauthenticated attackers to perform file operations on affected appliances.
Censys currently detects 9,569 Internet-exposed hosts and 177,497 web properties running BeyondTrust Remote Support or Privileged Remote Access. These figures represent detected installations, not confirmed vulnerable or unpatched instances.

BeyondTrust has released patches for both products. Organizations should prioritize patching self-hosted appliances and investigate potential compromise, as patching does not remediate prior exploitation.

Full Censys ARC advisory, including affected versions, exploitation indicators, and remediation guidance: https://censys.com/advisory/cve-2026-102764/

#CensysARC #Cybersecurity #VulnerabilityManagement #BeyondTrust #InfoSec

##

secdb@infosec.exchange at 2026-10-16T19:00:14.000Z ##

🚨 [CISA-2026:1016] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1016)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2025-61624 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-61624)
- Name: Fortinet Multiple Products Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: Multiple Products
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-122 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-61624

⚠️ CVE-2026-102764 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102764)
- Name: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BeyondTrust
- Product: Remote Support
- Notes: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102764

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261016 #cisa20261016 #cve_2025_61624 #cve_2026_102764 #cve202561624 #cve2026102764

##

cisakevtracker@mastodon.social at 2026-10-16T18:00:54.000Z ##

CVE ID: CVE-2026-102764
Vendor: BeyondTrust
Product: Remote Support
Date Added: 2026-10-16
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-102764

##

ssvc@infosec.exchange at 2026-10-16T17:34:28.000Z ##

Placeholder link https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog

CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability

updated 2026-10-16T19:56:15.773000

1 posts

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding

1 repos

https://github.com/rwilsonecs/CVE-2025-52097

nyanbinary@infosec.exchange at 2026-10-16T17:06:35.000Z ##

RE: https://infosec.exchange/@fuckeduprefs_bot/117451467118494691

...what the fuck happened here.

https://github.com/rwilsonecs/CVE-2025-52097/blob/main/ADVISORY.md

The researchers post is over a year old & states CVE-2025-52097 was already assigned in July 2025. The references are from the researchers advisory, checking the wayback machine has nothing for this dead link. The CVE record states it was reserved in 2026.

##

CVE-2026-111663
(8.6 HIGH)

EPSS: 0.29%

updated 2026-10-16T19:03:18.127000

2 posts

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.

updated 2026-10-16T18:34:55

2 posts

LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.

updated 2026-10-16T18:34:51

1 posts

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.

offseq@infosec.exchange at 2026-10-17T10:30:25.000Z ##

CVE-2026-111641: FastapiAdmin <=3.0 has a CRITICAL auth bypass flaw — unauthenticated attackers can seize admin sessions via exposed endpoints. Restrict access & watch for abuse until a patch lands. Details: https://radar.offseq.com/threat/fastapiadmin-through-30-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-8a2c1a85a7cb4068 #OffSeq #CVE2026111641 #infosec #security

##

CVE-2026-111650
(8.6 HIGH)

EPSS: 0.32%

updated 2026-10-16T18:34:47

1 posts

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.

thehackerwire@mastodon.social at 2026-10-18T10:02:35.000Z ##

🟠 CVE-2026-111650 - High (8.6)

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2025-61624
(6.0 MEDIUM)

EPSS: 1.08%

updated 2026-10-16T18:31:42

3 posts

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versio

secdb@infosec.exchange at 2026-10-16T19:00:14.000Z ##

🚨 [CISA-2026:1016] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1016)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2025-61624 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-61624)
- Name: Fortinet Multiple Products Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: Multiple Products
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-122 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-61624

⚠️ CVE-2026-102764 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102764)
- Name: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: BeyondTrust
- Product: Remote Support
- Notes: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102764

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261016 #cisa20261016 #cve_2025_61624 #cve_2026_102764 #cve202561624 #cve2026102764

##

cisakevtracker@mastodon.social at 2026-10-16T18:01:09.000Z ##

CVE ID: CVE-2025-61624
Vendor: Fortinet
Product: Multiple Products
Date Added: 2026-10-16
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-61624

##

ssvc@infosec.exchange at 2026-10-16T17:34:28.000Z ##

Placeholder link https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog

CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability

#CISA #KEV #Beyondtrust #fortinet

##

CVE-2026-89079
(9.8 CRITICAL)

EPSS: 0.29%

updated 2026-10-16T18:19:42.210000

1 posts

The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.

1 repos

https://github.com/murrez/CVE-2026-89079

DarkWebInformer@infosec.exchange at 2026-10-16T18:21:28.000Z ##

🚨 PoC published for a critical unauthenticated WordPress Theme My Login account takeover vulnerability; CVE-2026-89079

PoC: https://github.com/murrez/CVE-2026-89079

The flaw affects WordPress multisite installations using Theme My Login with user-chosen registration passwords enabled. Under the required configuration, an unauthenticated attacker can abuse the lost-password flow to overwrite another user's password and take over the account.

CVSS: 9.8 Critical
Affected: Theme My Login ≤ 7.2.1
Fixed: Theme My Login ≥ 7.2.2

Exploitation is configuration-dependent and requires WordPress multisite with the tml_user_passwords network option enabled. The PoC includes target checking, verification, bulk scanning, and an exploit mode that validates successful account access.

##

CVE-2026-111229
(7.2 HIGH)

EPSS: 6.37%

updated 2026-10-16T18:17:36.993000

1 posts

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell

secdb@infosec.exchange at 2026-10-19T00:03:06.000Z ##

📈 CVE Published in last 7 days (2026-10-12 - 2026-10-12)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 389
- High: 2415
- Medium: 1801
- Low: 195
- None: 228

Status:
- : 39
- Analyzed: 663
- Awaiting Analysis: 1828
- Deferred: 1843
- Modified: 1
- Received: 194
- Rejected: 31
- Undergoing Analysis: 429

CISA KEVs:
- CISA-2026:1013 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1013)
- CISA-2026:1014 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1014)
- CISA-2026:1015 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1015)
- CISA-2026:1016 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1016)

Top CNAs:
- Microsoft Corporation: 1441
- VulnCheck: 947
- GitHub, Inc.: 363
- VulDB: 202
- Wordfence: 200
- Adobe Systems Incorporated: 177
- Patchstack: 155
- Juniper Networks, Inc.: 153
- WPScan: 107
- MITRE: 93

