HOTNEWS 2026 January(174) February(168) March(221) April(222) May(261) June(255) July(464) August(446) September(518) October(115) November(0) December(0) | HOTNEWS 2026(2844) STATISTICS (7358) | ARCHIVE
|
DATE |
NAME |
INFO |
CATEGORY |
SUBCATE |
|
19.10.26 |
CVE-2025-61624 | Fortinet Multiple Products Path Traversal Vulnerability: FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. | ||
|
19.10.26 |
CVE-2026-102764 | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability: BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. | ||
|
19.10.26 |
CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability: Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. | ||
|
19.10.26 |
CVE-2026-0322 | Palo Alto Networks PAN-OS Code Injection Vulnerability: Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. | ||
|
19.10.26 |
CVE-2026-105133 | Ahsay AhsayCBS Improper Authentication Vulnerability: Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. | ||
|
19.10.26 |
CVE-2026-76519 | Cisco Secure Email Gateway Relative Path Traversal Vulnerability: Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. | ||
|
19.10.26 |
CVE-2026-105134 | Ahsay AhsayCBS Command Injection Vulnerability: Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. | ||
|
19.10.26 |
CVE-2026-96951 | Microsoft Windows Command Injection Vulnerability: Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. | ||
|
19.10.26 |
CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. | ||
|
19.10.26 |
Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials | The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are providing this Public Service Announcement (PSA) to raise awareness of the cyber threats facing election and campaign officials during the upcoming 2026 U.S. midterm elections. | IC3 | IC3 PRESS |
|
19.10.26 |
Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation |
This document sets out ten voluntary key practices to
guide emerging approaches in the management of incidents that might
occur during the training and evaluation of super intelligence (SI)
agents. While these incidents highlight the importance of traditional cybersecurity principles and practices, they also introduce novel considerations for incident prevention, response, and reporting. These novel considerations primarily stem from the agentic nature and advanced cyber capabilities of cutting-edge SI systems. |
REPORT | REPORT |
|
19.10.26 |
CVE-2025-61624 | Fortinet Multiple Products Path Traversal Vulnerability | KEV | KEV |
|
19.10.26 |
CVE-2026-102764 | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | KEV | KEV |
|
19.10.26 |
CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | KEV | KEV |
|
19.10.26 |
CVE-2026-110447 | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. | VULNEREBILITY | VULNEREBILITY |
|
19.10.26 |
Proxyjacking | Proxyjacking Edge Devices Into Residential Proxies | HACKING | HACKING |
|
19.10.26 |
The Validation Gap: What Automated Pentesting Alone Cannot See | A Practitioner's Guide to Evaluating Security Validation Across Your Full Attack Surface | REPORT | REPORT |
|
19.10.26 |
CVE-2026-33032 | Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware treats as "allow all". | VULNEREBILITY | VULNEREBILITY |
|
19.10.26 |
The 2026 State of Agentic AI in Pentesting |
Insights from 200 security leaders on the future of AI-driven offensive security | REPORT | REPORT |
|
19.10.26 |
CVE-2026-89108 | SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. | VULNEREBILITY | VULNEREBILITY |
|
19.10.26 |
CVE-2026-58231 | SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. | VULNEREBILITY | VULNEREBILITY |
|
19.10.26 |
CVE-2026-58240 | SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. | VULNEREBILITY | VULNEREBILITY |
|
19.10.26 |
ConnectWise incident | From time to time, ConnectWise will provide communications on broader security related topics that may not be linked to a specific ConnectWise product or vulnerability, but are still of importance to our partner community. | INCIDENT | INCIDENT |
|
17.10.26 |
CVE-2025-61624 | Fortinet Multiple Products Path Traversal Vulnerability | KEV | KEV |
|
17.10.26 |
CVE-2026-102764 | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | KEV | KEV |
|
17.10.26 |
XWorm Reborn | In September 2024, Netskope Threat Labs first reported on XWorm and its infection chain. The following year, in July 2025, we reported version 6.0 and its more advanced features. As we continued tracking the malware over the past year, we identified four distinct XWorm versions operating concurrently in the wild. | MALWARE | INFOSTEALER |
|
17.10.26 |
cikabika | Darktrace researchers investigate CikaBika Bot, a Rust-based remote access trojan delivered through a document-themed lure. The malware uses a Nim loader, PowerShell UAC bypass and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity. | MALWARE | BOT |
|
17.10.26 |
MALFEX | The MALFEX campaign is a long-running npm supply-chain attack that delivers Remote Access Trojans (RAT), information stealers, or open Node.js processes as payloads. Learn about how the attack works, how to find out if you’re impacted, and what response actions to take. | CAMPAIGN | CAMPAIGN |
|
17.10.26 |
Qilin Ransomware | Qilin ransomware combines file encryption with an affiliate operation that manages victims, ransom negotiations, and stolen-data publication. Different intrusion teams deploy its payloads, so identifying Qilin does not automatically identify the attacker or the method used to enter a network. | RANSOM | RANSOM |
|
17.10.26 |
YuanKong RAT | Most Android RATs try hard to hide their server. This one barely hides anything and that turns out to be the interesting part. The dropper leaves the key under the mat: a vault-config.json sitting in assets/ right next to the ciphertext it unlocks, holding the key and IV in cleartext. | MALWARE | RAT |
|
17.10.26 |
Rokarolla | The Rokarolla Android banking trojan combines fake login screens, message collection, and remote device interaction. With the required permissions, it can steal credentials and manipulate legitimate app interfaces. | MALWARE | ANDROID |
|
17.10.26 |
BlockStrap | BlockStrap (CVE-2026-103849) is a CVSS 10.0 Magento and Adobe Commerce flaw that gives unauthenticated attackers remote code execution. Adobe fixed it on October 13 in APSB26-153 but requires a manual patch, while new installs remain vulnerable. | VULNEREBILITY | VULNEREBILITY |
