📰 Cisco Patches Firewall Zero-Day Exploited for DoS Attacks

Cisco patches an actively exploited zero-day (CVE-2026-20349) in ASA and FTD firewalls. The flaw allows a remote, unauthenticated attacker to cause a denial-of-service (DoS). Patch immediately to prevent network disruption. #Cisco #ZeroDay #CyberSecu...

🔗 https://cyber.netsecops.io/articles/cisco-patches-firewall-zero-day-exploited-for-dos-attacks/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

CVE-2026-20349 can be exploited remotely without authentication against Secure Firewall ASA and FTD devices. https://www.securityweek.com/cisco-patches-firewall-zero-day-exploited-for-dos-attacks/

⚠️ New security advisory:

CVE-2026-20349 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-20349-cisco-asa-ftd-vpn-dos-exploited-in-wild

by Yazoul AI

#CVE #ZeroDay #ThreatIntel

Cisco ASA and FTD Flaw Exploited in Wild, Triggers Remote DoS

A high-severity vulnerability in Cisco Secure Firewall ASA and FTD software, known as CVE-2026-20349, is being actively exploited in the wild, allowing attackers to trigger a remote denial-of-service condition with a simple crafted HTTP request. This flaw, with a CVSS score of 8.6, can cause affected devices to reload, leaving networks…

https://osintsights.com/cisco-asa-and-ftd-flaw-exploited-in-wild-triggers-remote-dos?utm_source=mastodon&utm_medium=social

#CiscoAsa #Ftd #Cve202620349 #RemoteDos #VulnerabilityExploitation

🚨 THREAT ALERT: CISA adds CVE-2026-20349 (Cisco ASA/FTD Heap Inspection DoS) to the KEV catalog due to active exploitation. Unauthenticated remote actors can crash perimeter firewalls. Read our full TSUITE brief with SPL, KQL, AQL & Chronicle queries: https://thecybermind.co/jily

#CyberSecurity

Cisco Firewalls Under Pressure: CVE-2026-20349 Exposes a Dangerous Zero-Day Risk While Sandworm-Linked Hackers Weaponize Fake IT Jobs + Video

Introduction: Two Different Attacks, One Bigger Warning Cybersecurity defenders are facing a familiar but increasingly dangerous pattern: attackers do not need to break through every security control if they can find one exposed edge device or convince one trusted employee to install the wrong software. On August 12, 2026, two…

https://undercodenews.com/cisco-firewalls-under-pressure-cve-2026-20349-exposes-a-dangerous-zero-day-risk-while-sandworm-linked-hackers-weaponize-fake-it-jobs-video/?utm_source=mastodon&utm_medium=jetpack_social

Cisco Secure Firewall Under Active Attack: High-Severity CVE-2026-20349 Puts ASA and FTD Devices on Immediate Patch Alert + Video

A New Warning Has Turned a Firewall Bug Into an Active Security Emergency A firewall is supposed to be the wall between an organization and the hostile internet. When that wall can be forced to restart remotely, without authentication, the problem is no longer a theoretical weakness hidden inside a security scanner. It becomes an operational…

https://undercodenews.com/cisco-secure-firewall-under-active-attack-high-severity-cve-2026-20349-puts-asa-and-ftd-devices-on-immediate-patch-alert-video/?utm_source=mastodon&utm_medium=jetpack_social

「Ciscoは、ASAおよびFTD VPNの脆弱性が悪用され、デバイスがクラッシュする可能性があると警告している。 」： #BLEEPINGCOMPUTER

「シスコは、Secure Firewall ASAおよびThreat Defense（FTD）ソフトウェアに存在する深刻なサービス拒否攻撃の脆弱性が、影響を受けるデバイスをリモートからクラッシュさせる攻撃で積極的に悪用されていると警告している。

CVE-2026-20349として追跡されているこの脆弱性は、深刻度スコアが8.6であり、特定のリモートアクセスサービスが有効になっているCisco Secure Firewall Adaptive Security Appliance（ASA）またはSecure Firewall Threat Defense（FTD）ソフトウェアを実行しているデバイスに影響を与えます。

シスコは本日公開したセキュリティ勧告の中で、この脆弱性はHTTPリクエスト処理時のエラーチェックが不十分なことに起因すると述べた。 」

https://www.bleepingcomputer.com/news/security/cisco-warns-of-asa-and-ftd-vpn-flaw-exploited-to-crash-devices/

#prattohome

Cisco confirms CVE-2026-20349, a Cisco ASA and FTD VPN vulnerability (CVSS 8.6), is exploited in the wild to crash firewalls. Patch now.

#Cisco #CVE #DoS #FirewallSecurity #VPN #InfoSec

https://securityonline.info/cisco-asa-ftd-vpn-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-20349 can be exploited remotely without authentication against Secure Firewall ASA and FTD devices. https://www.securityweek.com/cisco-patches-firewall-zero-day-exploited-for-dos-attacks/

🚨 THREAT ALERT: CISA adds CVE-2026-20349 (Cisco ASA/FTD Heap Inspection DoS) to the KEV catalog due to active exploitation. Unauthenticated remote actors can crash perimeter firewalls. Read our full TSUITE brief with SPL, KQL, AQL & Chronicle queries: https://thecybermind.co/jily

#CyberSecurity

「Ciscoは、ASAおよびFTD VPNの脆弱性が悪用され、デバイスがクラッシュする可能性があると警告している。 」： #BLEEPINGCOMPUTER

「シスコは、Secure Firewall ASAおよびThreat Defense（FTD）ソフトウェアに存在する深刻なサービス拒否攻撃の脆弱性が、影響を受けるデバイスをリモートからクラッシュさせる攻撃で積極的に悪用されていると警告している。

CVE-2026-20349として追跡されているこの脆弱性は、深刻度スコアが8.6であり、特定のリモートアクセスサービスが有効になっているCisco Secure Firewall Adaptive Security Appliance（ASA）またはSecure Firewall Threat Defense（FTD）ソフトウェアを実行しているデバイスに影響を与えます。

シスコは本日公開したセキュリティ勧告の中で、この脆弱性はHTTPリクエスト処理時のエラーチェックが不十分なことに起因すると述べた。 」

https://www.bleepingcomputer.com/news/security/cisco-warns-of-asa-and-ftd-vpn-flaw-exploited-to-crash-devices/

#prattohome

Cisco confirms CVE-2026-20349, a Cisco ASA and FTD VPN vulnerability (CVSS 8.6), is exploited in the wild to crash firewalls. Patch now.

#Cisco #CVE #DoS #FirewallSecurity #VPN #InfoSec

https://securityonline.info/cisco-asa-ftd-vpn-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:0811] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0811)

CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-20349 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-20349)
- Name: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
- Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20349

⚠️ CVE-2026-68820 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-68820)
- Name: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows Ancillary Function Driver for WinSock
- Notes: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-68820 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-68820

⚠️ CVE-2026-72898 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-72898)
- Name: Metabase SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Metabase
- Product: Metabase
- Notes: https://www.metabase.com/blog/security-update ; https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72898

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260811 #cisa20260811 #cve_2026_20349 #cve_2026_68820 #cve_2026_72898 #cve202620349 #cve202668820 #cve202672898

This is being actively exploited. CVE-2026-20349. Patch now. Like right now. #infosec #vpn #cisco #cve
https://www.bleepingcomputer.com/news/security/cisco-warns-of-asa-and-ftd-vpn-flaw-exploited-to-crash-devices/

CVE ID: CVE-2026-20349
Vendor: Cisco
Product: Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
Date Added: 2026-08-11
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-20349

Broadcom has several new advisories that include two critical vulnerabilities https://support.broadcom.com/web/ecx/security-advisory #Broadcom

CISA:

Industrial vulnerability: Johnson Controls C-CURE 9000 and Victor application server (Update A) https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-01

Blog post: Cyber Storm X: 20 Years of Readiness, Resilience, and Real‑World Impact https://www.cisa.gov/news-events/news/cyber-storm-x-20-years-readiness-resilience-and-real-world-impact #CISA

Cisco:

High-severity: CVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF @TalosSecurity #Cisco

Yesterday:

Tenable Research Advisories:

Medium-severity: CVE-2026-12879: Google Cloud Platform (GCP) Apigee Cross-Tenant Data Exfiltration via Confused Deputy https://www.tenable.com/security/research/tra-2026-53 #infosec #Google #vulnerability

Microsoft lança atualização de emergência para corrigir a CVE-2026-68820, uma falha de gravidade elevada no controlador Ancillary Function para WinSock. A vulnerabilidade, que afeta diversas versões do Windows, já está a ser explorada em ataques reais. 🚨

🔗 https://tugatech.com.pt/t89012-microsoft-lanca-atualizacao-de-emergencia-para-falha-no-windows-explorada-ativamente

#falha #lan #microsoft #windows 

📰 Lazarus Group Exploits Windows Zero-Day in Espionage Campaign

Microsoft patches actively exploited Windows zero-day (CVE-2026-68820) used by Lazarus Group. The bug allows SYSTEM-level access and was used in the 'Operation Dream Job' campaign to deploy rootkits against the defense sector. #CVE202668820 #Lazarus ...

🔗 https://cyber.netsecops.io/articles/lazarus-group-exploits-windows-zero-day-in-operation-dream-job/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

⚠️ CRITICAL: August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day

Microsoft patched CVE-2026-68820, a zero-day use-after-free in afd.sys kernel driver actively exploited for SYSTEM privilege escalation. This is the fourth afd.sys zero-day since 2022, with historical links to nation-state actors. All Windows systems running unpatched afd.sys are at immediate risk…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

Microsoft's newest patch cycle closes nearly 400 security holes, among them CVE-2026-62832, CVE-2026-68820, and CVE-2026-72971. That volume makes triage the hard part, so plan which systems get updated first and confirm the rollout...

https://captechgroup.com/threat-intelligence-center/microsoft-patches-nearly-400-security-holes-includ-677de8?utm_source=mastodon&utm_medium=social&utm_campaign=threat_intel&utm_content=microsoft-patches-nearly-400-security-holes-including-cve-2026-62832

🏆 New Achievement! CVE-2026-68820: The Lazarus Rises (Again)!