Top Affected Products:
- UNKNOWN: 3031
- Microsoft Windows Server 2025: 1031
- Microsoft Windows 11 25h2: 1002
- Microsoft Windows 11 24h2: 1002
- Microsoft Windows 11 26h1: 989
- Microsoft Windows Server 2022: 967
- Microsoft Windows 11 23h2: 957
- Microsoft Windows Server 2019: 902
- Microsoft Windows 10 22h2: 890
- Microsoft Windows 10 21h2: 890

##

CVE-2026-111214
(7.2 HIGH)

EPSS: 8.63%

updated 2026-10-16T18:17:36.570000

1 posts

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.

secdb@infosec.exchange at 2026-10-19T00:03:06.000Z ##

📈 CVE Published in last 7 days (2026-10-12 - 2026-10-12)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 389
- High: 2415
- Medium: 1801
- Low: 195
- None: 228

Status:
- : 39
- Analyzed: 663
- Awaiting Analysis: 1828
- Deferred: 1843
- Modified: 1
- Received: 194
- Rejected: 31
- Undergoing Analysis: 429

CISA KEVs:
- CISA-2026:1013 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1013)
- CISA-2026:1014 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1014)
- CISA-2026:1015 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1015)
- CISA-2026:1016 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1016)

Top CNAs:
- Microsoft Corporation: 1441
- VulnCheck: 947
- GitHub, Inc.: 363
- VulDB: 202
- Wordfence: 200
- Adobe Systems Incorporated: 177
- Patchstack: 155
- Juniper Networks, Inc.: 153
- WPScan: 107
- MITRE: 93

Top Affected Products:
- UNKNOWN: 3031
- Microsoft Windows Server 2025: 1031
- Microsoft Windows 11 25h2: 1002
- Microsoft Windows 11 24h2: 1002
- Microsoft Windows 11 26h1: 989
- Microsoft Windows Server 2022: 967
- Microsoft Windows 11 23h2: 957
- Microsoft Windows Server 2019: 902
- Microsoft Windows 10 22h2: 890
- Microsoft Windows 10 21h2: 890

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97380/

##

CVE-2026-97380
(8.8 HIGH)

EPSS: 0.57%

updated 2026-10-16T18:09:12.750000

1 posts

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error

thehackerwire@mastodon.social at 2026-10-16T17:45:52.000Z ##

🟠 CVE-2026-97380 - High (8.8)

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not ...

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-106931
(7.8 HIGH)

EPSS: 0.66%

updated 2026-10-16T16:16:57.180000

7 posts

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

cyberveille@mastobot.ping.moi at 2026-10-19T19:00:05.000Z ##

📢 Exploitation active de CVE-2026-106931 dans le WAF SiteGuard Server Edition

BleepingComputer, publié le 18 octobre 2026. L'article rapporte l'exploitation active d'une vulnérabilité critique dans SiteGuard Server Edition, un pare-feu applicatif web (WAF) japonais largement déployé, protégeant selon le vendeur plus de 1,5 million de sites web.

📖 cyberveille : https://cyberveille.ch/posts/2026-10-19-exploitation-active-de-cve-2026-106931-dans-le-waf-siteguard-server-edition/
🌐 source : https://www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/
🟡 vérification factuelle moyenne
#SiteGuard #WAF #Cyberveille

##

vitobotta@mastodon.social at 2026-10-19T14:56:50.000Z ##

SiteGuard Server Edition, CVE-2026-106931: command injection in the statistics feature, commands as root. Actively exploited. The box in front of the internet, reachable from the internet, running as root. Patch it, then read your outbound logs.

##

vitobotta@mastodon.social at 2026-10-19T14:56:50.000Z ##

SiteGuard Server Edition, CVE-2026-106931: command injection in the statistics feature, commands as root. Actively exploited. The box in front of the internet, reachable from the internet, running as root. Patch it, then read your outbound logs.

##

ssvc@infosec.exchange at 2026-10-19T12:56:01.000Z ##

SiteGuard exploited zero-day: CVE-2026-106931 (CVSS4: 8.5 high) SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

English translation:

A vulnerability (CVE-2026-106931) allowing OS command injection has been discovered in the statistics function of SiteGuard Server Edition. Exploitation has already been confirmed.

https://www.eg-secure.co.jp/siteguard/news/alert-202610-1

#siteguard #eitw #CVE #zeroday

##

patrickcmiller@infosec.exchange at 2026-10-19T12:42:01.000Z ##

Japan’s SiteGuard WAF flaw CVE-2026-106931 is already being exploited https://securityaffairs.com/201258/security/japans-siteguard-waf-flaw-cve-2026-106931-is-already-being-exploited.html

##

beyondmachines1@infosec.exchange at 2026-10-18T20:01:49.000Z ##

SiteGuard WAF Flaw Exploited to Gain Root and SYSTEM Privileges

EG Secure Solutions reported an actively exploited OS command injection vulnerability (CVE-2026-106931) in SiteGuard Server Edition's statistics feature, allowing attackers to run commands with full administrative rights.

**If you use the SiteGuard Server Edition WAF (for Apache, Nginx or IIS), first save the diagnostic information from the web management interface, then immediately update to Ver8.00 Update 5 (Ver7.00 Update 6 on FreeBSD), or apply the vendor's patch if you're on an end-of-life version. This flaw is actively exploited. Check the saved diagnostics for signs of a break-in, and if anything looks suspicious, change all database credentials and passwords stored on that server.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/siteguard-waf-flaw-exploited-to-gain-root-and-system-privileges-4-0-i-i-v/gD2P6Ple2L

##

cyberworldops@infosec.exchange at 2026-10-18T14:50:10.000Z ##

OS command injection CVE-2026-106931 in the statistics function of SiteGuard Server Edition is under active exploitation, per vendor bulletin relayed by JPCERT/CC. It matters because code execution occurs on the WAF host itself, undermining web-layer protection. #SiteGuard #CommandInjection #WafSecurity

https://cyberworldops.eu/en/siteguard-waf-flaw-cve-2026-106931-is-under-active-exploitation

##

CVE-2026-64959
(0 None)

EPSS: 0.30%

updated 2026-10-16T15:20:39.130000

1 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API mi

DailyCyberSecurity@infosec.exchange at 2026-10-19T00:25:43.000Z ##

Apache fixes 12 Apache Kylin vulnerabilities, including critical CVE-2026-64959, plus Apache Airflow SSH flaws. Upgrade Kylin to 5.0.5 now.