|
17.10.26 |
QuartzLine | QuartzLine is a working PDF viewer with a backdoor hidden inside. In public analysis so far, the attacker never sent a command in any traffic researchers could decrypt. | MALWARE | BACKDOOR |
|
17.10.26 |
Big Fish | Calif frequently publishes our offensive research and work, but we otherwise don't draw much attention to the defensive work we do — assisting open source projects with remediation, patch generation, cryptographic improvements, and internal engineering projects we carry out for our clients. | EXPLOIT | EXPLOIT |
|
17.10.26 |
PhantomPolia | The campaign uses PhantomPolia, a JavaScript loader that retrieves an encrypted configuration from an Ethereum Sepolia smart contract through public Remote Procedure Call (RPC) endpoints. The loader then decrypts the configuration locally using PBKDF2 and AES-GCM, revealing the next-stage command-and-control (C2) domain without exposing it directly on the compromised site. | CAMPAIGN | CAMPAIGN |
|
17.10.26 |
PwnEscape | On August 18, 2026, Vercel announced a $1 million challenge inviting researchers to break the isolation boundary of its Sandbox product (total prize pool). The announcement came just weeks after OpenAI had disclosed a remarkable security incident: | VULNEREBILITY | VULNEREBILITY |
|
17.10.26 |
n0n Group | A month after its first leak site postings, the n0n extortion group has turned its attention to global shipping. On October 12, 2026, the group added 38 organizations to its Dark Web leak site in one batch: container terminals in Brazil, Spain, Morocco, India and Vietnam, shipping lines in Singapore, China and Taiwan, port IT providers in Kuwait, Indonesia and Germany, and a dense cluster of South Korean operators. | GROUPS | GROUPS |
|
17.10.26 |
ARTokens 5.1.2 | ARTokens (also reported as ARToken) is a Microsoft 365 device code phishing kit previously documented by Cisco Talos. It has re-emerged in recent campaigns with notable changes to its implementation and deployment options. | PHISHING | PHISHING KIT |
|
17.10.26 |
ARMORY CASTLE | On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. The successful exploitation of this vulnerability results in the arbitrary upload of files. | EXPLOIT | EXPLOIT |
|
17.10.26 |
GhostX | Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025. Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX. | MALWARE | RAT |
|
17.10.26 |
Warden Stealer | Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in our user base. | MALWARE | STEALER |
|
17.10.26 |
Aoki | Newer versions of a little-documented infostealer steal API keys and tokens from ever-growing number of AI coding assistants, including Claude, Codex, Cursor and Gemini. | MALWARE | INFOSTEALER |
|
17.10.26 |
UAT-11985 | Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. | GROUPS | GROUPS |
|
17.10.26 |
UAT-6275 | Cisco Talos identified UAT-6275 (TAG-193 by Recorded Future) activity targeting government organizations across the Commonwealth of Independent States (CIS). Recovered artifacts show additional interest in water resources and energy. This focus is consistent with intelligence collection and may reflect the regional effects of the Russia–Ukraine war. | GROUPS | GROUPS |
|
16.10.26 |
PEERSTITCH | Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance. | MALWARE | ARM64 |
|
16.10.26 |
CVE-2025-61624 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, | ||
|
16.10.26 |
TAG-193 | TAG-193’s Regional Espionage Operations | GROUPS | GROUPS |
|
16.10.26 |
Hydra Saiga | Hydra Saiga: Covert Espionage and Infiltration of Critical Utilities | GROUPS | GROUPS |
|
16.10.26 |
CVE-2025-25257 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. | ||
|
16.10.26 |
CVE-2026-99999 | In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. | ||
|
16.10.26 |
Candiru | Candiru is a secretive Israel-based company that sells spyware exclusively to governments. Using Internet scanning, we identified more than 750 websites linked to Candiru’s spyware infrastructure. | MALWARE | SPYWARE |
|
15.10.26 |
AdFection | How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware | MALWARE | Ad |
|
15.10.26 |
KGB RAT | KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize | MALWARE | RAT |
|
15.10.26 |
Mitigating Insider Threats to U.S. Election Systems | Elections in the United States are administered at the state and local levels of government, creating a diverse landscape of election systems and technologies across the country. Our national exercise in self-government also requires the support of vast groups of people, including election workers, vendors, contractors, temporary workers, and volunteers. | IC3 | IC3 INDUSTRY |
|
15.10.26 |
FBI Cautions About Threats to Election Workers Ahead of the November 2026 Midterm Election | Threats to election workers not only endanger the safety of the individuals involved but also jeopardize the stability of the US electoral process. The FBI defines "election workers" broadly as individuals who have responsibility over one or more aspects of election administration, including elected officials, appointed officials, staff, volunteers, contractors, vendors, and liaisons. | IC3 | IC3 PRESS |
|
15.10.26 |
FBI Warns Voters on Election Crimes Ahead of the November 2026 Midterm Election | Free and fair democratic elections are one of the foundational pillars of the United States. The FBI is committed to protecting every eligible citizen's right to vote. Consistent with past practice, the FBI is providing this information to educate voters about federal election crimes and how to avoid them, and to encourage voters to report suspected violations to the FBI. | IC3 | IC3 PRESS |
|
15.10.26 |
Scammers Exploit 2026 U.S. Midterm Election to Perpetrate Multiple Fraud Schemes | The FBI warns the public that scammers could exploit the 2026 US Midterm Election to perpetrate financial fraud schemes. These schemes target victims across the United States and have previously exploited state and local elections. This PSA is an update to alert number I-102924-PSA, published on 29 October 2024, titled “Scammers Exploit 2024 US General Election to Perpetrate Multiple Fraud Schemes.” | IC3 | IC3 PRESS |
|
15.10.26 |
GHSA-673q-mjm6-r5xr | App Router apps with Cache Components enabled, where a use cache function returns more than one typed array | ||
|
15.10.26 |