PHASE ONE BEGINS. Emerging from the shadows of Pyongyang's finest state-sponsored hacking collective, Lazarus has arrived — and they brought a use-after-free bug in afd.sys, the Windows kernel-mode driver, as their opening act. CVE-2026-68820 lets a low-privilege, locally authenticated attacker trigger a race condition, escalate straight to SYSTEM, and basically own the stage. (1/3)

CVE-2026-68820: CRITICAL Windows afd.sys zero-day exploited by Lazarus Group for SYSTEM access in defense/aerospace. Patch released 2026-08-11. Prioritize updates & check for ForestTiger/Troy backdoors. https://radar.offseq.com/threat/fresh-windows-zero-day-exploited-in-north-korean-cyberattacks-bbf9980a8328f4c4 #OffSeq #ZeroDay #Windows #Cybersecurity

Check Point researchers look into the latest variant of the Operation Dream Job campaign where the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of Lazarus’s kernel-mode rootkit FudModule. https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/

🚨 THREAT ALERT: CISA adds CVE-2026-68820 (Windows WinSock AFD Use-After-Free) to the KEV catalog due to active exploitation. Local attackers can elevate privileges to system level. Access our TSUITE brief with CrowdStrike CQL telemetry queries: https://thecybermind.co/jily

#CyberSecurity

「Microsoft 製品の脆弱性対策について(2026年8月)」： #IPA

「 2026年8月12日（日本時間）に Microsoft 製品に関するセキュリティ更新プログラム（月例）が公表されています。
これらの脆弱性を悪用された場合、アプリケーションプログラムが異常終了する、攻撃者によってパソコンを制御される、といった様々な被害が発生するおそれがあります。

この内 CVE-2026-68820 の脆弱性について、Microsoft 社では悪用の事実を確認済みと公表しており、今後被害が拡大するおそれがあるため、至急、セキュリティ更新プログラムを適用してください。 」

https://www.ipa.go.jp/security/security-alert/2026/0812-ms.html

#prattohome

Bugs in MS' Patch Tuesday release and NK's Lazarus has hit one already

Microsoft의 2026년 8월 Patch Tuesday는 421개 취약점을 수정했으며, 그중 Windows WinSock Ancillary Function Driver(afd.sys)의 use-after-free 취약점 CVE-2026-68820은 Lazarus 그룹이 패치 전 실제 공격에 사용한 제로데이다. 로컬 인증 사용자가 경쟁 조건을 유발해 사용자 상호작용 없이 SYSTEM 권한 코드 실행을...

https://www.theregister.com/security/2026/08/11/421-bugs-in-microsofts-patch-tuesday-release-and-the-norks-have-already-attacked-one/5286483

「マイクロソフトは、現在攻撃を受けているWindowsドライバーのゼロデイ脆弱性を含む398件の脆弱性を修正した。 」： #TheHackerNews

「マイクロソフトは火曜日に月例のセキュリティアップデートを公開したが、修正された脆弱性の1つが既に攻撃に悪用されている。

このバグは、ネットワークソケット操作を処理するWindowsカーネルの中核ドライバに存在します。既にマシン上でコードを実行している攻撃者は、このバグを利用してSYSTEM権限に昇格できます。このパッチが最初にリリースされます。

この脆弱性は CVE-2026-68820 （CVSSスコア：7.0）として追跡されており、今月のリリースでマイクロソフトが現在悪用されていると警告している唯一の脆弱性です。悪用は、ドライバーの競合状態をトリガーすることによって行われます。マイクロソフトは、この悪用を行った組織を公表していません。」

https://thehackernews.com/2026/08/microsoft-patches-398-flaws-including.html

#prattohome

Microsoft Plugs Nearly 400 Security Holes

Microsoft가 8월 Patch Tuesday에서 Windows 및 지원 소프트웨어의 취약점 최소 398건을 수정했으며, 이 중 42건은 원격 코드 실행 등으로 이어질 수 있는 Critical 등급이다. 이미 악용 중인 CVE-2026-68820은 거의 모든 Windows 엔드포인트의 소켓 연결에 관여하는 afd.sys의 권한 상승 취약점으로, 초기 침투 후 시스템 장악 체인에 사용될 수 있다. 또한 Windows User Profile Service의 CVE-2026-62832는 공개된 LegacyHive 이슈와 연관 가능성이 있으며 악용 가능성이 높은 것으로...

https://krebsonsecurity.com/2026/08/microsoft-plugs-nearly-400-security-holes/

Lazarus exploited a Windows zero-day (CVE-2026-68820) in Operation Dream Job to hit defense firms with fake job offers and a new backdoor.

#Lazarus #ZeroDay #CVE202668820 #OperationDreamJob #Cybersecurity #DPRK #FudModule #DefenseSector

https://securityonline.info/lazarus-zero-day-dream-job/?utm_source=mastodon&utm_medium=jetpack_social

Microsoft August 2026 Patch Tuesday fixes 421 flaws, including CVE-2026-68820, a WinSock zero-day exploited in the wild, plus two disclosed bugs.

#PatchTuesday #Microsoft #ZeroDay #CVE #WindowsSecurity #InfoSec

https://securityonline.info/microsoft-august-2026-patch-tuesday/?utm_source=mastodon&utm_medium=jetpack_social

Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days

Microsoft의 2026년 8월 Patch Tuesday는 총 400개 취약점(치명적 42개 포함)을 수정하며, 원격 코드 실행 110개와 권한 상승 176개가 포함된다. 특히 CVE-2026-68820은 Windows AFD.sys(WinSock Ancillary Function Driver)의 use-after-free 기반 로컬 권한 상승 취약점으로, Lazarus가 FudModule 커널 루트킷 배포에 실제 악용한 정황이 보고됐다. 공개된 Windows...

https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/

Microsoft lança atualização de emergência para corrigir a CVE-2026-68820, uma falha de gravidade elevada no controlador Ancillary Function para WinSock. A vulnerabilidade, que afeta diversas versões do Windows, já está a ser explorada em ataques reais. 🚨

🔗 https://tugatech.com.pt/t89012-microsoft-lanca-atualizacao-de-emergencia-para-falha-no-windows-explorada-ativamente

#falha #lan #microsoft #windows 

⚠️ CRITICAL: August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day

Microsoft patched CVE-2026-68820, a zero-day use-after-free in afd.sys kernel driver actively exploited for SYSTEM privilege escalation. This is the fourth afd.sys zero-day since 2022, with historical links to nation-state actors. All Windows systems running unpatched afd.sys are at immediate risk…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

🏆 New Achievement! CVE-2026-68820: The Lazarus Rises (Again)!

PHASE ONE BEGINS. Emerging from the shadows of Pyongyang's finest state-sponsored hacking collective, Lazarus has arrived — and they brought a use-after-free bug in afd.sys, the Windows kernel-mode driver, as their opening act. CVE-2026-68820 lets a low-privilege, locally authenticated attacker trigger a race condition, escalate straight to SYSTEM, and basically own the stage. (1/3)

CVE-2026-68820: CRITICAL Windows afd.sys zero-day exploited by Lazarus Group for SYSTEM access in defense/aerospace. Patch released 2026-08-11. Prioritize updates & check for ForestTiger/Troy backdoors. https://radar.offseq.com/threat/fresh-windows-zero-day-exploited-in-north-korean-cyberattacks-bbf9980a8328f4c4 #OffSeq #ZeroDay #Windows #Cybersecurity

Check Point researchers look into the latest variant of the Operation Dream Job campaign where the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of Lazarus’s kernel-mode rootkit FudModule. https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/

🚨 THREAT ALERT: CISA adds CVE-2026-68820 (Windows WinSock AFD Use-After-Free) to the KEV catalog due to active exploitation. Local attackers can elevate privileges to system level. Access our TSUITE brief with CrowdStrike CQL telemetry queries: https://thecybermind.co/jily

#CyberSecurity

「Microsoft 製品の脆弱性対策について(2026年8月)」： #IPA

「 2026年8月12日（日本時間）に Microsoft 製品に関するセキュリティ更新プログラム（月例）が公表されています。
これらの脆弱性を悪用された場合、アプリケーションプログラムが異常終了する、攻撃者によってパソコンを制御される、といった様々な被害が発生するおそれがあります。

この内 CVE-2026-68820 の脆弱性について、Microsoft 社では悪用の事実を確認済みと公表しており、今後被害が拡大するおそれがあるため、至急、セキュリティ更新プログラムを適用してください。 」

https://www.ipa.go.jp/security/security-alert/2026/0812-ms.html

#prattohome

「マイクロソフトは、現在攻撃を受けているWindowsドライバーのゼロデイ脆弱性を含む398件の脆弱性を修正した。 」： #TheHackerNews

「マイクロソフトは火曜日に月例のセキュリティアップデートを公開したが、修正された脆弱性の1つが既に攻撃に悪用されている。

このバグは、ネットワークソケット操作を処理するWindowsカーネルの中核ドライバに存在します。既にマシン上でコードを実行している攻撃者は、このバグを利用してSYSTEM権限に昇格できます。このパッチが最初にリリースされます。

この脆弱性は CVE-2026-68820 （CVSSスコア：7.0）として追跡されており、今月のリリースでマイクロソフトが現在悪用されていると警告している唯一の脆弱性です。悪用は、ドライバーの競合状態をトリガーすることによって行われます。マイクロソフトは、この悪用を行った組織を公表していません。」

https://thehackernews.com/2026/08/microsoft-patches-398-flaws-including.html

#prattohome

Lazarus exploited a Windows zero-day (CVE-2026-68820) in Operation Dream Job to hit defense firms with fake job offers and a new backdoor.

#Lazarus #ZeroDay #CVE202668820 #OperationDreamJob #Cybersecurity #DPRK #FudModule #DefenseSector

https://securityonline.info/lazarus-zero-day-dream-job/?utm_source=mastodon&utm_medium=jetpack_social

Microsoft August 2026 Patch Tuesday fixes 421 flaws, including CVE-2026-68820, a WinSock zero-day exploited in the wild, plus two disclosed bugs.

