tsecurity.de - Sicherheitslücken (CVE)

ZDI-CAN-33367: Patched kernels available in testing

Sat, 24 Oct 2026 05:03:30 +0200

A new Linux kernel vulnerability, tracked by Trend Micro’s Zero Day Initiative (ZDI) as ZDI-CAN-33367, was reported to the kernel security team and public kernel mailing lists on 2026-10-21. It lets an unprivileged local user change the contents of files they can read but not write, such as files owned by root, by corrupting the kernel’s in-memory... Weiterlesen

DSA-6582-1 brotli - security update

Sat, 24 Oct 2026 05:01:31 +0200

A vulnerability was discovered in Brotli, a generic-purpose lossless compression suite, which could result in denial of service, or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6582-1 Weiterlesen

CVE-2026-102208 | Microsoft Windows up to Server 2022 Win32 Kernel Subsystem use after free (EUVD-2026-100362)

Sat, 24 Oct 2026 05:00:45 +0200

A vulnerability, which was classified as very critical, has been found in Microsoft Windows up to Server 2022. Affected is an unknown function of the component Win32 Kernel Subsystem. Performing a manipulation results in use after free. This vulnerability is cataloged as CVE-2026-102208. The attack must be initiated from a local position. There is... Weiterlesen

CVE-2026-83862 | Microsoft Windows up to Server 2025 Network Load Balancing use after free (EUVD-2026-99392)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability has been found in Microsoft Windows up to Server 2025 and classified as very critical. The affected element is an unknown function of the component Network Load Balancing. The manipulation leads to use after free. This vulnerability is documented as CVE-2026-83862. The attack can be initiated remotely. There is not any exploit... Weiterlesen

CVE-2026-108471 | Microsoft Windows 10 1809/Server 2019 Enclave null pointer dereference (EUVD-2026-100456)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability was found in Microsoft Windows 10 1809/Server 2019. It has been classified as very critical. Affected by this issue is some unknown functionality of the component Enclave. The manipulation leads to null pointer dereference. This vulnerability is traded as CVE-2026-108471. An attack has to be approached locally. There is no exploit... Weiterlesen

CVE-2026-108136 | Microsoft Windows up to Server 2025 Search use after free (EUVD-2026-100455)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability labeled as very critical has been found in Microsoft Windows. Impacted is an unknown function of the component Search Component. Such manipulation leads to use after free. This vulnerability is listed as CVE-2026-108136. The attack must be carried out locally. There is no available exploit. It is advisable to implement a patch to... Weiterlesen

CVE-2026-108135 | Microsoft Windows up to 11 26H2 Backup Engine link following (EUVD-2026-100454)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability described as very critical has been identified in Microsoft Windows up to 11 26H2. Impacted is an unknown function of the component Backup Engine. Executing a manipulation can lead to link following. This vulnerability is tracked as CVE-2026-108135. The attack is restricted to local execution. No exploit exists. Applying a patch is... Weiterlesen

CVE-2026-108134 | Microsoft Windows 11 24H2/11 25H2/11 26H2 Autopilot use after free (EUVD-2026-100453)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability marked as very critical has been reported in Microsoft Windows 11 24H2/11 25H2/11 26H2. This issue affects some unknown processing of the component Autopilot. Performing a manipulation results in use after free. This vulnerability is identified as CVE-2026-108134. The attack is only possible with local access. There is not any... Weiterlesen

CVE-2026-108132 | Microsoft Windows up to Server 2025 Kerberos double free (EUVD-2026-100451)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability identified as very critical has been detected in Microsoft Windows up to Server 2025. This affects an unknown part of the component Kerberos. This manipulation causes double free. The identification of this vulnerability is CVE-2026-108132. The attack can only be executed locally. There is no exploit available. Applying a patch is... Weiterlesen

CVE-2026-108133 | Microsoft Windows Server 2022 memory corruption (EUVD-2026-100452)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability labeled as very critical has been found in Microsoft Windows Server 2022. This vulnerability affects unknown code. Such manipulation leads to memory corruption. This vulnerability is referenced as CVE-2026-108133. The attack can only be performed from a local environment. No exploit is available. The affected component should be... Weiterlesen