#ApacheKylin #ApacheAirflow #ApacheAnswer #CVE202664959 #CVE202668571 #CVE202694134 #SQLInjection #CyberSecurity

https://securityonline.info/apache-kylin-vulnerabilities-airflow-answer/?utm_source=mastodon&utm_medium=jetpack_social

##

CVE-2026-93953
(8.0 HIGH)

EPSS: 0.34%

updated 2026-10-16T06:30:32

2 posts

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSER

cyberveille@mastobot.ping.moi at 2026-10-19T16:00:06.000Z ##

📢 [VULN] Restaurer une sauvegarde peut offrir votre site WordPress à un pirate à cause de cette faille CVE-2026-93953

Un simple utilisateur avec le rôle d'abonné glisse quelques lignes dans sa biographie, un administrateur restaure une sauvegarde WordPress quelques jours plus tard... et le site web change de mains. C'est le scénario rendu possible par une faille dans Backuply, une extension…

🔗 https://www.it-connect.fr/backuply-cve-2026-93953-injection-sql-wordpress/
💬 discussion : https://infosec.pub/post/53801639
#Vulnérabilité #CVE #Cyberveille

##

benzogaga33@mamot.fr at 2026-10-17T09:40:03.000Z ##

Backuply : une faille SQL menace 600 000 WordPress, surtout si vous restaurez votre site web https://www.it-connect.fr/backuply-cve-2026-93953-injection-sql-wordpress/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Wordpress

##

CVE-2026-111226
(7.2 HIGH)

EPSS: 6.55%

updated 2026-10-15T21:36:16

1 posts

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.

secdb@infosec.exchange at 2026-10-19T00:03:06.000Z ##

📈 CVE Published in last 7 days (2026-10-12 - 2026-10-12)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 389
- High: 2415
- Medium: 1801
- Low: 195
- None: 228

Status:
- : 39
- Analyzed: 663
- Awaiting Analysis: 1828
- Deferred: 1843
- Modified: 1
- Received: 194
- Rejected: 31
- Undergoing Analysis: 429

CISA KEVs:
- CISA-2026:1013 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1013)
- CISA-2026:1014 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1014)
- CISA-2026:1015 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1015)
- CISA-2026:1016 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1016)

Top CNAs:
- Microsoft Corporation: 1441
- VulnCheck: 947
- GitHub, Inc.: 363
- VulDB: 202
- Wordfence: 200
- Adobe Systems Incorporated: 177
- Patchstack: 155
- Juniper Networks, Inc.: 153
- WPScan: 107
- MITRE: 93

Top Affected Products:
- UNKNOWN: 3031
- Microsoft Windows Server 2025: 1031
- Microsoft Windows 11 25h2: 1002
- Microsoft Windows 11 24h2: 1002
- Microsoft Windows 11 26h1: 989
- Microsoft Windows Server 2022: 967
- Microsoft Windows 11 23h2: 957
- Microsoft Windows Server 2019: 902
- Microsoft Windows 10 22h2: 890
- Microsoft Windows 10 21h2: 890

##

CVE-2026-111218
(7.2 HIGH)

EPSS: 8.45%

updated 2026-10-15T21:36:12

1 posts

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.

secdb@infosec.exchange at 2026-10-19T00:03:06.000Z ##

📈 CVE Published in last 7 days (2026-10-12 - 2026-10-12)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 389
- High: 2415
- Medium: 1801
- Low: 195
- None: 228

Status:
- : 39
- Analyzed: 663
- Awaiting Analysis: 1828
- Deferred: 1843
- Modified: 1
- Received: 194
- Rejected: 31
- Undergoing Analysis: 429

CISA KEVs:
- CISA-2026:1013 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1013)
- CISA-2026:1014 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1014)
- CISA-2026:1015 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1015)
- CISA-2026:1016 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1016)

Top CNAs:
- Microsoft Corporation: 1441
- VulnCheck: 947
- GitHub, Inc.: 363
- VulDB: 202
- Wordfence: 200
- Adobe Systems Incorporated: 177
- Patchstack: 155
- Juniper Networks, Inc.: 153
- WPScan: 107
- MITRE: 93

Top Affected Products:
- UNKNOWN: 3031
- Microsoft Windows Server 2025: 1031
- Microsoft Windows 11 25h2: 1002
- Microsoft Windows 11 24h2: 1002
- Microsoft Windows 11 26h1: 989
- Microsoft Windows Server 2022: 967
- Microsoft Windows 11 23h2: 957
- Microsoft Windows Server 2019: 902
- Microsoft Windows 10 22h2: 890
- Microsoft Windows 10 21h2: 890

##

CVE-2026-111215
(7.2 HIGH)

EPSS: 7.05%

updated 2026-10-15T21:36:10

1 posts

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interp

secdb@infosec.exchange at 2026-10-19T00:03:06.000Z ##

📈 CVE Published in last 7 days (2026-10-12 - 2026-10-12)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 389
- High: 2415
- Medium: 1801
- Low: 195
- None: 228

Status:
- : 39
- Analyzed: 663
- Awaiting Analysis: 1828
- Deferred: 1843
- Modified: 1
- Received: 194
- Rejected: 31
- Undergoing Analysis: 429

CISA KEVs:
- CISA-2026:1013 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1013)
- CISA-2026:1014 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1014)
- CISA-2026:1015 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1015)
- CISA-2026:1016 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1016)

Top CNAs:
- Microsoft Corporation: 1441
- VulnCheck: 947
- GitHub, Inc.: 363
- VulDB: 202
- Wordfence: 200
- Adobe Systems Incorporated: 177
- Patchstack: 155
- Juniper Networks, Inc.: 153
- WPScan: 107
- MITRE: 93

Top Affected Products:
- UNKNOWN: 3031
- Microsoft Windows Server 2025: 1031
- Microsoft Windows 11 25h2: 1002
- Microsoft Windows 11 24h2: 1002
- Microsoft Windows 11 26h1: 989
- Microsoft Windows Server 2022: 967
- Microsoft Windows 11 23h2: 957
- Microsoft Windows Server 2019: 902
- Microsoft Windows 10 22h2: 890
- Microsoft Windows 10 21h2: 890

##

CVE-2026-111216
(7.2 HIGH)

EPSS: 6.55%

updated 2026-10-15T21:05:32.823000

1 posts

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitor

secdb@infosec.exchange at 2026-10-19T00:03:06.000Z ##

📈 CVE Published in last 7 days (2026-10-12 - 2026-10-12)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 389
- High: 2415
- Medium: 1801
- Low: 195
- None: 228

Status:
- : 39
- Analyzed: 663
- Awaiting Analysis: 1828
- Deferred: 1843
- Modified: 1
- Received: 194
- Rejected: 31
- Undergoing Analysis: 429