#PatchTuesday #Microsoft #ZeroDay #CVE #WindowsSecurity #InfoSec

https://securityonline.info/microsoft-august-2026-patch-tuesday/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:0811] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0811)

CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-20349 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-20349)
- Name: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
- Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20349

⚠️ CVE-2026-68820 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-68820)
- Name: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows Ancillary Function Driver for WinSock
- Notes: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-68820 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-68820

⚠️ CVE-2026-72898 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-72898)
- Name: Metabase SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Metabase
- Product: Metabase
- Notes: https://www.metabase.com/blog/security-update ; https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72898

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260811 #cisa20260811 #cve_2026_20349 #cve_2026_68820 #cve_2026_72898 #cve202620349 #cve202668820 #cve202672898

Microsoft Patch Tuesday August 2026 patches 421 CVEs including CVE-2026-68820, an actively exploited use-after-free in the kernel driver afd.sys that grants SYSTEM-level privileges. Attacks are ongoing and no operational details have been disclosed yet. Prioritize patching on exposed systems.

#PatchTuesday #ZeroDay #VulnerabilityManagement #Microsoft

https://cyberworldops.eu/en/microsoft-fixes-421-vulnerabilities-including-an-exploited-zero-day-in

CVE ID: CVE-2026-68820
Vendor: Microsoft
Product: Windows Ancillary Function Driver for WinSock
Date Added: 2026-08-11
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-68820

Microsoft's newest patch cycle closes nearly 400 security holes, among them CVE-2026-62832, CVE-2026-68820, and CVE-2026-72971. That volume makes triage the hard part, so plan which systems get updated first and confirm the rollout...

https://captechgroup.com/threat-intelligence-center/microsoft-patches-nearly-400-security-holes-includ-677de8?utm_source=mastodon&utm_medium=social&utm_campaign=threat_intel&utm_content=microsoft-patches-nearly-400-security-holes-including-cve-2026-62832

Microsoft Plugs Nearly 400 Security Holes

Microsoft가 8월 Patch Tuesday에서 Windows 및 지원 소프트웨어의 취약점 최소 398건을 수정했으며, 이 중 42건은 원격 코드 실행 등으로 이어질 수 있는 Critical 등급이다. 이미 악용 중인 CVE-2026-68820은 거의 모든 Windows 엔드포인트의 소켓 연결에 관여하는 afd.sys의 권한 상승 취약점으로, 초기 침투 후 시스템 장악 체인에 사용될 수 있다. 또한 Windows User Profile Service의 CVE-2026-62832는 공개된 LegacyHive 이슈와 연관 가능성이 있으며 악용 가능성이 높은 것으로...

https://krebsonsecurity.com/2026/08/microsoft-plugs-nearly-400-security-holes/

CVE-2026-61353 - Heap buffer overflow in Windows Telephony Service. Local privilege escalation. CVSS 7.8. Patch reported, apply immediately. #CVE #Microsoft #infosec

https://www.valtersit.com/cve/CVE-2026-61353/

Google's new Chrome security update patches 5 high-severity use-after-free bugs, including CVE-2026-19556 and CVE-2026-19560. Update now.

#Chrome #Google #UseAfterFree #CVE #BrowserSecurity #PatchNow #Cybersecurity

https://securityonline.info/chrome-use-after-free-update/?utm_source=mastodon&utm_medium=jetpack_social

Google's new Chrome security update patches 5 high-severity use-after-free bugs, including CVE-2026-19556 and CVE-2026-19560. Update now.

#Chrome #Google #UseAfterFree #CVE #BrowserSecurity #PatchNow #Cybersecurity

https://securityonline.info/chrome-use-after-free-update/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-70398 - Critical (9.6)

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a te...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-70398/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL CVE-2026-70398 in Red Hat Advanced Cluster Management for Kubernetes 2: Authenticated tenants can redirect bearer tokens via GitOpsCluster controller. No official fix. Restrict privileges & monitor activity. https://radar.offseq.com/threat/cve-2026-70398-unintended-proxy-or-intermediary-confused-deputy-in-red-hat-red-hat-advanced-cluster-3d1f26674efa89dc #OffSeq #Kubernetes #RedHat #CVE202670398

🔴 CVE-2026-70398 - Critical (9.6)

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a te...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-70398/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL CVE-2026-70398 in Red Hat Advanced Cluster Management for Kubernetes 2: Authenticated tenants can redirect bearer tokens via GitOpsCluster controller. No official fix. Restrict privileges & monitor activity. https://radar.offseq.com/threat/cve-2026-70398-unintended-proxy-or-intermediary-confused-deputy-in-red-hat-red-hat-advanced-cluster-3d1f26674efa89dc #OffSeq #Kubernetes #RedHat #CVE202670398

CRITICAL: CVE-2026-67282 in Joomla Fabrik (v1.0.0 – 4.6.7) allows unauthenticated RCE (CWE-94). No patch yet — disable or restrict Fabrik use and monitor for updates. https://radar.offseq.com/threat/cve-2026-67282-cwe-94-improper-control-of-generation-of-code-code-injection-in-fabrikarcom-fabrik-2c969cc032f2e578 #OffSeq #Joomla #Infosec #RCE #CVE202667282

CRITICAL: CVE-2026-67282 in Joomla Fabrik (v1.0.0 – 4.6.7) allows unauthenticated RCE (CWE-94). No patch yet — disable or restrict Fabrik use and monitor for updates. https://radar.offseq.com/threat/cve-2026-67282-cwe-94-improper-control-of-generation-of-code-code-injection-in-fabrikarcom-fabrik-2c969cc032f2e578 #OffSeq #Joomla #Infosec #RCE #CVE202667282

🟠 CVE-2026-66875 - High (8.8)

In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measur...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66875/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66875 - High (8.8)

In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measur...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66875/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57858 - High (8.9)

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracki...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57858/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-57858: CRITICAL stored XSS in Cal.com Self-Hosted (v2.1.1 – 6.2.0). Exploited via BookingPageTagManager by authenticated event owners; affects all booking page visitors. Patch status unknown. Restrict privileges. https://radar.offseq.com/threat/cve-2026-57858-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-953e719dabfd2c11 #OffSeq #XSS #SecOps

🟠 CVE-2026-57858 - High (8.9)

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracki...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57858/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-57858: CRITICAL stored XSS in Cal.com Self-Hosted (v2.1.1 – 6.2.0). Exploited via BookingPageTagManager by authenticated event owners; affects all booking page visitors. Patch status unknown. Restrict privileges. https://radar.offseq.com/threat/cve-2026-57858-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-953e719dabfd2c11 #OffSeq #XSS #SecOps

🟠 CVE-2026-19426 - High (8.2)

POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19426 - High (8.2)

POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2025-056
Phoenix Contact: Improper Input Validation Vulnerabilities in PLCnext Firmware

This advisory addresses multiple security vulnerabilities in PLCnext firmware versions prior to 2026.0.3. The vulnerabilities may allow unauthenticated attackers to cause denial of service, trigger unexpected system behavior, or execute unauthorized SQL queries. Successful exploitation could impact the availability, integrity, and confidentiality of affected PLCnext Control devices. All issues are resolved in PLCnext firmware version 2026.0.3.
#CVE CVE-2025-41769, CVE-2025-41770, CVE-2025-41771

https://certvde.com/en/advisories/vde-2025-056/

#CSAF https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-056.json

#OT #Advisory VDE-2025-056
Phoenix Contact: Improper Input Validation Vulnerabilities in PLCnext Firmware

This advisory addresses multiple security vulnerabilities in PLCnext firmware versions prior to 2026.0.3. The vulnerabilities may allow unauthenticated attackers to cause denial of service, trigger unexpected system behavior, or execute unauthorized SQL queries. Successful exploitation could impact the availability, integrity, and confidentiality of affected PLCnext Control devices. All issues are resolved in PLCnext firmware version 2026.0.3.
#CVE CVE-2025-41769, CVE-2025-41770, CVE-2025-41771

https://certvde.com/en/advisories/vde-2025-056/

#CSAF https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-056.json

🟠 CVE-2025-41770 - High (7.5)

An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41770/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2025-056
Phoenix Contact: Improper Input Validation Vulnerabilities in PLCnext Firmware

This advisory addresses multiple security vulnerabilities in PLCnext firmware versions prior to 2026.0.3. The vulnerabilities may allow unauthenticated attackers to cause denial of service, trigger unexpected system behavior, or execute unauthorized SQL queries. Successful exploitation could impact the availability, integrity, and confidentiality of affected PLCnext Control devices. All issues are resolved in PLCnext firmware version 2026.0.3.
#CVE CVE-2025-41769, CVE-2025-41770, CVE-2025-41771

https://certvde.com/en/advisories/vde-2025-056/

#CSAF https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-056.json

🟠 CVE-2025-41770 - High (7.5)

An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41770/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2025-056
Phoenix Contact: Improper Input Validation Vulnerabilities in PLCnext Firmware

This advisory addresses multiple security vulnerabilities in PLCnext firmware versions prior to 2026.0.3. The vulnerabilities may allow unauthenticated attackers to cause denial of service, trigger unexpected system behavior, or execute unauthorized SQL queries. Successful exploitation could impact the availability, integrity, and confidentiality of affected PLCnext Control devices. All issues are resolved in PLCnext firmware version 2026.0.3.
#CVE CVE-2025-41769, CVE-2025-41770, CVE-2025-41771

https://certvde.com/en/advisories/vde-2025-056/

#CSAF https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-056.json

BoF in a PROFINET service?! I'm shocked. Shocked! Well, not that shocked.

https://nvd.nist.gov/vuln/detail/CVE-2025-41769

🔴 CVE-2025-41769 - Critical (9.8)

The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41769/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2025-056
Phoenix Contact: Improper Input Validation Vulnerabilities in PLCnext Firmware

This advisory addresses multiple security vulnerabilities in PLCnext firmware versions prior to 2026.0.3. The vulnerabilities may allow unauthenticated attackers to cause denial of service, trigger unexpected system behavior, or execute unauthorized SQL queries. Successful exploitation could impact the availability, integrity, and confidentiality of affected PLCnext Control devices. All issues are resolved in PLCnext firmware version 2026.0.3.
#CVE CVE-2025-41769, CVE-2025-41770, CVE-2025-41771

https://certvde.com/en/advisories/vde-2025-056/

#CSAF https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-056.json

BoF in a PROFINET service?! I'm shocked. Shocked! Well, not that shocked.

https://nvd.nist.gov/vuln/detail/CVE-2025-41769

🔴 CVE-2025-41769 - Critical (9.8)

The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41769/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2025-056
Phoenix Contact: Improper Input Validation Vulnerabilities in PLCnext Firmware

This advisory addresses multiple security vulnerabilities in PLCnext firmware versions prior to 2026.0.3. The vulnerabilities may allow unauthenticated attackers to cause denial of service, trigger unexpected system behavior, or execute unauthorized SQL queries. Successful exploitation could impact the availability, integrity, and confidentiality of affected PLCnext Control devices. All issues are resolved in PLCnext firmware version 2026.0.3.
#CVE CVE-2025-41769, CVE-2025-41770, CVE-2025-41771

https://certvde.com/en/advisories/vde-2025-056/

#CSAF https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-056.json

🟠 CVE-2026-19594 - High (8.1)

Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal (CWE-22) via unencoded `..` identifier path segments, a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19594/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19594 - High (8.1)

Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal (CWE-22) via unencoded `..` identifier path segments, a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19594/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-66659 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection.