CVE-2026-108130 | Microsoft Windows up to Server 2025 VBS Enclave heap-based overflow (EUVD-2026-100449)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability categorized as very critical has been discovered in Microsoft Windows 11 24H2/11 25H2/11 26H1/11 26H2/Server 2025. Affected by this issue is some unknown functionality of the component VBS Enclave. The manipulation results in heap-based buffer overflow. This vulnerability was named CVE-2026-108130. The attack needs to be approached... Weiterlesen

CVE-2026-108131 | Microsoft Windows up to Server 2025 Active Directory Federation Services improper authorization (EUVD-2026-100450)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability identified as problematic has been detected in Microsoft Windows. The impacted element is an unknown function of the component Active Directory Federation Services. Performing a manipulation results in improper authorization. This vulnerability is identified as CVE-2026-108131. The attack can be initiated remotely. There is not any... Weiterlesen

CVE-2026-108129 | Microsoft Windows up to Server 2025 DNS Server out-of-bounds (EUVD-2026-100448)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability was found in Microsoft Windows. It has been classified as problematic. This vulnerability affects unknown code of the component DNS Server. The manipulation leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2026-108129. The attack is possible to be carried out remotely. No exploit exists. Applying a... Weiterlesen

CVE-2026-108128 | Microsoft Windows up to Server 2025 out-of-bounds (EUVD-2026-100447)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability has been found in Microsoft Windows and classified as problematic. Affected by this issue is some unknown functionality. Performing a manipulation results in out-of-bounds read. This vulnerability is known as CVE-2026-108128. Remote exploitation of the attack is possible. No exploit is available. To fix this issue, it is... Weiterlesen

CVE-2026-110447 | Collabora Online up to 26.4.302 CODE Server proxy.php os command injection

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability was found in Collabora Online up to 26.4.302. It has been classified as critical. This issue affects some unknown processing of the file proxy.php of the component CODE Server. Performing a manipulation results in os command injection. This vulnerability was named CVE-2026-110447. The attack may be initiated remotely. In addition,... Weiterlesen

CVE-2026-115506 | Libexpat up to 2.9.0 xmlparse.c accountingDiffTolerated denial of service (WID-SEC-2026-4123)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability, which was classified as problematic, was found in Libexpat up to 2.9.0. This affects the function accountingDiffTolerated of the file xmlparse.c. Such manipulation leads to denial of service. This vulnerability is listed as CVE-2026-115506. The attack may be performed from remote. There is no available exploit. Weiterlesen

CVE-2025-31699 | Apache Traffic Server prior 9.2.16/10.1.5/10.2.1 access control (WID-SEC-2026-4112)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability has been found in Apache Traffic Server and classified as critical. This issue affects some unknown processing. This manipulation causes improper access controls. This vulnerability is registered as CVE-2025-31699. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded. Weiterlesen

CVE-2025-55702 | Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 improper synchronization (WID-SEC-2026-4112)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability was found in Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 and classified as critical. Impacted is an unknown function. Such manipulation leads to improper synchronization. This vulnerability is documented as CVE-2025-55702. The attack can be executed remotely. There is not any exploit available. It is suggested to... Weiterlesen

CVE-2026-111811 | Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 tsmemcache authorization (WID-SEC-2026-4112)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability classified as critical has been found in Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0. This impacts an unknown function of the component tsmemcache. Performing a manipulation results in missing authorization. This vulnerability was named CVE-2026-111811. The attack may be initiated remotely. There is no available... Weiterlesen

CVE-2026-113378 | mcollina mcp-ripgrep up to 0.4.0 Advanced Search Tool src/index.ts fileType os command injection

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability was found in mcollina mcp-ripgrep up to 0.4.0. It has been declared as problematic. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. This vulnerability is reported as CVE-2026-113378. The attack requires a local... Weiterlesen