GHSA-2464-fhr4-w9xw | Apps that pass attacker-supplied SVG files to sharp on glibc-based Linux | ||
|
15.10.26 |
GHSA-p3m5-59mp-jv5r | App Router apps with at least one Server Action | ||
|
15.10.26 |
CVE-2026-108097 | Drupal core - Critical - Remote code execution - SA-CORE-2026-014 | ||
|
15.10.26 |
CVE-2026-15176 | Heap overflow in a worker process: crash, possibly code execution | ||
|
15.10.26 |
CVE-2026-93479 | Heap overflow in a worker process: crash, possibly code execution | ||
|
15.10.26 |
CVE-2026-97205 | Use-after-free in a worker process: crash, memory corruption, possibly code execution | ||
|
15.10.26 |
CVE-2026-95101 | Extra bytes injected into a proxied request, or a body past client_max_body_size | ||
|
15.10.26 |
CVE-2026-97629 | A forged TLS session that could bypass client-certificate verification (non-deterministic and beyond the attacker's control, F5 says) | ||
|
15.10.26 |
GhostAction campaign | GitGuardian reported a campaign titled "GhostAction": attackers with write access to GitHub repositories - gained by an unknown initial access vector - added a malicious GitHub Actions workflow that exfiltrates CI/CD secrets via HTTP POST to an attacker-controlled endpoint. | ||
|
15.10.26 |
CVE-2026-105740 | Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server | ||
|
15.10.26 |
CVE-2026-105133 | A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. | ||
|
15.10.26 |
CVE-2026-105134 | A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. | ||
|
15.10.26 |
CVE-2026-0322 | Palo Alto Networks PAN-OS Code Injection Vulnerability | KEV | KEV |
|
15.10.26 |
CVE-2026-76519 | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | KEV | KEV |
|
15.10.26 |
CVE-2026-105133 | Ahsay AhsayCBS Improper Authentication Vulnerability | KEV | KEV |
|
15.10.26 |
CVE-2026-105134 | Ahsay AhsayCBS Command Injection Vulnerability | KEV | KEV |
|
15.10.26 |
Iron Man | Resecurity identified and mapped the infrastructure supporting a commercial phishing-kit-as-a-service (PhaaS) operation marketed under the name “Iron Man System.” The kit is sold to criminal buyers as a self-hosted package that deploys pre-built lure pages impersonating postal and courier services, toll and traffic-fine authorities, tax agencies, banks, telecoms and loyalty programmes, then captures the data victims submit. | PHISHING | PHAAS |
|
15.10.26 |
Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. | ||
|
15.10.26 |
Cisco Secure Email Gateway Arbitrary File Write Vulnerability | A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.This vulnerability is due to improper handling of email attachments when the file | ||
|
14.10.26 |
Google BoringSSL Name Constraints Bypass in SAN Validation Logic | Five Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 concern the legacy crypto/x509 path; .11 concerns the newer pki path. Two have been fixed, one is accepted, one is disputed, and one was declined. | ALERT | ALERT |
|
14.10.26 |
Multiple TLS Libraries can Bypass Delegation Enforcement | This note covers thirteen library-specific records (VU#948176.6, .8–.19) of how widely used TLS libraries apply X.509 Name Constraints. The records describe cases where a constrained name may be accepted by one library and rejected by another. Some are fixed, some remain under review, and some were not accepted as security issues. | ALERT | ALERT |
|
14.10.26 |
Bisheng has authentication bypass vulnerabilities | Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (IDOR) vulnerability that exposes cross-user workflow data; | ALERT | ALERT |
|
14.10.26 |
Komodo Periphery Agent Contains an OS Command Injection Vulnerability | Versions <= 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execute arbitrary commands as root on the underlying host, enabling persistent compromise of infrastructure. | ALERT | ALERT |
|
14.10.26 |
Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration | Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. | ALERT | ALERT |
|
14.10.26 |
Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation | This note covers differences in how TLS libraries interpret X.509 Name Constraints. A certificate that one library accepts may be rejected by another. Some of those differences are defects; others follow from behavior that RFC 5280 does not fully specify. | ALERT | ALERT |
|
14.10.26 |
XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE | Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. | ALERT | ALERT |
|
14.10.26 |
Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1 | Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template injection (SSTI), stored and reflected cross-site scripting (XSS), unauthorized URL redirection, and other risks that expose both server-side and client-side attack surfaces. | ALERT | ALERT |
|
14.10.26 |
Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability | A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated | ||
|
14.10.26 |
CVE-2026-96951 | (CVSS score: 8.8) - A command injection vulnerability in Windows Shell that allows an unauthorized attacker to bypass a security feature over a network. | ||
|
14.10.26 |
CVE-2026-108398 | (CVSS score: 8.8) - An untrusted search path vulnerability in .NET Framework that allows an authorized attacker to bypass a security feature locally. | ||
|
14.10.26 |
CVE-2026-92707 | (CVSS score: 5.3) - An improperly controlled sequential memory allocation vulnerability in MessagePack-CSharp that allows an unauthorized attacker to deny service over a network. | ||
|
14.10.26 |
CVE-2026-109412 | An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information. | ||
|
14.10.26 |
CVE-2026-106042 | An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application. | ||
|
14.10.26 |
CVE-2026-89111 | OAuth2 SSRF vulnerability in SAP Cloud SDK for Python | ||
|
14.10.26 |
CVE-2026-96951 | Microsoft Windows Command Injection Vulnerability | KEV | KEV |
|
14.10.26 |
CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | KEV | KEV |
|
14.10.26 |
CVE-2026-92392 | During an upload, curl mishandles HTTP/2 RST_STREAM received from the server (with reason HTTP_1_1_REQUIRED or REFUSED_STREAM) leading to a use after free of a struct Curl_easy object. | ||
|
14.10.26 |
CVE-2026-83498 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | ||
|
14.10.26 |