This issue affects Tablesome Table: from n/a through 1.2.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66659/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-66659: CRITICAL SQL Injection (CVSS 9.3) in Essekia Tablesome Table ≤1.2.9. Allows unauth’d blind SQLi & data disclosure. No patch yet — monitor vendor updates. https://radar.offseq.com/threat/cve-2026-66659-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-04cbf964b30f2d13 #OffSeq #SQLInjection #Vuln #Infosec

🔴 CVE-2026-66659 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection.

This issue affects Tablesome Table: from n/a through 1.2.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66659/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-66659: CRITICAL SQL Injection (CVSS 9.3) in Essekia Tablesome Table ≤1.2.9. Allows unauth’d blind SQLi & data disclosure. No patch yet — monitor vendor updates. https://radar.offseq.com/threat/cve-2026-66659-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-04cbf964b30f2d13 #OffSeq #SQLInjection #Vuln #Infosec

CVE-2026-66807 - High severity stack buffer overflow in Microsoft Office. Local code execution risk. CVSS 7.8. Patch reported—update immediately. #CVE #Microsoft #infosec

https://www.valtersit.com/cve/CVE-2026-66807/

🟠 CVE-2026-64954 - High (8.2)

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the auth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-64954/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-64954 - High (8.2)

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the auth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-64954/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New Episode: SANS Stormcast Wednesday, August 12th, 2026: Microsoft Patch Tuesday; Zoom Vulnerabilities; Mozilla Revokes Key; Rogue Inflight Wifi

Shownotes:

Microsoft Patch Tuesday
https://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%20August%202026/33236
Zoom Vulnerablities CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415
https://a.security/blog/asecurity-zoomsday
Mozilla Revokes

Transcript

AntennaPod | Anytime Player | Apple Podcasts | Castamatic | CurioCaster | Fountain | gPodder | Overcast | Pocket Casts | Podcast Addict | Podcast Guru | Podnews | Podverse | Truefans

Or Listen right here.

🟠 CVE-2026-18961 - High (8.1)

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18961/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18961 - High (8.1)

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18961/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73122 - High (7.7)

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73122/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73122 - High (7.7)

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73122/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6484 - High (8.2)

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6484 - High (8.2)

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-72526 (CRITICAL, CVSS 9.9) in Red Hat Advanced Cluster Management for Kubernetes 2 lets low-priv hub users escalate to cluster-admin on managed clusters. No official fix. Restrict Application creation permissions now. https://radar.offseq.com/threat/cve-2026-72526-unintended-proxy-or-intermediary-confused-deputy-in-red-hat-red-hat-advanced-cluster-d135ff679a7da34d #OffSeq #RedHat #Kubernetes #CVE2026_72526

🔴 CVE-2026-72526 - Critical (9.9)

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to creat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72526/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-72526 (CRITICAL, CVSS 9.9) in Red Hat Advanced Cluster Management for Kubernetes 2 lets low-priv hub users escalate to cluster-admin on managed clusters. No official fix. Restrict Application creation permissions now. https://radar.offseq.com/threat/cve-2026-72526-unintended-proxy-or-intermediary-confused-deputy-in-red-hat-red-hat-advanced-cluster-d135ff679a7da34d #OffSeq #RedHat #Kubernetes #CVE2026_72526

🔴 CVE-2026-72526 - Critical (9.9)

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to creat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72526/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66878 - High (7.7)

A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Nam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66878/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66878 - High (7.7)

A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Nam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66878/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Mira Firmware v1.7.1.47 has a CRITICAL auth bug (CVE-2026-68067): login accepts any valid-format password, exposing hormone records. No patch yet; restrict access & monitor accounts. https://radar.offseq.com/threat/cve-2026-68067-cwe-1390-weak-authentication-in-quanovate-tech-inc-operating-as-mira-mira-care-mira-85cdd6a62acb5a46 #OffSeq #Vulnerability #IoTSecurity #CVE202668067

🔴 CVE-2026-68067 - Critical (9.8)

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud acc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-68067/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Mira Firmware v1.7.1.47 has a CRITICAL auth bug (CVE-2026-68067): login accepts any valid-format password, exposing hormone records. No patch yet; restrict access & monitor accounts. https://radar.offseq.com/threat/cve-2026-68067-cwe-1390-weak-authentication-in-quanovate-tech-inc-operating-as-mira-mira-care-mira-85cdd6a62acb5a46 #OffSeq #Vulnerability #IoTSecurity #CVE202668067

🔴 CVE-2026-68067 - Critical (9.8)

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud acc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-68067/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-67568 - Critical (9.1)

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67568/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-67568 (CRITICAL, CVSS 9.3) in Mira Firmware 1.7.1.47: Hard-coded credentials let remote attackers read/write sensitive health data. No patch yet — restrict network access & monitor logs. https://radar.offseq.com/threat/cve-2026-67568-cwe-798-use-of-hard-coded-credentials-in-quanovate-tech-inc-operating-as-mira-mira-care-535c1a595418b62d #OffSeq #CVE202667568 #infosec #medtech #vuln

🔴 CVE-2026-67568 - Critical (9.1)

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67568/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-67568 (CRITICAL, CVSS 9.3) in Mira Firmware 1.7.1.47: Hard-coded credentials let remote attackers read/write sensitive health data. No patch yet — restrict network access & monitor logs. https://radar.offseq.com/threat/cve-2026-67568-cwe-798-use-of-hard-coded-credentials-in-quanovate-tech-inc-operating-as-mira-mira-care-535c1a595418b62d #OffSeq #CVE202667568 #infosec #medtech #vuln

Google's new Chrome security update patches 5 high-severity use-after-free bugs, including CVE-2026-19556 and CVE-2026-19560. Update now.

#Chrome #Google #UseAfterFree #CVE #BrowserSecurity #PatchNow #Cybersecurity

https://securityonline.info/chrome-use-after-free-update/?utm_source=mastodon&utm_medium=jetpack_social

Google's new Chrome security update patches 5 high-severity use-after-free bugs, including CVE-2026-19556 and CVE-2026-19560. Update now.

#Chrome #Google #UseAfterFree #CVE #BrowserSecurity #PatchNow #Cybersecurity

https://securityonline.info/chrome-use-after-free-update/?utm_source=mastodon&utm_medium=jetpack_social

SonicWall patched a critical GMS vulnerability, CVE-2026-66147 (CVSS 9.4), enabling unauthenticated remote code execution. Update to 9.5.2 now.

#SonicWall #CVE #RCE #GMS #EmailSecurity #InfoSec

https://securityonline.info/sonicwall-gms-rce-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

SonicWall patched a critical GMS vulnerability, CVE-2026-66147 (CVSS 9.4), enabling unauthenticated remote code execution. Update to 9.5.2 now.

#SonicWall #CVE #RCE #GMS #EmailSecurity #InfoSec

https://securityonline.info/sonicwall-gms-rce-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-73247 - High (8.6)

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73247/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73247 - High (8.6)

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73247/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-15562 - High (7.5)

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of ser...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15562/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-18948: CRITICAL in RHOAI Feast — unsafe UDF deserialization allows unauth RCE on feature-server. Auth attackers can bypass auth to run code on registry-server. Mitigate by enforcing `auth.type: kubernetes`. https://radar.offseq.com/threat/cve-2026-18948-vulnerability-in-red-hat-red-hat-openshift-ai-rhoai-ae1bc718efe1cce9 #OffSeq #RedHat #CVE #infosec

🔴 CVE-2026-18948 - Critical (9.9)

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18948/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18951 - High (8.8)

A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permissions into the native Kubernetes `edit ClusterRole`. This allows any user with `edit Clus...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18951/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18947 - High (8.5)

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permissi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18947/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

OpenSSHの脆弱性(Medium: CVE-2026-73282, Low: CVE-2026-73281, CVE-2026-73283)とOpenSSH 10.5リリース - SIOS SECURITY BLOG https://security.sios.jp/vulnerability/openssh-security-vulnerability-20260812/

OpenSSHの脆弱性(Medium: CVE-2026-73282, Low: CVE-2026-73281, CVE-2026-73283)とOpenSSH 10.5リリース - SIOS SECURITY BLOG https://security.sios.jp/vulnerability/openssh-security-vulnerability-20260812/

OpenSSHの脆弱性(Medium: CVE-2026-73282, Low: CVE-2026-73281, CVE-2026-73283)とOpenSSH 10.5リリース - SIOS SECURITY BLOG https://security.sios.jp/vulnerability/openssh-security-vulnerability-20260812/

OpenSSHの脆弱性(Medium: CVE-2026-73282, Low: CVE-2026-73281, CVE-2026-73283)とOpenSSH 10.5リリース - SIOS SECURITY BLOG https://security.sios.jp/vulnerability/openssh-security-vulnerability-20260812/

🟠 CVE-2026-18949 - High (8.8)

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18949/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-16985: Squeeze WP plugin <1.7.12 has a CRITICAL vuln — users with upload_files can upload PHP files, enabling remote code execution. Restrict permissions, monitor uploads, and check for updates. https://radar.offseq.com/threat/cve-2026-16985-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-squeeze-a1de64d348b6591f #OffSeq #WordPress #CVE2026_16985 #infosec