CISA KEVs:
- CISA-2026:1013 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1013)
- CISA-2026:1014 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1014)
- CISA-2026:1015 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1015)
- CISA-2026:1016 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1016)

Top CNAs:
- Microsoft Corporation: 1441
- VulnCheck: 947
- GitHub, Inc.: 363
- VulDB: 202
- Wordfence: 200
- Adobe Systems Incorporated: 177
- Patchstack: 155
- Juniper Networks, Inc.: 153
- WPScan: 107
- MITRE: 93

Top Affected Products:
- UNKNOWN: 3031
- Microsoft Windows Server 2025: 1031
- Microsoft Windows 11 25h2: 1002
- Microsoft Windows 11 24h2: 1002
- Microsoft Windows 11 26h1: 989
- Microsoft Windows Server 2022: 967
- Microsoft Windows 11 23h2: 957
- Microsoft Windows Server 2019: 902
- Microsoft Windows 10 22h2: 890
- Microsoft Windows 10 21h2: 890

##

CVE-2026-111217
(7.2 HIGH)

EPSS: 7.05%

updated 2026-10-15T21:05:32.823000

1 posts

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.

secdb@infosec.exchange at 2026-10-19T00:03:06.000Z ##

📈 CVE Published in last 7 days (2026-10-12 - 2026-10-12)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 389
- High: 2415
- Medium: 1801
- Low: 195
- None: 228

Status:
- : 39
- Analyzed: 663
- Awaiting Analysis: 1828
- Deferred: 1843
- Modified: 1
- Received: 194
- Rejected: 31
- Undergoing Analysis: 429

CISA KEVs:
- CISA-2026:1013 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1013)
- CISA-2026:1014 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1014)
- CISA-2026:1015 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1015)
- CISA-2026:1016 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1016)

Top CNAs:
- Microsoft Corporation: 1441
- VulnCheck: 947
- GitHub, Inc.: 363
- VulDB: 202
- Wordfence: 200
- Adobe Systems Incorporated: 177
- Patchstack: 155
- Juniper Networks, Inc.: 153
- WPScan: 107
- MITRE: 93

Top Affected Products:
- UNKNOWN: 3031
- Microsoft Windows Server 2025: 1031
- Microsoft Windows 11 25h2: 1002
- Microsoft Windows 11 24h2: 1002
- Microsoft Windows 11 26h1: 989
- Microsoft Windows Server 2022: 967
- Microsoft Windows 11 23h2: 957
- Microsoft Windows Server 2019: 902
- Microsoft Windows 10 22h2: 890
- Microsoft Windows 10 21h2: 890

https://github.com/Ife-ella/CVE-vulnerability

##

CVE-2026-94603
(10.0 CRITICAL)

EPSS: 0.92%

updated 2026-10-15T20:22:17

2 posts

### Impact Podman v4.4.0 added a feature where container checkpoints (from the `podman container checkpoint` command) could be distributed via OCI registry, and pulled from that registry and run via the `podman run` command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the containe

ChrisShort@hachyderm.io at 2026-10-19T16:09:47.000Z ##

CVE-2026-94603 - GitHub Advisory Database #devopsish https://github.com/advisories/GHSA-2cvf-wqm6-wr9g

##

ChrisShort@hachyderm.io at 2026-10-19T16:09:47.000Z ##

CVE-2026-94603 - GitHub Advisory Database #devopsish https://github.com/advisories/GHSA-2cvf-wqm6-wr9g

##

CVE-2026-0322
(7.2 HIGH)

EPSS: 1.21%

updated 2026-10-15T13:47:26.713000

1 posts

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended

1 repos

PatchOrPass@infosec.exchange at 2026-10-18T19:22:35.000Z ##

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: https://patchorpass.beehiiv.com

#homelab #infosec #selfhosted #sysadmin

##

CVE-2026-76519
(9.8 CRITICAL)

EPSS: 1.57%

updated 2026-10-15T13:47:19.470000

2 posts

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a

1 repos

https://github.com/Mickysalivan/CVE-2026-76519-Proof-of-concept

PatchOrPass@infosec.exchange at 2026-10-18T19:22:35.000Z ##

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: https://patchorpass.beehiiv.com

#homelab #infosec #selfhosted #sysadmin

##

youranonnewsirc@nerdculture.de at 2026-10-16T22:26:20.000Z ##

Geopolitical tensions rise: US-Ukraine ties fray over Starlink restrictions and Patriot missile shortages (Oct 16). Tech breakthrough: Microsoft unveils MAI-Base-2, a 2.8T parameter AI model with 12x DeepSeek gain (Oct 15). Cybersecurity critical: Chinese APT exploited BeyondTrust zero-day (CVE-2026-102764). Cisco warns of exploited Secure Email Gateway flaw (CVE-2026-76519).

#Cybersecurity #Geopolitics #AI

##

CVE-2026-59774
(9.8 CRITICAL)

EPSS: 28.31%

updated 2026-10-15T04:18:24.663000

1 posts

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger acces

Nuclei template

1 repos

https://github.com/FlowerWitch/CVE-2026-59774_docker

secdb@infosec.exchange at 2026-10-19T00:03:06.000Z ##

📈 CVE Published in last 7 days (2026-10-12 - 2026-10-12)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

updated 2026-10-15T03:36:28

1 posts

Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a

secdb@infosec.exchange at 2026-10-19T00:03:06.000Z ##

📈 CVE Published in last 7 days (2026-10-12 - 2026-10-12)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 389
- High: 2415
- Medium: 1801
- Low: 195
- None: 228

Status:
- : 39
- Analyzed: 663
- Awaiting Analysis: 1828
- Deferred: 1843
- Modified: 1
- Received: 194
- Rejected: 31
- Undergoing Analysis: 429

CISA KEVs:
- CISA-2026:1013 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1013)
- CISA-2026:1014 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1014)
- CISA-2026:1015 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1015)
- CISA-2026:1016 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1016)

Top CNAs:
- Microsoft Corporation: 1441
- VulnCheck: 947
- GitHub, Inc.: 363
- VulDB: 202
- Wordfence: 200
- Adobe Systems Incorporated: 177
- Patchstack: 155
- Juniper Networks, Inc.: 153
- WPScan: 107
- MITRE: 93