CVE-2022-47758 | Nanoleaf up to 7.1.1 certificate validation (EUVD-2022-50516)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability labeled as critical has been found in Nanoleaf up to 7.1.1. This impacts an unknown function. Executing a manipulation can lead to improper certificate validation. This vulnerability is handled as CVE-2022-47758. The attack can only be done within the local network. There is not any exploit available. Weiterlesen

CVE-2022-47766 | PopojiCMS 2.0.1 Backend Plugin unrestricted upload (Issue 35 / EUVD-2022-50523)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability, which was classified as critical, has been found in PopojiCMS 2.0.1. The impacted element is an unknown function of the component Backend Plugin Handler. The manipulation leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2022-47766. The attack can only be initiated within the local network. No exploit... Weiterlesen

CVE-2022-47767 | Solar-Log Gateway up to 4.2.7/5.1.1 slcore backdoor (EUVD-2022-50524)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability was found in Solar-Log Gateway up to 4.2.7/5.1.1. It has been declared as critical. Affected is an unknown function of the component slcore. The manipulation results in backdoor. This vulnerability is reported as CVE-2022-47767. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected... Weiterlesen

CVE-2022-47770 | Serenissima Informatica Fast Checkin 1.0 sql injection (EUVD-2022-50527)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability marked as critical has been reported in Serenissima Informatica Fast Checkin 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. This vulnerability is listed as CVE-2022-47770. The attack must be carried out from within the local network. There is no available exploit. Weiterlesen

CVE-2022-47936 | Siemens JT Open/JT Utilities/Parasolid JT File stack-based overflow (ssa-836777)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability was found in Siemens JT Open, JT Utilities and Parasolid. It has been declared as critical. Affected by this issue is some unknown functionality of the component JT File Handler. Executing a manipulation can lead to stack-based buffer overflow. This vulnerability is registered as CVE-2022-47936. It is possible to launch the attack... Weiterlesen

CVE-2022-43552 | Apple macOS up to 13.2.1 curl use after free (HT213670 / Nessus ID 211153)

Sat, 24 Oct 2026 05:00:43 +0200

A vulnerability marked as problematic has been reported in Apple macOS up to 13.2.1. This vulnerability affects unknown code of the component curl. Performing a manipulation results in use after free. This vulnerability was named CVE-2022-43552. The attack needs to be approached within the local network. There is no available exploit. It is... Weiterlesen

CVE-2023-24564 | Siemens Solid Edge SE2022/Solid Edge SE2023 DWG File memory corruption (ssa-491245)

Sat, 24 Oct 2026 05:00:41 +0200

A vulnerability marked as critical has been reported in Siemens Solid Edge SE2022 and Solid Edge SE2023. This impacts an unknown function of the component DWG File Handler. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2023-24564. It is possible to initiate the attack remotely. There is no exploit available. It... Weiterlesen

CVE-2023-24562 | Siemens Solid Edge SE2022/Solid Edge SE2023 PAR File uninitialized pointer (ssa-491245)

Sat, 24 Oct 2026 05:00:41 +0200

A vulnerability identified as critical has been detected in Siemens Solid Edge SE2022 and Solid Edge SE2023. The impacted element is an unknown function of the component PAR File Handler. Performing a manipulation results in uninitialized pointer. This vulnerability is reported as CVE-2023-24562. The attack is possible to be carried out remotely.... Weiterlesen

CVE-2023-24556 | Siemens Solid Edge SE2022/Solid Edge SE2023 PAR File out-of-bounds (ssa-491245)

Sat, 24 Oct 2026 05:00:41 +0200

A vulnerability has been found in Siemens Solid Edge SE2022 and Solid Edge SE2023 and classified as problematic. Affected by this issue is some unknown functionality of the component PAR File Handler. Performing a manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2023-24556. The attack can be initiated remotely.... Weiterlesen

CVE-2023-24552 | Siemens Solid Edge SE2022/Solid Edge SE2023 PAR File out-of-bounds (ssa-491245)

Sat, 24 Oct 2026 05:00:41 +0200

A vulnerability classified as problematic has been found in Siemens Solid Edge SE2022 and Solid Edge SE2023. This affects an unknown function of the component PAR File Handler. The manipulation leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2023-24552. The attack is possible to be carried out remotely. No exploit... Weiterlesen