Vghost | vq->meta_iotlb[] caches the IOTLB mapping behind each vring metadata region (desc / avail / used). VHOST_SET_VRING_ADDR and VHOST_SET_VRING_NUM do not reset that cache. With a device IOTLB attached, a live vq can translate a reconfigured vring through a mapping that no longer covers it. vhost_vq_meta_fetch() has no range check, and the result is passed to __copy_to_user() / __copy_from_user(). | ||
|
14.10.26 |
Hirudo | Hirudo: From Fake Updates to Patched Banking Apps | MALWARE | BANKING |
|
14.10.26 |
CVE-2026-85045 | Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||
|
14.10.26 |
CVE-2026-78952 | Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||
|
13.10.26 |
CVE-2026-97229 | GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. | ||
|
13.10.26 |
CVE-2026-92883 | GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users’ browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output. | ||
|
13.10.26 |
CVE-2026-16301 | GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service. | ||
|
13.10.26 |
CVE-2026-14814 | GitLab has remediated an issue that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users’ CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references. | ||
|
13.10.26 |
CVE-2026-81839 | GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group’s privileges due to improper cleanup of scheduled pipeline execution policy records. | ||
|
13.10.26 |
CVE-2026-96893 | GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction. | ||
|
13.10.26 |
CVE-2026-101168 | GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events. | ||
|
13.10.26 |
CVE-2026-7767 | GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy. | ||
|
13.10.26 |
CVE-2026-16275 | GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks. | ||
|
13.10.26 |
CVE-2026-84284 | GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks. | ||
|
13.10.26 |
CVE-2026-85529 | GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to improper authorization in the GraphQL API. | ||
|
13.10.26 |
CVE-2026-100755 | GitLab has remediated an issue that, under certain deployment configurations, could have allowed an authenticated user to poison cached page content served to other users due to improper cache key construction. | ||
|
13.10.26 |
CVE-2026-78335 | GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained Personal Access Token to modify integrations belonging to a group outside the token’s scope, due to incorrect authorization checks. | ||
|
13.10.26 |
CVE-2026-100104 | GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a time-of-check to time-of-use race condition in URL validation during repository import operations. | ||
|
13.10.26 |
CVE-2026-82632 | GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with a fine-grained Personal Access Token scoped only to user-boundary import permissions to import projects into group namespaces beyond the token’s intended scope, due to incorrect authorization of the import target namespace. | ||
|
13.10.26 |
CVE-2026-103549 | GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that package protection rules restrict to higher roles, due to improper authorization checks. | ||
|
13.10.26 |
CVE-2026-9268 | GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization, due to insufficient access control checks. | ||
|
13.10.26 |
CVE-2026-85947 | Create a persistent administrator account, potentially giving complete administrative control of the server | ||
|
13.10.26 |
CVE-2026-85948 | Gain persistent administrative control, through an XQuery injection flaw in a deprecated Management API path | ||
|
13.10.26 |
CVE-2026-85955 | Run server-side code with elevated permissions | ||
|
13.10.26 |
CVE-2026-85956 | Back up or restore forests outside its own database, allowing access to or changes to what Progress calls "security-critical data" | ||
|
13.10.26 |
CVE-2026-9191 | Perform unauthorized actions or compromise an authenticated session | ||
|
13.10.26 |
Keenadu | Android devices ship with firmware-level malware | MALWARE | ANDROID |
|
13.10.26 |
Android.Phantom | Android.Phantom trojans are bundled with modded games and popular apps to infiltrate smartphones. They use machine learning and video broadcasts to engage in click fraud | MALWARE | ANDROID |
|
12.10.26 |
CVE-2026-102258 | Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC). | ||
|
12.10.26 |
CVE-2026-102257 | A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution. | ||
|
12.10.26 |
CVE-2026-102256 | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution. | ||
|
10.10.26 |
FakeGit Infrastructure Re-Armed in Large-Scale RePointing Campaign | According to Apiiro, security researchers observed a massive automated campaign re-arming a fleet of more than 17,000 malicious GitHub repositories linked to the FakeGit ecosystem. Skipping the need for new infrastructure, the threat actor utilizes a tactic termed RePointing, executing rapid, automated commits to update existing project README files so their download links redirect to fresh ZIP archives. | ALERTS | CAMPAIGN |
|
10.10.26 |
Earth Sirrush Espionage Group Refines Toolset Against Ukrainian Targets | Researchers at TrendAI recently reported on Earth Sirrush, a Russia-aligned intrusion set, also tracked as UAC-0099 and previously as SHADOW-EARTH-065, that has run espionage operations since at least 2022. Its targets are mainly Ukrainian government bodies, defense organizations, border units and logistics operators, reached through spear-phishing lures that pose as the national police, border guard, tax and justice authorities. | ALERTS | APT |
|
10.10.26 |
AI-Branded Ad Phishing campaign | In a recent write-up, researchers at Island detail a human-operated phishing platform disguised as a range of AI advertising products, including a fake "Muse Ads" tool that went live eight days after Meta announced Muse. The campaign targets agency staff, media buyers and Google Ads manager-account administrators, whose accounts carry stored payment methods and access to multiple client accounts. Victims arrive through invitation emails at a branded product page. | ALERTS | PHISHING |
|
10.10.26 |
Targeted Intrusion Campaign Leverages Trojanized Coding Assessments | Researchers at Unit 42 from Palo Alto Networks recently reported on an intrusion campaign designated as Blinder Tunnel, which targeted critical infrastructure entities in Iraq. The threat actor behind the activity impersonated the IT department of an aviation enterprise to deliver trojanized coding assessments to targeted individuals. | ALERTS | HACKING |