Top Affected Products:
- UNKNOWN: 3031
- Microsoft Windows Server 2025: 1031
- Microsoft Windows 11 25h2: 1002
- Microsoft Windows 11 24h2: 1002
- Microsoft Windows 11 26h1: 989
- Microsoft Windows Server 2022: 967
- Microsoft Windows 11 23h2: 957
- Microsoft Windows Server 2019: 902
- Microsoft Windows 10 22h2: 890
- Microsoft Windows 10 21h2: 890

https://github.com/AmpedWasTaken/CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE

##

CVE-2026-97229
(10.0 CRITICAL)

EPSS: 0.55%

updated 2026-10-14T13:55:26.987000

2 posts

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

4 repos

https://github.com/jburgess-r7/CVE-2026-97229-PoC

https://github.com/OppositDeer/Gitlab-RCE-CVE-2026-97229

https://github.com/gandli/cve-2026-97229-lab

cyberveille@mastobot.ping.moi at 2026-10-19T18:00:05.000Z ##

📢 GitLab corrige une faille RCE critique dans le compilateur de regex CI/CD (CVE-2026-97229)

📰 Source : BleepingComputer — Date : 12 octobre 2026 GitLab a publié un avis de sécurité urgent concernant CVE-2026-97229, une vulnérabilité de sévérité maximale (CVSS non précisé mais qualifié de critique) affectant le compilateur d'expressions régulières CI/CD de sa…

📖 cyberveille : https://cyberveille.ch/posts/2026-10-19-gitlab-corrige-une-faille-rce-critique-dans-le-compilateur-de-regex-ci-cd-cve-2026-97229/
🌐 source : https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/
🟡 vérification factuelle moyenne
#CICD #GitLab #Cyberveille

##

AAKL@infosec.exchange at 2026-10-16T17:06:49.000Z ##

New.

Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229) https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/ @Rapid7Official #infosec #GitLab #vulnerability #threatresearch

##

CVE-2026-110447(CVSS UNKNOWN)

EPSS: 1.23%

updated 2026-10-14T03:30:40

1 posts

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Coll

1 repos

https://github.com/adriyansyah-mf/cve-2026-110447

guru@thecybersecguru.com at 2026-10-17T09:26:14.000Z ##

Critical Nextcloud Collabora Flaw Enables Unauthenticated Command Execution Through Built-in CODE Server

CVE-2026-110447 is a critical Nextcloud Collabora RCE flaw exploited in the wild. Learn affected versions, attack details, web shell indicators, and fixes

https://thecybersecguru.com/exploits/nextcloud-cve-2026-110447-collabora-rce/

##

CVE-2026-65674
(8.8 HIGH)

CVE-2026-104935
(8.6 HIGH)

EPSS: 25.98%

updated 2026-10-13T18:30:50

2 posts

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Nuclei template

2 repos

https://github.com/ApexBreach/CVE-2026-104935-Proof-of-concept

https://github.com/0x45dd/ivanti-cve-2026-104935-check

secdb@infosec.exchange at 2026-10-19T00:03:06.000Z ##

📈 CVE Published in last 7 days (2026-10-12 - 2026-10-12)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 389
- High: 2415
- Medium: 1801
- Low: 195
- None: 228

Status:
- : 39
- Analyzed: 663
- Awaiting Analysis: 1828
- Deferred: 1843
- Modified: 1
- Received: 194
- Rejected: 31
- Undergoing Analysis: 429

CISA KEVs:
- CISA-2026:1013 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1013)
- CISA-2026:1014 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1014)
- CISA-2026:1015 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1015)
- CISA-2026:1016 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1016)

Top CNAs:
- Microsoft Corporation: 1441
- VulnCheck: 947
- GitHub, Inc.: 363
- VulDB: 202
- Wordfence: 200
- Adobe Systems Incorporated: 177
- Patchstack: 155
- Juniper Networks, Inc.: 153
- WPScan: 107
- MITRE: 93

Top Affected Products:
- UNKNOWN: 3031
- Microsoft Windows Server 2025: 1031
- Microsoft Windows 11 25h2: 1002
- Microsoft Windows 11 24h2: 1002
- Microsoft Windows 11 26h1: 989
- Microsoft Windows Server 2022: 967
- Microsoft Windows 11 23h2: 957
- Microsoft Windows Server 2019: 902
- Microsoft Windows 10 22h2: 890
- Microsoft Windows 10 21h2: 890

#homelab #infosec #selfhosted #sysadmin

##

PatchOrPass@infosec.exchange at 2026-10-18T19:22:35.000Z ##

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: https://patchorpass.beehiiv.com

##

CVE-2026-107570
(2.5 LOW)

EPSS: 0.13%

updated 2026-10-10T00:31:27

1 posts

heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.

thomasnoel@mamot.fr at 2026-10-17T11:00:41.000Z ##

CVE-2026-107570 : cette fois c'est sûr on va tous mourir.

##

CVE-2026-98260
(7.8 HIGH)

EPSS: 0.13%

updated 2026-10-07T09:33:19

2 posts

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posix_cputimers. The task is looked up by that PID. When a non-leader thread exec()s, de_thread() changes which task owns that PID. pi

2 repos

https://github.com/jadedFella/lpe-study-notes

https://github.com/ylh440104/InfinityCore-Android-CVE-2026-98260

DailyCyberSecurity@infosec.exchange at 2026-10-19T00:50:50.000Z ##

Details and PoC exploits are public for six Linux kernel vulnerabilities, including CVE-2026-98260, enabling privilege escalation. Patch now.

#LinuxKernel #InfinityCore #CVE202698260 #CVE202698256 #CVE202689754 #PrivilegeEscalation #ContainerEscape #PoC #CyberSecurity

https://securityonline.info/linux-kernel-vulnerabilities-infinity-core-poc/?utm_source=mastodon&utm_medium=jetpack_social

##

harrysintonen@infosec.exchange at 2026-10-16T22:09:52.000Z ##

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

CVE-2026-80775 (Futex)
This is a use-after-free caused when two tasks that share an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH.

CVE-2026-98385 (Scheduler)
This is a use-after-free caused when scheduler cache accounting continues to update per-CPU statistics belonging to a previously freed mm_struct. The vulnerable path is reached when CONFIG_SCHED_CACHE is enabled, scheduler cache is active at runtime, and the CPU topology contains multiple LLCs.