OpenSSHの脆弱性(Medium: CVE-2026-73282, Low: CVE-2026-73281, CVE-2026-73283)とOpenSSH 10.5リリース - SIOS SECURITY BLOG https://security.sios.jp/vulnerability/openssh-security-vulnerability-20260812/

OpenSSHの脆弱性(Medium: CVE-2026-73282, Low: CVE-2026-73281, CVE-2026-73283)とOpenSSH 10.5リリース - SIOS SECURITY BLOG https://security.sios.jp/vulnerability/openssh-security-vulnerability-20260812/

🟠 CVE-2026-55676 - High (8.8)

Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55676/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Red Hat JBoss EAP 7 hit by CVE-2026-10579 (CRITICAL, CVSS 9.8): SAML handler flaw lets unauthenticated attackers forge access as any user. Patch available — apply ASAP. Full details: https://radar.offseq.com/threat/cve-2026-10579-vulnerability-in-red-hat-red-hat-jboss-enterprise-application-platform-7-8ca4df02d00ed318 #OffSeq #RedHat #Vuln #CVE202610579

🟠 CVE-2026-73231 - High (7.8)

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73231/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18950 - High (8.8)

A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the `roleRef` field, allowing a user to specify an arbitrary role,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18950/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Securing your software supply chain shouldn't be manual work. 🤖 Our latest tutorial dives deep into automating dependency scanning within your CI/CD pipelines to block vulnerabilities like CVE-2021-44228. Elevate your DevSecOps game today! https://cvedatabase.com/blog/automating-dependency-scanning-a-practical-guide-to-securing-your-ci-cd-pipeline-2026-08-10 #SCA #DevSecOps #CICD #InfoSec #CyberSecurity #Automation

🟠 CVE-2026-73224 - High (8.8)

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73224/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

「Cisco社、ClamAVの深刻な脆弱性と公開されているエクスプロイトについて警告 」： #BLEEPINGCOMPUTER

「Ciscoは、Secure Endpoint Connectorに影響を与える2つの深刻な脆弱性について警告を発した。これらの脆弱性により、攻撃者はサービス拒否（DoS）攻撃においてClamAVのスキャンプロセスをクラッシュさせることができる。

これらのセキュリティ上の欠陥（ CVE-2026-20337 および CVE-2026-20338 として追跡）は、マルウェアのファイルスキャンに使用されるオープンソースかつクロスプラットフォームのエンジンであるClamAV（Clam AntiVirus）のZIPアーカイブパーサーで発見されました。

シスコが金曜日に発表した勧告によると、これら2つの脆弱性はそれぞれ不適切な境界チェックとメモリ処理に起因するものであり、認証されていないリモート攻撃者によって悪用される可能性がある。 」

https://www.bleepingcomputer.com/news/security/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits/

#prattohome

「Cisco社、ClamAVの深刻な脆弱性と公開されているエクスプロイトについて警告 」： #BLEEPINGCOMPUTER

「Ciscoは、Secure Endpoint Connectorに影響を与える2つの深刻な脆弱性について警告を発した。これらの脆弱性により、攻撃者はサービス拒否（DoS）攻撃においてClamAVのスキャンプロセスをクラッシュさせることができる。

これらのセキュリティ上の欠陥（ CVE-2026-20337 および CVE-2026-20338 として追跡）は、マルウェアのファイルスキャンに使用されるオープンソースかつクロスプラットフォームのエンジンであるClamAV（Clam AntiVirus）のZIPアーカイブパーサーで発見されました。

シスコが金曜日に発表した勧告によると、これら2つの脆弱性はそれぞれ不適切な境界チェックとメモリ処理に起因するものであり、認証されていないリモート攻撃者によって悪用される可能性がある。 」

https://www.bleepingcomputer.com/news/security/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits/

#prattohome

The security flaws (tracked as CVE-2026-20337 and CVE-2026-20338) were found in the ZIP archive parser of ClamAV (Clam AntiVirus), the open-source and cross-platform engine used to scan files for malware. https://www.bleepingcomputer.com/news/security/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits/

Cisco disclosed seven high-severity vulnerabilities in ClamAV, the open-source antivirus engine used in Secure Endpoint Connector across Windows, macOS, and Linux. Two of the flaws (CVE-2026-20337 and CVE-2026-20338) already have public proof-of-concept exploits, elevating the risk. The vulnerabilities can trigger denial-of-service conditions.

#ClamAV #Cisco #CVE #InfoSec

https://cyberworldops.eu/en/cisco-reports-seven-high-severity-clamav-flaws-two-pocs-available

New.

CISA: Gunra Ransomware Advisory https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a

Cisco:

Advisory for a high-severity vulnerability first published on August 7:

CVE-2026-20337, CVE-2026-20338, and CVE-2026-20339: ClamAV Vulnerabilities Affecting Cisco Products: August 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26 @TalosSecurity #Cisco #infosec #CISA #ransomware #cybercrime #vulnerability

Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days

Tag
CVE ID
CVE Title
Severity
.NET
CVE-2026-58641
.NET Elevation of Privilege Vulnerability
Important
.NET
CVE-2026-62901
.NET Denial…
#NewsBeep #News #US #USA #UnitedStates #UnitedStatesOfAmerica #Technology
https://www.newsbeep.com/us/810540/

Microsoft's newest patch cycle closes nearly 400 security holes, among them CVE-2026-62832, CVE-2026-68820, and CVE-2026-72971. That volume makes triage the hard part, so plan which systems get updated first and confirm the rollout...

https://captechgroup.com/threat-intelligence-center/microsoft-patches-nearly-400-security-holes-includ-677de8?utm_source=mastodon&utm_medium=social&utm_campaign=threat_intel&utm_content=microsoft-patches-nearly-400-security-holes-including-cve-2026-62832

Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days

Tag
CVE ID
CVE Title
Severity
.NET
CVE-2026-58641
.NET Elevation of Privilege Vulnerability
Important
.NET
CVE-2026-62901
.NET Denial…
#NewsBeep #News #US #USA #UnitedStates #UnitedStatesOfAmerica #Technology
https://www.newsbeep.com/us/810540/

CVE-2026-56721 - Privilege escalation in CamaleonCMS ≤2.9.2 via IDOR. Authenticated low-priv users can overwrite any credentials. CVSS 8.8. Unpatched - update immediately. #CVE #CamaleonCMS #infosec

https://www.valtersit.com/cve/CVE-2026-56721/

🟠 CVE-2026-56721 - High (8.8)

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confus...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56721/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New Episode: SANS Stormcast Wednesday, August 12th, 2026: Microsoft Patch Tuesday; Zoom Vulnerabilities; Mozilla Revokes Key; Rogue Inflight Wifi

Shownotes:

Microsoft Patch Tuesday
https://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%20August%202026/33236
Zoom Vulnerablities CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415
https://a.security/blog/asecurity-zoomsday
Mozilla Revokes

Transcript

AntennaPod | Anytime Player | Apple Podcasts | Castamatic | CurioCaster | Fountain | gPodder | Overcast | Pocket Casts | Podcast Addict | Podcast Guru | Podnews | Podverse | Truefans

Or Listen right here.

New Episode: SANS Stormcast Wednesday, August 12th, 2026: Microsoft Patch Tuesday; Zoom Vulnerabilities; Mozilla Revokes Key; Rogue Inflight Wifi

Shownotes:

Microsoft Patch Tuesday
https://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%20August%202026/33236
Zoom Vulnerablities CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415
https://a.security/blog/asecurity-zoomsday
Mozilla Revokes

Transcript

AntennaPod | Anytime Player | Apple Podcasts | Castamatic | CurioCaster | Fountain | gPodder | Overcast | Pocket Casts | Podcast Addict | Podcast Guru | Podnews | Podverse | Truefans

Or Listen right here.

🟠 CVE-2026-67180 - High (8.4)

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-13738 (CRITICAL, CVSS 9.2) affects Commvault Cloud CommServe: authorization bypass enables unauthorized command execution. Affects v11.36.0 – 11.46.0. Upgrade all components. https://radar.offseq.com/threat/cve-2026-13738-cwe-863-incorrect-authorization-in-commvault-commvault-cloud-723a8b64e139288c #OffSeq #CVE #CloudSecurity #SysAdmin

🟠 CVE-2026-73079 - High (8.5)

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73079/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Vulnerabilities in #Mastodon
URL: https://github.com/mastodon/mastodon/security/advisories/GHSA-7jvv-fhmg-wpfw
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5
CVEs: CVE-2026-72914, CVE-2026-72915, CVE-2026-72916
See also:
- https://github.com/mastodon/mastodon/security/advisories/GHSA-hx34-2pfw-2qfj
- https://github.com/mastodon/mastodon/security/advisories/GHSA-vwhj-3g83-v276

CVE-2026-72914 (CVSS: 7.5): A Mastodon statistics endpoint intended for
instance administrators was checking for the appropriate permissions before
returning the results, but not before computing them, allowing anyone to issue
potentially expensive requests.

CVE-2026-72915 (CVSS: 7.5): Mastodon versions 4.6.0 to 4.6.4 allow any
logged-in local user to access personally-identifying information about other
local-users due to an incorrect access control validation.

CVE-2026-72916 (CVSS: 6.3): By nature, Mastodon performs a lot of outbound
requests to user-provided domains. Mastodon however has some protection
mechanism to disallow requests to local IP addresses (unless specified in
ALLOWED_PRIVATE_ADDRESSES) to avoid the “confused deputy” problem. The list of
disallowed IP address ranges was lacking the IPv4-compatible IPv6 address
range that can be used to reach local IP addresses on specific configurations.

Vulnerabilities in #Mastodon
URL: https://github.com/mastodon/mastodon/security/advisories/GHSA-7jvv-fhmg-wpfw
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5
CVEs: CVE-2026-72914, CVE-2026-72915, CVE-2026-72916
See also:
- https://github.com/mastodon/mastodon/security/advisories/GHSA-hx34-2pfw-2qfj
- https://github.com/mastodon/mastodon/security/advisories/GHSA-vwhj-3g83-v276

CVE-2026-72914 (CVSS: 7.5): A Mastodon statistics endpoint intended for
instance administrators was checking for the appropriate permissions before
returning the results, but not before computing them, allowing anyone to issue
potentially expensive requests.