|
10.10.26 |
Cling botnet | In a recent write-up, Nozomi Networks details a novel botnet dubbed Cling that targets internet-exposed IoT and networking devices. Per the report, initial access relied on exploiting a known vulnerability in Realtek Jungle SDK diagnostic components (CVE-2021-35394) alongside multiple command-injection flaws across router and CCTV products. | ALERTS | BOTNET |
|
10.10.26 |
BPFDoor and AVERAT activity continues | Researchers at Rapid7 recently reported a cluster of Linux malware targeting telecom and network-edge environments with regionalized process spoofing. The activity involves a dropper that deploys customized builds of BPFDoor, BPF Rekoobe, and a new modular implant tracked as AVERAT. | ALERTS | VIRUS |
|
10.10.26 |
Vidar and Remus infostealers distributed with help of new 2CLoader | Zscaler ThreatLabz uncovered a previously undocumented loader malware dubbed 2CLoader. This modular loader has been observed facilitating the delivery of credential-harvesting tools including Vidar and Remus, alongside the XWorm malware strain. | ALERTS | VIRUS |
|
10.10.26 |
CVE-2025-30241 | Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise. | ||
|
10.10.26 |
CVE-2025-30240 | The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem. | ||
|
10.10.26 |
CVE-2025-30239 | In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information. | ||
|
10.10.26 |
CVE-2025-30238 | In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings. | ||
|
10.10.26 |
CVE-2025-30237 | The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device. | ||
|
10.10.26 |
CVE-2026-47483 | NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption by submitting concurrent unauthenticated profiling requests. | ||
|
10.10.26 |
GhostAction | New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials | ||
|
10.10.26 |
ARTEX | Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance | GROUPS | GROUPS |
|
10.10.26 |
SCARLET LOOP | A model discovers and qualifies 6,171 companies that move money. An autonomous agent tests credentials and exploits login weaknesses. At least 11,832 credentials validated as active across 107 countries. | ||
|
10.10.26 |
ProFTPD Improper Access Control Vulnerability: ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. |
|||
|
10.10.26 |
ONLYOFFICE Docs Server Path Traversal Vulnerability: ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. |
|||
|
10.10.26 |
Strapi Cleartext Storage of Sensitive Information Vulnerability: Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. |
|||
|
10.10.26 |
Apache Struts Command Injection Vulnerability: Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. |
|||
|
10.10.26 |
ISC BIND Data Processing Errors Vulnerability: ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. |
|||
|
10.10.26 |
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability: Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. |
|||
|
10.10.26 |
Dire Wolf Ransomware is a double-extortion ransomware first observed in April 2025. By August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services. |
|||
|
10.10.26 |
Earth Sirrush has repeatedly changed its tools and delivery methods, but TrendAI™ Research reveals how shared code, reused artifacts, and infrastructure patterns continue to expose the links between its campaigns. |
|||
|
10.10.26 |
tensorlake@0.5.144 on npm steals credentials when you install it, then tries to spread to other packages and repos. It also sets a trap. If you revoke the GitHub token it stole, a background job on your machine deletes your home directory. |
PYTHON |
||
|
10.10.26 |
CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. |
PYTHON |
||
|
10.10.26 |
Exploring what the agent's default execution role and stolen credentials can actually do, and how they became an entry point to the entire region - discovering and invoking other agents, reading, deleting and hijacking private conversations through chat history tampering, and more. |
AI |
||
|
10.10.26 |
AgentCorruption: Credential Theft from AWS's Secrets Manager and More |
Up to now, we showed how far we could get once we had the over-privileged role in hand: we were able to pull container images, talk to other agents that we were never allowed to, read private conversations, plant short- and long-term memories to control agents’ behavior and delete user data. All of this stays within the AWS region boundary. |
AI |
|
|
10.10.26 |
AgentCorruption: Weaponizing Agent Memory for Persistent Hijacking |
How access to AgentCore Memory let us plant instructions that survived beyond the initial compromise, turning an agent's remembered context into a channel for persistent command and control. |
AI |
|
|
10.10.26 |
How a single prompt to a public-facing AgentCore agent exposed the instance metadata endpoint, the agent's cloud identity, and its container image: the foothold for everything that follows in this series. |
AI |
||
|
10.10.26 |
Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, from the C2 delivery server to the per-wallet theft modules. The infrastructure was still in use at triage time. |
|||
|
10.10.26 |
Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in our user base. |
STEALER |
||
|
10.10.26 |
Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. |
APT |
||
|
10.10.26 |
ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026 |
DOWNLOADER |
||
|
9.10.26 |
(CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction.java" component. |
|||
|
9.10.26 |
(CVSS v4 score: 9.3) - An operating system command injection vulnerability in the Replication Receiver component. |
|||
|
9.10.26 |
(CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. |
|||
|
9.10.26 |
(CVSS score: 9.8) - A path traversal vulnerability in ONLYOFFICE Docs that can occur when JSON Web Token (JWT) is used, via a "/.." sequence in an image upload parameter and could allow for remote code execution. |
|||
|
9.10.26 |
(CVSS score: 7.2) - A cleartext storage of sensitive information vulnerability in Strapi that could allow an attacker with access to the admin panel to discover sensitive user details via the query filter. |
|||
|
9.10.26 |
(CVSS score: 8.1) - A command injection vulnerability in Apache Struts that could allow a remote attacker to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. |
|||
|
9.10.26 |