CVE-2026-97941 (SLAB)
This is a list corruption caused by a race between returning a freelist and removing a slab from the node partial list during SLUB object refill. The public trigger causes a kernel panic.

https://www.openwall.com/lists/oss-security/2026/10/16/36

https://cyberworldops.eu/en/langflow-command-injection-draws-exploitation-attempts-as-version-190

##

CVE-2026-105740
(9.9 CRITICAL)

EPSS: 0.59%

updated 2026-10-06T19:17:41.197000

1 posts

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediate

cyberworldops@infosec.exchange at 2026-10-16T15:00:22.000Z ##

Langflow fixed CVE-2026-105740, a critical command injection enabling RCE with CVSS 9.9. Exploitation attempts have been observed, putting exposed AI workflow servers at immediate risk. Patch to 1.9.0 and review logs for compromise. #Langflow #RemoteCodeExecution #ThreatIntel

##

CVE-2026-88779
(7.5 HIGH)

EPSS: 0.59%

updated 2026-10-05T13:35:24.663000

2 posts

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

2 repos

https://github.com/orjanj/netscaler_threat_hunt_helper

https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker

ssvc at 2026-10-19T16:17:13.910Z ##

For the DoS haters who don't want to patch their Citrix NetScalers: threat actors are chaining CVE-2026-88771 and CVE-2026-88779:

https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/

https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/

##

ssvc@infosec.exchange at 2026-10-19T16:17:13.000Z ##

For the DoS haters who don't want to patch their Citrix NetScalers: threat actors are chaining CVE-2026-88771 and CVE-2026-88779:

##

CVE-2026-96652
(4.3 MEDIUM)

EPSS: 0.22%

updated 2026-09-29T18:36:18.417000

6 posts

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

2 repos

https://cyberworldops.eu/en/public-plex2shell-exploit-used-to-compromise-exposed-plex-media

cyberveille@mastobot.ping.moi at 2026-10-19T18:30:05.000Z ##

📢 Exploitation in-the-wild de vulnérabilités Plex Media Server via chaîne RCE (plex2shell)

Le chercheur zmain a découvert et chaîné plusieurs vulnérabilités dans Plex Media Server v1.43.2 et antérieures pour obtenir une exécution de code à distance (RCE). Les CVE associées sont : CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656 Le code…

📖 cyberveille : https://cyberveille.ch/posts/2026-10-19-exploitation-in-the-wild-de-vulnerabilites-plex-media-server-via-chaine-rce-plex2shell/
🌐 source : https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html?m=1
🟢 vérification factuelle haute
#PlexMediaServer #RCE #Cyberveille

##

cyberworldops at 2026-10-19T16:40:07.819Z ##

A public Plex2Shell exploit chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 for unauthenticated RCE on exposed Plex Media Server instances. Active exploitation means any internet-facing unpatched server should be treated as at-risk and prioritized for patching and exposure review. #Plex2Shell #PlexSecurity #RemoteCodeExecution

##

sayzard@mastodon.sayzard.org at 2026-10-19T14:43:52.000Z ##

Plex vulnerabilities being exploited in the wild to drop a cryptominer

Plex Media Server v1.43.2 이하의 취약점 체인(CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656)을 이용한 원격 코드 실행 공격이 실제 관측됐다. 연구자의 허니팟에서는 공격자가 취약한 Plex 서버에 접근해 XMRig 기반 암호화폐 채굴기와 `myawesomeproxy` 프록시 도구를 내려받는 행위가 확인됐다. 공개된 PoC, PCAP, 탐지 규칙 및 IP·파일 해시 IOC를 활용해 Plex 노출 자산을 즉시 패치하고, 비...

http://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

##

cyberworldops@infosec.exchange at 2026-10-19T16:40:07.000Z ##

A public Plex2Shell exploit chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 for unauthenticated RCE on exposed Plex Media Server instances. Active exploitation means any internet-facing unpatched server should be treated as at-risk and prioritized for patching and exposure review. #Plex2Shell #PlexSecurity #RemoteCodeExecution

https://cyberworldops.eu/en/public-plex2shell-exploit-used-to-compromise-exposed-plex-media

##

ssvc@infosec.exchange at 2026-10-19T13:22:57.000Z ##

Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

CVE-2026-96652 (5.3 med) Plex Media Server SSRF
CVE-2026-96654 (6.9 med) Plex Media Server URL injection
CVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF
CVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write

##

DarkWebInformer@infosec.exchange at 2026-10-18T16:00:00.000Z ##

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

##

CVE-2026-96654
(6.5 MEDIUM)

EPSS: 0.23%

updated 2026-09-29T18:35:57.403000

6 posts

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

2 repos

https://cyberworldops.eu/en/public-plex2shell-exploit-used-to-compromise-exposed-plex-media

cyberveille@mastobot.ping.moi at 2026-10-19T18:30:05.000Z ##

📢 Exploitation in-the-wild de vulnérabilités Plex Media Server via chaîne RCE (plex2shell)

Le chercheur zmain a découvert et chaîné plusieurs vulnérabilités dans Plex Media Server v1.43.2 et antérieures pour obtenir une exécution de code à distance (RCE). Les CVE associées sont : CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656 Le code…

📖 cyberveille : https://cyberveille.ch/posts/2026-10-19-exploitation-in-the-wild-de-vulnerabilites-plex-media-server-via-chaine-rce-plex2shell/
🌐 source : https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html?m=1
🟢 vérification factuelle haute
#PlexMediaServer #RCE #Cyberveille

##

cyberworldops at 2026-10-19T16:40:07.819Z ##

A public Plex2Shell exploit chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 for unauthenticated RCE on exposed Plex Media Server instances. Active exploitation means any internet-facing unpatched server should be treated as at-risk and prioritized for patching and exposure review. #Plex2Shell #PlexSecurity #RemoteCodeExecution

##

sayzard@mastodon.sayzard.org at 2026-10-19T14:43:52.000Z ##

Plex vulnerabilities being exploited in the wild to drop a cryptominer

Plex Media Server v1.43.2 이하의 취약점 체인(CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656)을 이용한 원격 코드 실행 공격이 실제 관측됐다. 연구자의 허니팟에서는 공격자가 취약한 Plex 서버에 접근해 XMRig 기반 암호화폐 채굴기와 `myawesomeproxy` 프록시 도구를 내려받는 행위가 확인됐다. 공개된 PoC, PCAP, 탐지 규칙 및 IP·파일 해시 IOC를 활용해 Plex 노출 자산을 즉시 패치하고, 비...

http://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

##

cyberworldops@infosec.exchange at 2026-10-19T16:40:07.000Z ##

A public Plex2Shell exploit chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 for unauthenticated RCE on exposed Plex Media Server instances. Active exploitation means any internet-facing unpatched server should be treated as at-risk and prioritized for patching and exposure review. #Plex2Shell #PlexSecurity #RemoteCodeExecution

https://cyberworldops.eu/en/public-plex2shell-exploit-used-to-compromise-exposed-plex-media