CVE-2026-72915 (CVSS: 7.5): Mastodon versions 4.6.0 to 4.6.4 allow any
logged-in local user to access personally-identifying information about other
local-users due to an incorrect access control validation.

CVE-2026-72916 (CVSS: 6.3): By nature, Mastodon performs a lot of outbound
requests to user-provided domains. Mastodon however has some protection
mechanism to disallow requests to local IP addresses (unless specified in
ALLOWED_PRIVATE_ADDRESSES) to avoid the “confused deputy” problem. The list of
disallowed IP address ranges was lacking the IPv4-compatible IPv6 address
range that can be used to reach local IP addresses on specific configurations.

🟠 CVE-2026-72915 - High (7.5)

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72915/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-48161 | CRITICAL: dai-shi react18-use had malicious postinstall script — RCE on dev machines via npm install. Not in npm registry, but local checkouts may be compromised. Rotate creds & reimage if affected. https://radar.offseq.com/threat/cve-2026-48161-cwe-506-embedded-malicious-code-in-dai-shi-react18-use-f46bf3ec395447fd #OffSeq #SupplyChain #CVE #npm #infosec

CRITICAL path traversal (CVE-2026-13716, CVSS 9.1) found in Crafty Controller v4.4.0 (Arcadia). Authenticated attackers can upload files to arbitrary paths, risking RCE. Restrict admin/file upload access & monitor activity. Details: https://radar.offseq.com/threat/cve-2026-13716-cwe-35-path-traversal-in-arcadia-technology-llc-crafty-controller-2cdd2d33980b3ceb #OffSeq #Vuln #CVE202613716

🟠 CVE-2026-72903 - High (8.1)

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir() and _makeFile() u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72903/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-67179 - High (7.8)

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registere...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67179/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-18786: CRITICAL auth bypass in CheckView WP plugin ≤2.0.29. Attackers can exploit REST API via crafted links to perform admin actions if an admin clicks. Restrict plugin REST API & avoid suspicious links. https://radar.offseq.com/threat/cve-2026-18786-cwe-287-improper-authentication-in-checkview-8f35dcb91728f992 #OffSeq #WordPress #CVE202618786

🔴 CVE-2026-73080 - Critical (9.3)

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the response i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73080/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Tracked as CVE-2026-18129, the first is described as a cleartext transmission of sensitive information issue that can be exploited by an attacker in a man-in-the-middle (MitM) position to leak credentials for external SQL connections. https://www.securityweek.com/ivanti-epm-update-patches-remotely-exploitable-flaws/

Tracked as CVE-2026-18129, the first is described as a cleartext transmission of sensitive information issue that can be exploited by an attacker in a man-in-the-middle (MitM) position to leak credentials for external SQL connections. https://www.securityweek.com/ivanti-epm-update-patches-remotely-exploitable-flaws/

CVE-2026-58115 is a CVSS 10 flaw letting unauthenticated attackers run code on SIMATIC IoT2050 via Node-RED. Siemens urges an immediate update.

#CVE202658115 #Siemens #NodeRED #RCE #SIMATIC #ICS #Cybersecurity

https://securityonline.info/simatic-iot2050-node-red-rce/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-58115 is a CVSS 10 flaw letting unauthenticated attackers run code on SIMATIC IoT2050 via Node-RED. Siemens urges an immediate update.

#CVE202658115 #Siemens #NodeRED #RCE #SIMATIC #ICS #Cybersecurity

https://securityonline.info/simatic-iot2050-node-red-rce/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-18972 (CRITICAL): Rapid7 Velociraptor <0.77.2 lets low-priv users escalate to admin by spoofing 'Grpc-Metadata-USER' header — full account takeover. No patch yet. Restrict GUI access, monitor requests. https://radar.offseq.com/threat/cve-2026-18972-cwe-290-authentication-bypass-by-spoofing-in-rapid7-velociraptor-72ecf6c68bed741e #OffSeq #Velociraptor #CVE202618972

🔴 CVE-2026-72864 - Critical (9.9)

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72864/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44763 - High (7.6)

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the at...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44763/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

The vulnerability, assigned the CVE identifier CVE-2026-58231, is rated 10.0 on the CVSS scoring system. It has been described as a case of insufficient authorization checks and input validation. https://thehackernews.com/2026/08/sap-commerce-cloud-flaw-could-let.html

SAP Issues Emergency-Grade Patch for CVSS 100 Commerce Cloud Flaw That Could Enable Unauthenticated Code Execution + Video

A Critical Warning for SAP Enterprise Customers A maximum-severity vulnerability in SAP Commerce Cloud has put enterprise e-commerce environments under renewed security pressure. The newly identified flaw, tracked as CVE-2026-58231, carries the highest possible CVSS score of 10.0 and could allow an unauthenticated attacker to execute arbitrary code…

https://undercodenews.com/sap-issues-emergency-grade-patch-for-cvss-100-commerce-cloud-flaw-that-could-enable-unauthenticated-code-execution-video/?utm_source=mastodon&utm_medium=jetpack_social

SAP August 2026 Patch Day Fixes Critical Code Injection and Memory Corruption Flaws

SAP's August 2026 Security Patch Day addresses 31 vulnerabilities, including a critical CVSS 10.0 authentication bypass in Commerce Cloud and code injection flaws in Manufacturing Integration and Intelligence. These vulnerabilities allow remote attackers to execute arbitrary commands and gain unauthorized access to internal enterprise systems.

**If you run SAP products, especially Manufacturing Integration and Intelligence (MII) read the advisory in detail. First make sure these systems are isolated from the internet where possible and reachable only from trusted internal networks. Then apply SAP's August 2026 security notes ASAP starting with the critical fixes for Commerce Cloud (CVE-2026-58231) and MII (CVE-2026-44772, CVE-2026-44758), followed by the ABAP Platform patch (CVE-2026-34265).**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/sap-august-2026-patch-day-fixes-critical-code-injection-and-memory-corruption-flaws-p-s-x-p-k/gD2P6Ple2L

The vulnerability, assigned the CVE identifier CVE-2026-58231, is rated 10.0 on the CVSS scoring system. It has been described as a case of insufficient authorization checks and input validation. https://thehackernews.com/2026/08/sap-commerce-cloud-flaw-could-let.html

SAP August 2026 Patch Day Fixes Critical Code Injection and Memory Corruption Flaws

SAP's August 2026 Security Patch Day addresses 31 vulnerabilities, including a critical CVSS 10.0 authentication bypass in Commerce Cloud and code injection flaws in Manufacturing Integration and Intelligence. These vulnerabilities allow remote attackers to execute arbitrary commands and gain unauthorized access to internal enterprise systems.

**If you run SAP products, especially Manufacturing Integration and Intelligence (MII) read the advisory in detail. First make sure these systems are isolated from the internet where possible and reachable only from trusted internal networks. Then apply SAP's August 2026 security notes ASAP starting with the critical fixes for Commerce Cloud (CVE-2026-58231) and MII (CVE-2026-44772, CVE-2026-44758), followed by the ABAP Platform patch (CVE-2026-34265).**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/sap-august-2026-patch-day-fixes-critical-code-injection-and-memory-corruption-flaws-p-s-x-p-k/gD2P6Ple2L

SAP August 2026 Patch Day fixes CVE-2026-58231 (CVSS 10.0) and code injection RCE flaws scoring 9.9 and 9.8 across Commerce Cloud and NetWeaver.

#SAP #CVE #RCE #PatchTuesday #NetWeaver #InfoSec

http://securityonline.info/sap-august-2026-patch-day/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-71217 - High (7.5)

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper inp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71217/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-72693 - High (7.8)

`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc//fd/0")`....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72693/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Win Men Intermational Travel Agency Management System has a CRITICAL SQL Injection flaw (CVE-2026-19425, CVSS 9.8). Unauthenticated attackers may fully compromise databases. No patch yet: restrict access & monitor for SQLi. https://radar.offseq.com/threat/cve-2026-19425-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-c590b6d3eb66ff09 #OffSeq #CVE202619425 #SQLInjection #InfoSec

Grafana MCP Server hit by CRITICAL SSRF (CVE-2026-19516, CVSS 9.1) via X-Grafana-URL header. Attackers can access internal endpoints and metadata. Restrict access & monitor usage until patch available. https://radar.offseq.com/threat/cve-2026-19516-cwe-918-in-grafana-grafana-mcp-server-3995ac1dff45c6f5 #OffSeq #Grafana #SSRF #Vuln

🟠 CVE-2026-58243 - High (8.8)

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58243/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66763 - High (7.9)

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66763/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SAP August 2026 Patch Day Fixes Critical Code Injection and Memory Corruption Flaws

SAP's August 2026 Security Patch Day addresses 31 vulnerabilities, including a critical CVSS 10.0 authentication bypass in Commerce Cloud and code injection flaws in Manufacturing Integration and Intelligence. These vulnerabilities allow remote attackers to execute arbitrary commands and gain unauthorized access to internal enterprise systems.

**If you run SAP products, especially Manufacturing Integration and Intelligence (MII) read the advisory in detail. First make sure these systems are isolated from the internet where possible and reachable only from trusted internal networks. Then apply SAP's August 2026 security notes ASAP starting with the critical fixes for Commerce Cloud (CVE-2026-58231) and MII (CVE-2026-44772, CVE-2026-44758), followed by the ABAP Platform patch (CVE-2026-34265).**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/sap-august-2026-patch-day-fixes-critical-code-injection-and-memory-corruption-flaws-p-s-x-p-k/gD2P6Ple2L

SAP August 2026 Patch Day Fixes Critical Code Injection and Memory Corruption Flaws

SAP's August 2026 Security Patch Day addresses 31 vulnerabilities, including a critical CVSS 10.0 authentication bypass in Commerce Cloud and code injection flaws in Manufacturing Integration and Intelligence. These vulnerabilities allow remote attackers to execute arbitrary commands and gain unauthorized access to internal enterprise systems.