(CVSS score: 7.5) - A reachable assertion vulnerability in ISC BIND that could allow a remote attacker to cause a denial-of-service via TKEY queries. |
|||
|
9.10.26 |
Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-107406 |
|||
|
9.10.26 |
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability |
|||
|
9.10.26 |
Zammad GmbH Zammad Session Fixation Vulnerability |
|||
|
9.10.26 |
Zammad GmbH Zammad Improper Privilege Management Vulnerability |
|||
|
9.10.26 |
Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. |
|||
|
8.10.26 |
Fortra Intelligence and Research Experts (FIRE) has discovered an active phishing campaign leveraging a reusable Adobe-themed phishing kit deployed across multiple compromised WordPress websites. |
Phish Kit |
||
|
8.10.26 |
MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work |
|||
|
8.10.26 |
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. |
|||
|
8.10.26 |
Cisco License (Smart Software Manager) On-Prem Vulnerabilities |
Multiple vulnerabilities in the web-based management interface and API endpoints of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow a remote attacker to gain unauthorized access, access sensitive information, cause a denial of service (DoS) |
||
|
8.10.26 |
Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities |
Multiple vulnerabilities in the Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as Next Generation OAM (NGOAM), could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) |
||
|
8.10.26 |
Cisco NX-OS Software NX-API Remote Code Execution Vulnerability |
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input |
||
|
8.10.26 |
Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability |
A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or |
||
|
8.10.26 |
Cisco License (Smart Software Manager) On-Prem Security Hardening Release: October 2026 |
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening |
||
|
8.10.26 |
Cisco NX-OS Software Security Hardening Release: October 2026 |
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. |
||
|
8.10.26 |
Cisco Application Policy Infrastructure Controller Security Hardening Release: October 2026 |
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple |
||
|
8.10.26 |
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.This vulnerability is due to improper input validation for specific HTTP requests |
|||
|
8.10.26 |
Cisco NX-OS Software Control Plane Denial of Service Vulnerability |
A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition.This vulnerability exists because rate limiting was improperly applied to some protocols. An attacker could exploit this |
||
|
8.10.26 |
A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device.This vulnerability is due to |
|||
|
8.10.26 |
Cisco Application Policy Infrastructure Controller Unauthorized File Access Vulnerability |
A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to access sensitive files on an affected device. To exploit this vulnerability, the attacker must have valid |
||
|
8.10.26 |
Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability |
A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative |
||
|
8.10.26 |
Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability |
A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remote attacker to bypass configured EPG contracts.This vulnerability is |
||
|
8.10.26 |
Canto incognito: tracking the PoeLLM malware |
AI |
||
|
8.10.26 |
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations. |
|||
|
8.10.26 |
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. |
|||
|
8.10.26 |
Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service |
|||
|
7.10.26 |
FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts |
FortiBleed refers to a credential-harvesting and access-broker operation whose internal workflow became visible only after the threat actors unintentionally exposed their own backend server. The open directory revealed a mature, multi-stage campaign targeting FortiGate SSL VPN appliances, harvesting credentials at scale, and cracking them using a distributed graphics processing unit (GPU) cluster. |
IC3 INDUSTRY |
|
|
7.10.26 |
In September 2026, CERT-UA specialists discovered over 100 compromised websites to which malicious JavaScript code had been added by attackers. When visiting such a site, the user was shown a fake Cloudflare verification page, which, under the pretext of confirming that the visitor was a human, offered to execute a command. |
LINUX |
||
|
7.10.26 |
SOCRadar’s Threat Research Unit (STRU) has documented CyberXero, a Russian-speaking, financially motivated Initial Access Broker that pairs commodity offensive tooling with an AI orchestration layer running on its own infrastructure. |
AI |
||
|
7.10.26 |
ClickFix campaigns have become one of the most effective ways to turn a browser session into code execution. The technique is simple: show the victim a fake verification page, place a command on the clipboard, and convince them to paste it into the Windows Run dialog. |
RAT |
||
|
7.10.26 |
During Cybersecurity Awareness Month, ransomware remains one of the clearest examples of how a cyber incident can become a business continuity issue. IronChain shows why. It puts business-critical data at risk of permanent loss and can bring operations to a halt. |
|||
|
7.10.26 |
This Android Security Bulletin contains details of security vulnerabilities that affect Android devices. Security patch levels of 2026-10-01 or higher address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. |
|||
|
7.10.26 |
The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices (Google devices). For Google devices, security patch levels of 2026-10-05 or later address all issues in this bulletin and all issues in the October 2026 Android Security Bulletin. |
|||
|
7.10.26 |
SMTP is the key: BPFDoor and AVERAT hitting the network edge |
DROPPER |
||
|
6.10.26 |
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. |
|||
|
6.10.26 |
Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. |
|||
|
6.10.26 |
Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. |
|||
|
6.10.26 |
Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. |
|||
|
6.10.26 |
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. |
|||
|
6.10.26 |
Mapping the expanding family of user-assisted malware delivery techniques Report | September 2026 |
|||
|
6.10.26 |
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1. |
|||