##

ssvc@infosec.exchange at 2026-10-19T13:22:57.000Z ##

Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

CVE-2026-96652 (5.3 med) Plex Media Server SSRF
CVE-2026-96654 (6.9 med) Plex Media Server URL injection
CVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF
CVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write

##

DarkWebInformer@infosec.exchange at 2026-10-18T16:00:00.000Z ##

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

##

CVE-2026-96655
(4.3 MEDIUM)

EPSS: 0.22%

updated 2026-09-29T18:35:19.410000

6 posts

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

2 repos

https://cyberworldops.eu/en/public-plex2shell-exploit-used-to-compromise-exposed-plex-media

cyberveille@mastobot.ping.moi at 2026-10-19T18:30:05.000Z ##

📢 Exploitation in-the-wild de vulnérabilités Plex Media Server via chaîne RCE (plex2shell)

Le chercheur zmain a découvert et chaîné plusieurs vulnérabilités dans Plex Media Server v1.43.2 et antérieures pour obtenir une exécution de code à distance (RCE). Les CVE associées sont : CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656 Le code…

📖 cyberveille : https://cyberveille.ch/posts/2026-10-19-exploitation-in-the-wild-de-vulnerabilites-plex-media-server-via-chaine-rce-plex2shell/
🌐 source : https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html?m=1
🟢 vérification factuelle haute
#PlexMediaServer #RCE #Cyberveille

##

cyberworldops at 2026-10-19T16:40:07.819Z ##

A public Plex2Shell exploit chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 for unauthenticated RCE on exposed Plex Media Server instances. Active exploitation means any internet-facing unpatched server should be treated as at-risk and prioritized for patching and exposure review. #Plex2Shell #PlexSecurity #RemoteCodeExecution

##

sayzard@mastodon.sayzard.org at 2026-10-19T14:43:52.000Z ##

Plex vulnerabilities being exploited in the wild to drop a cryptominer

Plex Media Server v1.43.2 이하의 취약점 체인(CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656)을 이용한 원격 코드 실행 공격이 실제 관측됐다. 연구자의 허니팟에서는 공격자가 취약한 Plex 서버에 접근해 XMRig 기반 암호화폐 채굴기와 `myawesomeproxy` 프록시 도구를 내려받는 행위가 확인됐다. 공개된 PoC, PCAP, 탐지 규칙 및 IP·파일 해시 IOC를 활용해 Plex 노출 자산을 즉시 패치하고, 비...

http://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

##

cyberworldops@infosec.exchange at 2026-10-19T16:40:07.000Z ##

A public Plex2Shell exploit chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 for unauthenticated RCE on exposed Plex Media Server instances. Active exploitation means any internet-facing unpatched server should be treated as at-risk and prioritized for patching and exposure review. #Plex2Shell #PlexSecurity #RemoteCodeExecution

https://cyberworldops.eu/en/public-plex2shell-exploit-used-to-compromise-exposed-plex-media

##

ssvc@infosec.exchange at 2026-10-19T13:22:57.000Z ##

Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

CVE-2026-96652 (5.3 med) Plex Media Server SSRF
CVE-2026-96654 (6.9 med) Plex Media Server URL injection
CVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF
CVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write

##

DarkWebInformer@infosec.exchange at 2026-10-18T16:00:00.000Z ##

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

##

CVE-2026-96656
(7.2 HIGH)

EPSS: 0.40%

updated 2026-09-29T18:34:58.550000

6 posts

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

3 repos

https://github.com/a3igner/plex-codec-cache-implant

https://cyberworldops.eu/en/public-plex2shell-exploit-used-to-compromise-exposed-plex-media

cyberveille@mastobot.ping.moi at 2026-10-19T18:30:05.000Z ##

📢 Exploitation in-the-wild de vulnérabilités Plex Media Server via chaîne RCE (plex2shell)

Le chercheur zmain a découvert et chaîné plusieurs vulnérabilités dans Plex Media Server v1.43.2 et antérieures pour obtenir une exécution de code à distance (RCE). Les CVE associées sont : CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656 Le code…

📖 cyberveille : https://cyberveille.ch/posts/2026-10-19-exploitation-in-the-wild-de-vulnerabilites-plex-media-server-via-chaine-rce-plex2shell/
🌐 source : https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html?m=1
🟢 vérification factuelle haute
#PlexMediaServer #RCE #Cyberveille

##

cyberworldops at 2026-10-19T16:40:07.819Z ##

A public Plex2Shell exploit chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 for unauthenticated RCE on exposed Plex Media Server instances. Active exploitation means any internet-facing unpatched server should be treated as at-risk and prioritized for patching and exposure review. #Plex2Shell #PlexSecurity #RemoteCodeExecution

##

sayzard@mastodon.sayzard.org at 2026-10-19T14:43:52.000Z ##

Plex vulnerabilities being exploited in the wild to drop a cryptominer

Plex Media Server v1.43.2 이하의 취약점 체인(CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656)을 이용한 원격 코드 실행 공격이 실제 관측됐다. 연구자의 허니팟에서는 공격자가 취약한 Plex 서버에 접근해 XMRig 기반 암호화폐 채굴기와 `myawesomeproxy` 프록시 도구를 내려받는 행위가 확인됐다. 공개된 PoC, PCAP, 탐지 규칙 및 IP·파일 해시 IOC를 활용해 Plex 노출 자산을 즉시 패치하고, 비...

http://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

##

cyberworldops@infosec.exchange at 2026-10-19T16:40:07.000Z ##

A public Plex2Shell exploit chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 for unauthenticated RCE on exposed Plex Media Server instances. Active exploitation means any internet-facing unpatched server should be treated as at-risk and prioritized for patching and exposure review. #Plex2Shell #PlexSecurity #RemoteCodeExecution

https://cyberworldops.eu/en/public-plex2shell-exploit-used-to-compromise-exposed-plex-media

##

ssvc@infosec.exchange at 2026-10-19T13:22:57.000Z ##

Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

CVE-2026-96652 (5.3 med) Plex Media Server SSRF
CVE-2026-96654 (6.9 med) Plex Media Server URL injection
CVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF
CVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write

##

DarkWebInformer@infosec.exchange at 2026-10-18T16:00:00.000Z ##

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

https://github.com/emilstahl/pitscaler

##

CVE-2026-88771
(9.8 CRITICAL)