**If you run SAP products, especially Manufacturing Integration and Intelligence (MII) read the advisory in detail. First make sure these systems are isolated from the internet where possible and reachable only from trusted internal networks. Then apply SAP's August 2026 security notes ASAP starting with the critical fixes for Commerce Cloud (CVE-2026-58231) and MII (CVE-2026-44772, CVE-2026-44758), followed by the ABAP Platform patch (CVE-2026-34265).**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/sap-august-2026-patch-day-fixes-critical-code-injection-and-memory-corruption-flaws-p-s-x-p-k/gD2P6Ple2L

Time to patch your Kernel...
CVSS v3.0 Base Score: 9,8 / 10

3714806 - [CVE-2026-34265] Memory Corruption vulnerability in Application Server #ABAP for #SAP NetWeaver and ABAP Platform

https://me.sap.com/notes/3714806

🔴 CVE-2026-34265 - Critical (9.8)

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the sy...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34265/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-34265: CRITICAL out-of-bounds write in SAP NetWeaver & ABAP Platform (CVSS 9.8) allows unauthenticated memory corruption. No patch yet — restrict access & monitor SAP advisories for updates. https://radar.offseq.com/threat/cve-2026-34265-cwe-787-out-of-bounds-write-in-sapse-sap-netweaver-and-abap-platform-d60f14fafe8af8b8 #OffSeq #SAP #Vuln #Cybersecurity

SAP August 2026 Patch Day Fixes Critical Code Injection and Memory Corruption Flaws

SAP's August 2026 Security Patch Day addresses 31 vulnerabilities, including a critical CVSS 10.0 authentication bypass in Commerce Cloud and code injection flaws in Manufacturing Integration and Intelligence. These vulnerabilities allow remote attackers to execute arbitrary commands and gain unauthorized access to internal enterprise systems.

**If you run SAP products, especially Manufacturing Integration and Intelligence (MII) read the advisory in detail. First make sure these systems are isolated from the internet where possible and reachable only from trusted internal networks. Then apply SAP's August 2026 security notes ASAP starting with the critical fixes for Commerce Cloud (CVE-2026-58231) and MII (CVE-2026-44772, CVE-2026-44758), followed by the ABAP Platform patch (CVE-2026-34265).**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/sap-august-2026-patch-day-fixes-critical-code-injection-and-memory-corruption-flaws-p-s-x-p-k/gD2P6Ple2L

SAP August 2026 Patch Day Fixes Critical Code Injection and Memory Corruption Flaws

SAP's August 2026 Security Patch Day addresses 31 vulnerabilities, including a critical CVSS 10.0 authentication bypass in Commerce Cloud and code injection flaws in Manufacturing Integration and Intelligence. These vulnerabilities allow remote attackers to execute arbitrary commands and gain unauthorized access to internal enterprise systems.

**If you run SAP products, especially Manufacturing Integration and Intelligence (MII) read the advisory in detail. First make sure these systems are isolated from the internet where possible and reachable only from trusted internal networks. Then apply SAP's August 2026 security notes ASAP starting with the critical fixes for Commerce Cloud (CVE-2026-58231) and MII (CVE-2026-44772, CVE-2026-44758), followed by the ABAP Platform patch (CVE-2026-34265).**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/sap-august-2026-patch-day-fixes-critical-code-injection-and-memory-corruption-flaws-p-s-x-p-k/gD2P6Ple2L

🔴 CVE-2026-44758 - Critical (9.1)

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44758/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SAP MII 15.5 is exposed to CRITICAL code injection (CVE-2026-44758, CVSS 9.1). High-privilege users could execute arbitrary OS commands. No patch yet — restrict access & monitor for code injection. https://radar.offseq.com/threat/cve-2026-44758-cwe-94-improper-control-of-generation-of-code-in-sapse-sap-manufacturing-integration-a0b460ddbf734b9d #OffSeq #SAP #Infosec #CVE202644758

Asus posted an advisory today. Scroll down for the full list:

CVE-2026-8917: Security Update for ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and Armoury Crate Security Bulletin https://www.asus.com/security-advisory/

PC Gamer: It's time to update Asus Armoury Crate and several other Asus software tools again, as another high severity security vulnerability has been discovered https://www.pcgamer.com/software/security/its-time-to-update-asus-armoury-crate-and-several-other-asus-software-tools-again-as-another-high-severity-security-vulnerability-has-been-discovered/ #infosec #vulnerability #Asus

🟠 CVE-2026-73030 - High (8.1)

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73030/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-63622 - High (7.8)

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63622/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-63106 - Critical (9.8)

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in Pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-72901 - Critical (9.9)

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.cre...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72901/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-72689 - High (7.5)

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents us...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72689/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-71576 - High (8.5)

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certific...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71576/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-66738 - Critical (9.8)

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal q...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66738/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-72691 - High (7.5)

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72691/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-13206: CRITICAL OS command injection in Zyxel WAH7601 (≤20072026). Remote, unauthenticated code execution possible — no patch yet. Restrict access & monitor vendor updates. Details: https://radar.offseq.com/threat/cve-2026-13206-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-16288f4bcb3de542 #OffSeq #CVE #Zyxel #Vuln #InfoSec

Or this one - does that links actually document the vulnerability?

https://nvd.nist.gov/vuln/detail/CVE-2026-18933

GStreamer gst-plugins-ugly (asfdemux) in Red Hat Enterprise Linux 10 is affected by CVE-2026-19389 (HIGH, CVSS 7.1). Parsing crafted ASF/WMV/WMA files may lead to DoS or info leaks. No patch yet — avoid untrusted media. https://radar.offseq.com/threat/cve-2026-19389-integer-overflow-or-wraparound-in-red-hat-red-hat-enterprise-linux-10-8bd45ea7a574114c #OffSeq #Linux #CVE #GStreamer

🟠 CVE-2026-19387 - High (7.6)

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19387/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Falha com 18 anos no Linux entrega controlo máximo de administrador. Uma falha de segurança identificada como CVE-2026-64564 permite que utilizadores com acesso local prévio escalarem privilégios até atingirem o estatuto máximo no sistema operativo. 🚨

🔗 https://tugatech.com.pt/t88893-falha-com-18-anos-no-linux-entrega-controlo-maximo-de-administrador

#administrador #controlo #entrega #falha #linux 

CVE-2026-67261: Dell VSI RCE Flaw Scores CVSS 9.8

https://securityonline.info/dell-vsi-cve-2026-67261-unauthenticated-rce/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-67261: Dell VSI RCE Flaw Scores CVSS 9.8

https://securityonline.info/dell-vsi-cve-2026-67261-unauthenticated-rce/?utm_source=mastodon&utm_medium=jetpack_social

New.

CISA: Gunra Ransomware Advisory https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a

Cisco:

Advisory for a high-severity vulnerability first published on August 7:

CVE-2026-20337, CVE-2026-20338, and CVE-2026-20339: ClamAV Vulnerabilities Affecting Cisco Products: August 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26 @TalosSecurity #Cisco #infosec #CISA #ransomware #cybercrime #vulnerability

「Cisco社、ClamAVの深刻な脆弱性と公開されているエクスプロイトについて警告 」： #BLEEPINGCOMPUTER

「Ciscoは、Secure Endpoint Connectorに影響を与える2つの深刻な脆弱性について警告を発した。これらの脆弱性により、攻撃者はサービス拒否（DoS）攻撃においてClamAVのスキャンプロセスをクラッシュさせることができる。

これらのセキュリティ上の欠陥（ CVE-2026-20337 および CVE-2026-20338 として追跡）は、マルウェアのファイルスキャンに使用されるオープンソースかつクロスプラットフォームのエンジンであるClamAV（Clam AntiVirus）のZIPアーカイブパーサーで発見されました。

シスコが金曜日に発表した勧告によると、これら2つの脆弱性はそれぞれ不適切な境界チェックとメモリ処理に起因するものであり、認証されていないリモート攻撃者によって悪用される可能性がある。 」

https://www.bleepingcomputer.com/news/security/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits/

#prattohome

「Cisco社、ClamAVの深刻な脆弱性と公開されているエクスプロイトについて警告 」： #BLEEPINGCOMPUTER

「Ciscoは、Secure Endpoint Connectorに影響を与える2つの深刻な脆弱性について警告を発した。これらの脆弱性により、攻撃者はサービス拒否（DoS）攻撃においてClamAVのスキャンプロセスをクラッシュさせることができる。

これらのセキュリティ上の欠陥（ CVE-2026-20337 および CVE-2026-20338 として追跡）は、マルウェアのファイルスキャンに使用されるオープンソースかつクロスプラットフォームのエンジンであるClamAV（Clam AntiVirus）のZIPアーカイブパーサーで発見されました。

シスコが金曜日に発表した勧告によると、これら2つの脆弱性はそれぞれ不適切な境界チェックとメモリ処理に起因するものであり、認証されていないリモート攻撃者によって悪用される可能性がある。 」

https://www.bleepingcomputer.com/news/security/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits/

#prattohome

The security flaws (tracked as CVE-2026-20337 and CVE-2026-20338) were found in the ZIP archive parser of ClamAV (Clam AntiVirus), the open-source and cross-platform engine used to scan files for malware. https://www.bleepingcomputer.com/news/security/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits/

Cisco disclosed seven high-severity vulnerabilities in ClamAV, the open-source antivirus engine used in Secure Endpoint Connector across Windows, macOS, and Linux. Two of the flaws (CVE-2026-20337 and CVE-2026-20338) already have public proof-of-concept exploits, elevating the risk. The vulnerabilities can trigger denial-of-service conditions.

#ClamAV #Cisco #CVE #InfoSec

https://cyberworldops.eu/en/cisco-reports-seven-high-severity-clamav-flaws-two-pocs-available

New.