|
6.10.26 |
CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products |
|||
|
6.10.26 |
Microsoft Exchange Server Elevation of Privilege Vulnerability |
|||
|
5.10.26 |
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure |
BACKDOOR |
||
|
5.10.26 |
Horizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS |
Anthropic started Project Glasswing with the mission of securing the world’s most critical software. Since joining the project in July of 2026, Horizon3 has used Anthropic’s Mythos model in its vulnerability research pipelines to discover many critical vulnerabilities. Horizon3’s participation in the project came with our own internal mission to find vulnerabilities likely to be found and exploited in the wild by threat actors at scale. |
||
|
5.10.26 |
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability |
|||
|
5.10.26 |
Rejetto HFS 3.0.0 through 3.2.0 derives its session... |
|||
|
5.10.26 |
Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88779 |
|||
|
5.10.26 |
Atomic macOS (AMOS) Stealer infection from malicious ad impersonating Claude Code |
Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. |
||
|
5.10.26 |
Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. |
|||
|
5.10.26 |
Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. |
|||
|
5.10.26 |
Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles |
|||
|
4.10.26 |
The challenge confronting security leaders today is no longer a lack of information. It is the growing complexity of the environments they are responsible for protecting. |
|||
|
4.10.26 |
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. |
|||
|
4.10.26 |
In 2025, the FBI Internet Crime Complaint Center (IC3) celebrated its 25th anniversary as the central hub for reporting cyber-enabled crime. This milestone signifies the FBI's enduring commitment to fighting the ever-evolving cyber threat. Our success in protecting individuals and organizations is driven by public participation and robust data analysis. |
|||
|
4.10.26 |
Warlock Ransomware Attackers Hit Water and Telecom Operators |
|||
|
4.10.26 |
TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system. |
|||
|
4.10.26 |
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update. |
|||
|
4.10.26 |
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation. |
|||
|
4.10.26 |
TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user |
|||
|
4.10.26 |
An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. |
|||
|
3.10.26 |
Zammad GmbH Zammad Session Fixation Vulnerability: Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490. |
|||
|
3.10.26 |
Zammad GmbH Zammad Improper Privilege Management Vulnerability: Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. |
|||
|
3.10.26 |
Fortinet FortiMail Path Traversal Vulnerability: Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. |
|||
|
3.10.26 |
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability: Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. |
|||
|
3.10.26 |
Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability |
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.This vulnerability is due to improper handling of URI encoding |
||
|
3.10.26 |
Cisco IOS XE Software Security Hardening Release: August 2026 |
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered |
||
|
3.10.26 |
CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode |
MACOS |
||
|
3.10.26 |
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway. |
|||
|
3.10.26 |
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor |
|||
|
3.10.26 |
(CVSS score: 9.6) - An improper neutralization of special elements used in a template engine vulnerability that a low-privilege attacker with remote access could exploit to escalate privileges, access sensitive information, and carry out unauthorized RBAC tampering. |
|||
|
3.10.26 |
(CVSS score: 9.8) - A use of hard-coded cryptographic key vulnerability in the JWT authentication component of karavi-authorization that a remote unauthenticated attacker with knowledge of this publicly available signing secret could exploit to forge authentication tokens and gain administrative privileges. |
|||
|
3.10.26 |
(CVSS score: 9.8) - A use of hard-coded credentials vulnerability in the CSM Authorization module that a remote unauthenticated attacker could exploit to forge cryptographically valid administrative tokens and gain unauthorized administrative access to the CSM Authorization proxy. |
|||
|
3.10.26 |
(CVSS score: 9.9) - An improper privilege management vulnerability in the ContainerStorageModule Custom Resource reconciler that a low-privilege remote attacker could exploit to escalate privileges and gain root-level access on cluster nodes. |
|||
|
3.10.26 |
(CVSS score: 10.0) - A missing authentication for critical function vulnerability in the authorization proxy and tenant service that an unauthenticated network attacker could exploit to bypass authentication controls and gain administrative-level privileges. |
|||
|
3.10.26 |
(CVSS score: 10.0) - A missing authentication for critical function vulnerability in the csm-authorization-storage gRPC server that an unauthenticated remote attacker could exploit to obtain unauthorized access to storage backend administrator credentials for all registered storage arrays. |
|||
|
3.10.26 |
Milk Dragon, also known as NaiLong is an Adversary-in-the-Middle (AiTM) phishing kit active since October 2025. Unlike conventional phishing tactics that rely on fear and urgency, Milk Dragon lures victims with big discounts on consumer goods distributed via Facebook and TikTok marketplace advertisements. |
|||
|
3.10.26 |
This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of SmokeLoader malware. This is a modular program used by a variety of criminal and APT groups to gain a foothold on a system. It has vigorous anti-VM, anti-AV, and anti-analysis checks and capabilities. SmokeLoader can be used with RATs, ransomware, backdoors or botnets and uses both file and fileless methods of persistence. |
LOADER |
||
|
3.10.26 |
Recently, the SonicWall Capture Labs Threat Research Team discovered a sophisticated multi-stage .NET malware campaign that delivers VioletRAT v6.5 through a heavily obfuscated infection chain. The malware uses multiple .NET loader stages, an obfuscated batch script, in-memory assembly loading, and process injection into Msbuild.exe before executing the final VioletRAT payload. |