CVE-2023-24549 | Siemens Solid Edge SE2022/Solid Edge SE2023 PAR File stack-based overflow (ssa-491245)

Sat, 24 Oct 2026 05:00:39 +0200

A vulnerability labeled as critical has been found in Siemens Solid Edge SE2022 and Solid Edge SE2023. Impacted is an unknown function of the component PAR File Handler. Such manipulation leads to stack-based buffer overflow. This vulnerability is traded as CVE-2023-24549. The attack may be launched remotely. There is no exploit available. The... Weiterlesen

CVE-2023-24550 | Siemens Solid Edge SE2022/Solid Edge SE2023 PAR File heap-based overflow (ssa-491245)

Sat, 24 Oct 2026 05:00:39 +0200

A vulnerability marked as critical has been reported in Siemens Solid Edge SE2022 and Solid Edge SE2023. The affected element is an unknown function of the component PAR File Handler. Performing a manipulation results in heap-based buffer overflow. This vulnerability is known as CVE-2023-24550. Remote exploitation of the attack is possible. No... Weiterlesen

CVE-2022-43552 | cURL Proxy Error use after free (Nessus ID 211153)

Sat, 24 Oct 2026 05:00:38 +0200

A vulnerability identified as problematic has been detected in cURL. This impacts an unknown function of the component Proxy Error Handler. The manipulation leads to use after free. This vulnerability is listed as CVE-2022-43552. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component. Weiterlesen

CVE-2023-22794 | activerecord Gem on Ruby ActiveRecord Comment sql injection (Nessus ID 256761)

Sat, 24 Oct 2026 05:00:38 +0200

A vulnerability classified as critical was found in activerecord Gem on Ruby. This affects an unknown part of the component ActiveRecord Comment Handler. The manipulation results in sql injection. This vulnerability is identified as CVE-2023-22794. The attack can only be performed from the local network. There is not any exploit available.... Weiterlesen

CVE-2022-47762 | Gin-Vue-Admin up to 2.5.4 Download path traversal (Issue 1309 / EUVD-2023-0818)

Sat, 24 Oct 2026 05:00:38 +0200

A vulnerability marked as critical has been reported in Gin-Vue-Admin up to 2.5.4. This affects an unknown part of the component Download Module. This manipulation causes path traversal. The identification of this vulnerability is CVE-2022-47762. The attack needs to be done within the local network. There is no exploit available. It is suggested... Weiterlesen

CVE-2022-47780 | Bangresto 1.0 itemID sql injection (EUVD-2022-50537)

Sat, 24 Oct 2026 05:00:38 +0200

A vulnerability classified as critical was found in Bangresto 1.0. Affected is an unknown function. Executing a manipulation of the argument itemID can lead to sql injection. This vulnerability is handled as CVE-2022-47780. The attack can only be done within the local network. There is not any exploit available. Weiterlesen

CVE-2022-47790 | SourceCodester Dynamic Transaction Queuing System 1.0 index.php?page=display id sql injection (EUVD-2022-50547)

Sat, 24 Oct 2026 05:00:38 +0200

A vulnerability identified as critical has been detected in SourceCodester Dynamic Transaction Queuing System 1.0. This affects an unknown function of the file /queuing/index.php?page=display. The manipulation of the argument ID leads to sql injection. This vulnerability is traded as CVE-2022-47790. It is possible to initiate the attack remotely.... Weiterlesen

CVE-2022-31259 | beego up to 2.0.2 Route Lookup /p1/p2/:name access control (Issue 4946 / EUVD-2022-5053)

Sat, 24 Oct 2026 05:00:38 +0200

A vulnerability was found in beego up to 2.0.2. It has been declared as critical. The affected element is an unknown function of the file /p1/p2/:name of the component Route Lookup Handler. The manipulation results in improper access controls. This vulnerability is cataloged as CVE-2022-31259. The attack must originate from the local network.... Weiterlesen

CVE-2022-47848 | Bezeq Vtech NB403-IL/Vtech IAD604-IL UPnP Service rootDesc.xml information disclosure (EUVD-2022-50605)