CISA: Gunra Ransomware Advisory https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a

Cisco:

Advisory for a high-severity vulnerability first published on August 7:

CVE-2026-20337, CVE-2026-20338, and CVE-2026-20339: ClamAV Vulnerabilities Affecting Cisco Products: August 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26 @TalosSecurity #Cisco #infosec #CISA #ransomware #cybercrime #vulnerability

🚨 CRITICAL THREAT ALERT: CVE-2026-8037 is under active exploitation per CISA KEV. Progress LoadMaster appliances face remote command injection risks. Secure your perimeter with our strategic C-Suite breakdown covering technical indicators, backdoor mechanics, and hardening protocols.
https://thecybermind.co/2j7b

⚠️ CRITICAL: CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability

Progress Kemp LoadMaster has a critical RCE vulnerability (CVE-2026-8037) that allows unauthenticated attackers to execute arbitrary commands. Active exploitation started around June 29. Any organization running affected LoadMaster versions needs to patch immediately or risk full appliance compromi…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

CVE-2026-5423 is an authentication bypass in @neo4j/graphql that lets unauthenticated clients forge JWT claims and read subscription data.

#Neo4j #GraphQL #CVE20265423 #AuthenticationBypass #JWT #InfoSec

https://securityonline.info/neo4j-graphql-authentication-bypass/?utm_source=mastodon&utm_medium=jetpack_social

ACTUALLY...

CVE-2026-34966 -> https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc -> CVE-2026-59765

... did they double assign without retraction?

motherf... https://nvd.nist.gov/vuln/detail/cve-2026-34966

Why is this a vulncheck CVE, gitea got their own CNA!

CVE-2026-71319 lets attackers run arbitrary commands via unauthenticated Nuxt DevTools RPC. CVSS 9.6, 7.3M monthly downloads. Patch now.

#Nuxt #VueJS #CVE #RCE #CyberSecurity

http://securityonline.info/nuxt-devtools-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-71319 lets attackers run arbitrary commands via unauthenticated Nuxt DevTools RPC. CVSS 9.6, 7.3M monthly downloads. Patch now.

#Nuxt #VueJS #CVE #RCE #CyberSecurity

http://securityonline.info/nuxt-devtools-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

A CISA szerint már aktívan kihasználják a TeamCity CVE-2026-63077 távoli kódfuttatási hibáját

https://linuxmint.hu/hir/2026/08/a-cisa-szerint-mar-aktivan-kihasznaljak-a-teamcity-cve-2026-63077-tavoli-kodfuttatasi

https://nvd.nist.gov/vuln/detail/CVE-2026-71249 like, look at this shit

Like, please read this: https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_5-3_Public_References

And then tell me that this CVE https://nvd.nist.gov/vuln/detail/CVE-2026-55739 is sufficiently documented by the one and only reference https://github.com/crater-invoice-inc/crater , the landing page for a project that has not had a release in 4 years (years before the vulnerability was presumably assigned)

CVE-2026-10090: Red Hat ACM Privilege Escalation Flaw Grants Cluster-Admin, Rated CVSS 9.9

http://securityonline.info/red-hat-acm-privilege-escalation/?utm_source=mastodon&utm_medium=jetpack_social

Gunra Ransomware Targets Infrastructure via Fortinet Flaws

Gunra Ransomware is exploiting critical Fortinet flaws, including CVE-2024-55591, to gain super-admin privileges and infiltrate government and critical infrastructure networks. This alarming vulnerability allows remote attackers to craft requests and bypass authentication, putting sensitive systems at risk.

https://osintsights.com/gunra-ransomware-targets-infrastructure-via-fortinet-flaws?utm_source=mastodon&utm_medium=social

#GunraRansomware #Fortinet #Cve202455591 #Ransomware #SupplyChain

Gunra Ransomware Targets Infrastructure via Fortinet Flaws

Gunra Ransomware is exploiting critical Fortinet flaws, including CVE-2024-55591, to gain super-admin privileges and infiltrate government and critical infrastructure networks. This alarming vulnerability allows remote attackers to craft requests and bypass authentication, putting sensitive systems at risk.

https://osintsights.com/gunra-ransomware-targets-infrastructure-via-fortinet-flaws?utm_source=mastodon&utm_medium=social

#GunraRansomware #Fortinet #Cve202455591 #Ransomware #SupplyChain

PoC exploit code is public for CVE-2026-61515, an unauthenticated command injection in Puwell IP Camera firmware. CVSS 9.3. Details inside.

#IPCamera #IoT #CVE #CommandInjection #CyberSecurity

http://securityonline.info/puwell-ip-camera-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

PoC exploit code is public for CVE-2026-61515, an unauthenticated command injection in Puwell IP Camera firmware. CVSS 9.3. Details inside.

#IPCamera #IoT #CVE #CommandInjection #CyberSecurity

http://securityonline.info/puwell-ip-camera-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

StormEncryptor: come l’ex affiliato Medusa Storm-1175 ha trasformato N-central in un launchpad ransomware

https://insicurezzadigitale.com/stormencryptor-come-lex-affiliato-medusa-storm-1175-ha-trasformato-n-central-in-un-launchpad-ransomware/

Like a fighting-game boss mid-match suddenly swapping movesets, it exploited CVE-2026-18577, an authentication-bypass zero-day in N-able's N-central RMM tool, to get inside.

N-able dropped a hotfix on August 2 — patch to build 2026.3.1.7 immediately, and hunt for rogue svchost.exe files in user Documents folders, a Cloudflared service, or suspicious inbound connections listed in the advisory.

Reward: You've received the Cursed Badge of the Late Patcher — equip it at your peril. (2/2)

Storm-1175, a China-nexus financially motivated threat actor, is distributing the StormEncryptor ransomware by exploiting a critical zero-day in ConnectWise N-central (CVE-2026-18577). First exploitation was detected July 31, with ransomware deployment beginning August 2. Targeting MSPs amplifies downstream impact across hundreds of managed clients.

#Storm1175 #Ransomware #Ncentral #MSPSecurity

https://cyberworldops.eu/en/storm-1175-exploits-critical-n-central-flaw-to-target-msps

📰 VMware Patches Critical VM Escape Flaw (CVE-2026-47876) in ESXi

Broadcom patches critical VMware flaws, including a VM escape in ESXi (CVE-2026-47876) and unauthenticated RCE in vCenter (CVE-2026-59309, CVE-2026-59310). CVSS scores up to 9.8. Immediate patching is crucial. #VMware #CyberSecurity #PatchTuesday

🔗 https://cyber.netsecops.io/articles/vmware-patches-critical-vm-escape-vulnerability-cve-2026-47876-in-esxi/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

VMware vCenter Under Attack: Critical CVE-2026-59310 Exploited in a Rapid Global Intrusion Campaign + Video

A New Warning for Virtualization Administrators Virtualization infrastructure has quietly become one of the most valuable targets in modern cyberattacks. A compromised workstation can expose one user or one endpoint, but a compromised virtualization-management server can potentially open a path toward dozens, hundreds, or even thousands of workloads. That is why…

https://undercodenews.com/vmware-vcenter-under-attack-critical-cve-2026-59310-exploited-in-a-rapid-global-intrusion-campaign-video/?utm_source=mastodon&utm_medium=jetpack_social

The vulnerability in question is CVE-2026-59310 (CVSS score: 9.8), a directory-traversal vulnerability in the VMware vCenter server that a malicious actor with network access can exploit to execute arbitrary code. https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html

The vulnerability in question is CVE-2026-59310 (CVSS score: 9.8), a directory-traversal vulnerability in the VMware vCenter server that a malicious actor with network access can exploit to execute arbitrary code. https://thehackernews.com/2026/08/attackers-exploit-vmware-vcenter.html

📰 VMware Patches Critical VM Escape Flaw (CVE-2026-47876) in ESXi

Broadcom patches critical VMware flaws, including a VM escape in ESXi (CVE-2026-47876) and unauthenticated RCE in vCenter (CVE-2026-59309, CVE-2026-59310). CVSS scores up to 9.8. Immediate patching is crucial. #VMware #CyberSecurity #PatchTuesday

🔗 https://cyber.netsecops.io/articles/vmware-patches-critical-vm-escape-vulnerability-cve-2026-47876-in-esxi/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

📰 VMware Patches Critical VM Escape Flaw (CVE-2026-47876) in ESXi

Broadcom patches critical VMware flaws, including a VM escape in ESXi (CVE-2026-47876) and unauthenticated RCE in vCenter (CVE-2026-59309, CVE-2026-59310). CVSS scores up to 9.8. Immediate patching is crucial. #VMware #CyberSecurity #PatchTuesday

🔗 https://cyber.netsecops.io/articles/vmware-patches-critical-vm-escape-vulnerability-cve-2026-47876-in-esxi/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

CVE-2026-64560: Linux Kernel CPU Timer Use-After-Free Gives a Root Shell, PoC Exploit Code Publicly Disclosed

https://securityonline.info/linux-kernel-cpu-timer-flaw/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-64560: Linux Kernel CPU Timer Use-After-Free Gives a Root Shell, PoC Exploit Code Publicly Disclosed

https://securityonline.info/linux-kernel-cpu-timer-flaw/?utm_source=mastodon&utm_medium=jetpack_social

@jurjen_heeck @malwaretech it might be not so much agentic yet. There is however a growing number of CVE’s with AI, like CVE-2026-64747 and the early release by Apple recently of multiple fixes as a result https://www.reuters.com/business/apple-says-it-is-releasing-updates-early-response-ai-cybersecurity-concerns-2026-06-29/

@jurjen_heeck @malwaretech it might be not so much agentic yet. There is however a growing number of CVE’s with AI, like CVE-2026-64747 and the early release by Apple recently of multiple fixes as a result https://www.reuters.com/business/apple-says-it-is-releasing-updates-early-response-ai-cybersecurity-concerns-2026-06-29/

CISA has confirmed active ransomware exploitation of CVE-2026-45659, a remote code execution flaw in Microsoft SharePoint. The vulnerability was added to the Known Exploited Vulnerabilities catalog on July 1st with a mandatory 3-day remediation deadline for federal agencies.

#SharePoint #Ransomware #CISA #CVE202645659

https://cyberworldops.eu/en/sharepoint-cisa-confirms-ransomware-exploitation-of-cve-2026-45659

CVE-2026-45659 - Changed to Known Ransomware Status

Microsoft SharePoint Server Deserialization of Untrusted Data VulnerabilityVendor: MicrosoftProduct: SharePoint ServerMicrosoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.Status changed from Unknown to Known for ransomware campaign usage.Flip detected on: August 10, 2026 at 17:08:17 UTCDate https://nvd.nist.gov/vuln/detail/CVE-2026-45659