RAT |
||
|
2.10.26 |
Malicious packages posing as KakaoTalk messaging app installers |
ASEC Ahnlab researchers reported about an evolution of recently monitored campaigns where adversaries are manipulating search engine optimization (SEO) to steer unsuspecting users toward counterfeit KakaoTalk installers. The packaging of these trojanized setup packages progressively shifted across NSIS, Advanced Installer, and Inno Setup formats, bundling authentic software alongside malicious components. |
||
|
2.10.26 |
In a recent write-up, Cisco Talos details UAT-11587, a China-nexus cluster active since September 2025 that delivers a previously undocumented Rust backdoor named Antino. The targets are government, defense, diplomatic, legislative and research organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria. |
|||
|
2.10.26 |
According to Jamf Threat Labs, researchers discovered a two-stage macOS backdoor dubbed CloudSyncD that arrives hidden inside fake Zoom application installers. The malicious dropper convinces users into bypassing Gatekeeper protections and entering their system password |
|||
|
2.10.26 |
The China-nexus group behind Warlock ransomware is still breaking into organizations through Microsoft SharePoint vulnerabilities, a tactic that brought it to prominence a year ago. In the past two months, the group, which Symantec tracks as Longlegs (aka Storm-2603), attacked at least four organizations in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America. |
|||
|
2.10.26 |
Researchers at Point Wild recently reported a new malware family dubbed BotHelper, a .NET remote access trojan equipped with real-time desktop monitoring functions. Targeting Windows environments, the infection begins with a native executable stager that fingerprints the host machine and intentionally disables TLS certificate validation to retrieve an encrypted payload from a remote server. |
|||
|
2.10.26 |
Brimstone APT Delivers ComicPulse Backdoor Through RedFlick Technique |
Researchers at Microsoft Threat Intelligence recently reported on evolving cyberespionage tradecraft from the Russian state-sponsored group Brimstone (aka Star Blizzard). The group has pivoted from narrow spear-phishing toward broader initial-contact email operations while adopting compromised host platforms to distribute malicious content. |
||
|
2.10.26 |
Multi-stage attack leveraging KMS Auto that leads to scareware |
A recent K7 Security Labs investigation highlights a multi-phase intrusion campaign wherein adversaries leverage KMS Auto, which is an an unofficial third-party utility used to bypass licensing and activate various Microsoft products. |
||
|
2.10.26 |
In a recent write-up, BI.ZONE Threat Intelligence details a new campaign deploying LxBase RAT against Russian organizations. Between July and September 2026, attackers targeted a wide array of domestic industries, including finance, energy, retail, logistics, and engineering. |
|||
|
2.10.26 |
A new variant documented by Jamf Threat Labs targets macOS environments with an upgraded version of the PamStealer infostealer. Attackers trick users into downloading a malicious disk image by impersonating a multichain cryptocurrency wallet called Wavel. |
|||
|
2.10.26 |
InsydeH2O IHISI SMM is vulnerable to unsafe memory write operations |
An Out-of-bounds Write vulnerability in the InsydeH2O IHISI software used by HP PC BIOS can allow a local attacker with OS kernel privileges to perform arbitrary physical memory writes, including writes to System Management RAM (SMRAM). Because the vulnerable code executes in System Management Mode (SMM), successful exploitation can allow an attacker to modify SMM-protected memory and potentially achieve arbitrary code execution in SMM. |
||
|
2.10.26 |
|
Elastic Security Labs reports that RONINGLOADER writes ollama.sys to a temporary directory, creates a temporary service to load it, and sends target process IDs to the driver to terminate antivirus processes. The service is deleted after the termination request. |
||
|
2.10.26 |
SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor |
LOADER |
||
|
2.10.26 |
Fortinet FortiMail Path Traversal Vulnerability |
|||
|
1.10.26 |
CVE-2026-86950: The Great Glyph Grift |
|||
|
1.10.26 |
Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
|||
|
1.10.26 |
CVE-2026-86104 Fireware OS Resource Exhaustion in Login Process Allows Denial of Service |
Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
||
|
1.10.26 |
CVE-2026-18145 Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution |
Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
||
|
1.10.26 |
CVE-2026-13046 Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution |
Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
||
|
1.10.26 |
CVE-2026-86101 Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access |
Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
||
|
1.10.26 |
Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
|||
|
1.10.26 |
CVE-2026-13224 Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read |
Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
||
|
1.10.26 |
CVE-2026-86132 Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service |
Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
||
|
1.10.26 |
CVE-2026-86105 Fireware OS Improper Authorization in Access Portal Reverse Proxy |
Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
||
|
1.10.26 |
Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
|||
|
1.10.26 |
CVE-2026-86131 Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution |
Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
||
|
1.10.26 |
Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
|||
|
1.10.26 |
Fireware OS>= 2026.3, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3 |
|||
|
1.10.26 |
Default>= 2026.3, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
|||
|
1.10.26 |
Default>= 2026.3, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 |
|||
|
1.10.26 |
CVE-2026-101891 WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access |
WatchGuard AP>= 1.0, < 3.4.8>= 3.4.8 |
||
|
1.10.26 |
CVE-2026-86102 WatchGuard AP Command Injection in Internal Management API Allows Command Execution |
WatchGuard AP>= 1.0, < 3.4.8>= 3.4.8 |
||
|
1.10.26 |
CVE-2026-87969 WatchGuard AP Authenticated Command Injection in Diagnostic CLI |
WatchGuard AP>= 1.0, < 3.4.8>= 3.4.8 |