EPSS: 1.08%

updated 2026-09-28T12:32:08

2 posts

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

13 repos

https://github.com/craigsblackie/cve-2026-88771-netscaler

https://github.com/LETHAL-FORENSICS/Get-NetScalerTimeline

https://github.com/techupdate24/citrix-netscaler-cve-2026-88771-rce

https://github.com/grupooruss/netscaler-defensive-checker

https://github.com/bkchaudhari/NetScaler-CTX697096-Assessment-Script

https://github.com/technion/netscaler_scanner

https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker

https://github.com/SwiftSecur/CVE-2026-88771-HuntScript

https://github.com/watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs

https://github.com/orjanj/netscaler_threat_hunt_helper

https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771

https://github.com/securekomodo/citrixInspector

ssvc at 2026-10-19T16:17:13.910Z ##

For the DoS haters who don't want to patch their Citrix NetScalers: threat actors are chaining CVE-2026-88771 and CVE-2026-88779:

https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/

https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/

##

ssvc@infosec.exchange at 2026-10-19T16:17:13.000Z ##

For the DoS haters who don't want to patch their Citrix NetScalers: threat actors are chaining CVE-2026-88771 and CVE-2026-88779:

https://github.com/ylh440104/InfinityCore-Android-CVE-2026-97941

##

CVE-2026-97941
(7.8 HIGH)

EPSS: 0.15%

updated 2026-09-25T15:32:53

1 posts

In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race Commit ba7425312607 ("mm, slab: add an optimistic __slab_try_return_freelist()") incorrectly assumed that nobody has freed an object to the slab as long as slab->freelist is NULL and cmpxchg succeeds. However, as reported by Hyunwoo Kim [1], other CPUs mig

1 repos

harrysintonen@infosec.exchange at 2026-10-16T22:09:52.000Z ##

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

updated 2026-09-21T20:17:40.807000

1 posts

A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of the file BS_LED64.sys of the component IOCTL Handler. The manipulation of the argument AssociatedIrp leads to write-what-where condition. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted early abo

1 repos

https://github.com/lzty/CVE-2026-94128

hugovalters@mastodon.social at 2026-10-19T19:20:12.000Z ##

CVE-2026-94128 BioStar VIVID LED DJ driver write-what-where flaw, CVSS 8.8, public exploit, vendor silent, no patch. Update or isolate now: #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94128/

##

CVE-2026-94097
(10.0 CRITICAL)

EPSS: 2.94%

updated 2026-09-21T00:30:33

2 posts

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about t

hugovalters@mastodon.social at 2026-10-19T16:20:03.000Z ##

CVE-2026-94097: CVSS 10 command injection in Netcore NBR200V2 1.3.241127.071246 via the /www/cgi-bin/network_tools CGI endpoint. Public exploit, remote, unpatched, vendor silent. Isolate the device and watch for a fix. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94097/

##

hugovalters@mastodon.social at 2026-10-19T16:20:03.000Z ##

CVE-2026-94097: CVSS 10 command injection in Netcore NBR200V2 1.3.241127.071246 via the /www/cgi-bin/network_tools CGI endpoint. Public exploit, remote, unpatched, vendor silent. Isolate the device and watch for a fix. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94097/

##

CVE-2026-94038
(7.3 HIGH)

EPSS: 0.51%

updated 2026-09-20T18:31:24

1 posts

A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabase_url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 8389032e5d52c28c4855c612

hugovalters@mastodon.social at 2026-10-19T14:40:03.000Z ##

CVE-2026-94038: SSRF in NonceGeek dim-sum-app (CVSS 7.3), public exploit out, patch unconfirmed. Apply commit 8389032 if you run it. #CVE #infosec https://www.valtersit.com/cve/CVE-2026-94038/

##

CVE-2026-89754
(7.8 HIGH)

EPSS: 0.17%

updated 2026-09-13T09:32:30

1 posts

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() If ->pmd_entry() sets walk->action = ACTION_AGAIN, the pmd_none() check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk->ops->install_pte is not specified, the code continues to the next PMD entry in the range without resetting

1 repos

https://github.com/ylh440104/InfinityCore-Android-CVE-2026-89754

harrysintonen@infosec.exchange at 2026-10-16T22:09:52.000Z ##

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

CVE-2026-80775 (Futex)
This is a use-after-free caused when two tasks that share an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH.

CVE-2026-98385 (Scheduler)
This is a use-after-free caused when scheduler cache accounting continues to update per-CPU statistics belonging to a previously freed mm_struct. The vulnerable path is reached when CONFIG_SCHED_CACHE is enabled, scheduler cache is active at runtime, and the CPU topology contains multiple LLCs.

CVE-2026-97941 (SLAB)
This is a list corruption caused by a race between returning a freelist and removing a slab from the node partial list during SLUB object refill. The public trigger causes a kernel panic.

https://www.openwall.com/lists/oss-security/2026/10/16/36

https://github.com/ylh440104/InfinityCore-Android-CVE-2026-80775

##

CVE-2026-81376
(9.6 CRITICAL)

EPSS: 0.90%

updated 2026-09-08T18:34:02

1 posts

Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

DarkWebInformer@infosec.exchange at 2026-10-18T18:21:55.000Z ##

CVE-2026-81376: VS Code RCE via Security Feature Bypass; $4,000 bounty.

Write-up: https://samchen.blog/blog/vscode-nested-form-to-rce

##

CVE-2026-80775(CVSS UNKNOWN)

EPSS: 0.17%

updated 2026-09-04T18:31:32

1 posts

In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm->futex.phash.ref allocation futex_hash_allocate() allocates mm->futex.phash.ref without any locking. Commit d9b05321e21e ("futex: Move futex_hash_free() back to __mmput()") moved the allocation here and assumed that the process has just a single thread at this point. Commit ee9dce44362b ("futex

1 repos

harrysintonen@infosec.exchange at 2026-10-16T22:09:52.000Z ##

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

CVE-2026-80775 (Futex)
This is a use-after-free caused when two tasks that share an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH.

CVE-2026-98385 (Scheduler)
This is a use-after-free caused when scheduler cache accounting continues to update per-CPU statistics belonging to a previously freed mm_struct. The vulnerable path is reached when CONFIG_SCHED_CACHE is enabled, scheduler cache is active at runtime, and the CPU topology contains multiple LLCs.

CVE-2026-97941 (SLAB)
This is a list corruption caused by a race between returning a freelist and removing a slab from the node partial list during SLUB object refill. The public trigger causes a kernel panic.

https://www.openwall.com/lists/oss-security/2026/10/16/36