Sat, 24 Oct 2026 05:00:38 +0200

A vulnerability was found in Bezeq Vtech NB403-IL and Vtech IAD604-IL. It has been rated as problematic. Impacted is an unknown function of the file rootDesc.xml of the component UPnP Service. This manipulation causes information disclosure. This vulnerability is tracked as CVE-2022-47848. The attack is possible to be carried out remotely. No... Weiterlesen

CVE-2022-47853 | TOTOlink A7100RU 7.4cu.2313_B20191024 httpd Service command injection (EUVD-2022-50610)

Sat, 24 Oct 2026 05:00:37 +0200

A vulnerability described as critical has been identified in TOTOlink A7100RU 7.4cu.2313_B20191024. Affected by this issue is some unknown functionality of the component httpd Service. Such manipulation leads to command injection. This vulnerability is documented as CVE-2022-47853. The attack requires being on the local network. There is not any... Weiterlesen

CVE-2022-47854 | i-librarian 4.10 ajaxsupplement.php unrestricted upload (Issue 155 / EUVD-2022-50611)

Sat, 24 Oct 2026 05:00:37 +0200

A vulnerability described as critical has been identified in i-librarian 4.10. Affected by this vulnerability is an unknown functionality of the file ajaxsupplement.php. Executing a manipulation can lead to unrestricted upload. This vulnerability appears as CVE-2022-47854. The attacker needs to be present on the local network. There is no... Weiterlesen

CVE-2022-47859 | SourceCodester Lead Management System 1.0 changePassword.php user_id sql injection (EUVD-2022-50616)

Sat, 24 Oct 2026 05:00:37 +0200

A vulnerability was found in SourceCodester Lead Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file changePassword.php. Such manipulation of the argument user_id leads to sql injection. This vulnerability is uniquely identified as CVE-2022-47859. The attack can only be initiated within the local... Weiterlesen

CVE-2026-111812 | Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 origin_server_auth plugin privileges management (WID-SEC-2026-4112)

Sat, 24 Oct 2026 05:00:37 +0200

A vulnerability described as critical has been identified in Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0. This affects an unknown function of the component origin_server_auth plugin. Such manipulation leads to improper privilege management. This vulnerability is uniquely identified as CVE-2026-111812. The attack can be launched... Weiterlesen

CVE-2026-111813 | Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0 magick plugin data authenticity (WID-SEC-2026-4112)

Sat, 24 Oct 2026 05:00:37 +0200

A vulnerability was found in Apache Traffic Server up to 8.1.11/9.2.15/10.1.4/10.2.0. It has been declared as critical. Affected is an unknown function of the component magick plugin. The manipulation results in insufficient verification of data authenticity. This vulnerability is reported as CVE-2026-111813. The attack can be launched remotely.... Weiterlesen

CVE-2026-20337 | Cisco ClamAV Zip Archive Parser out-of-bounds write (Nessus ID 335452 / WID-SEC-2026-2708)

Sat, 24 Oct 2026 05:00:37 +0200

A vulnerability labeled as critical has been found in Cisco ClamAV. Impacted is an unknown function of the component Zip Archive Parser. Executing a manipulation can lead to out-of-bounds write. This vulnerability is registered as CVE-2026-20337. It is possible to launch the attack remotely. No exploit is available. The affected component should... Weiterlesen

CVE-2026-20338 | Cisco ClamAV up to 8.4.5.30483 Zip Archive Parser double free (Nessus ID 335452 / WID-SEC-2026-2708)

Sat, 24 Oct 2026 05:00:37 +0200

A vulnerability described as critical has been identified in Cisco ClamAV. The impacted element is an unknown function of the component Zip Archive Parser. The manipulation results in double free. This vulnerability is reported as CVE-2026-20338. The attack can be launched remotely. No exploit exists. Upgrading the affected component is... Weiterlesen

CVE-2026-102253 | esnet iperf3 up to 3.21 denial of service (WID-SEC-2026-4121)

Sat, 24 Oct 2026 05:00:37 +0200

A vulnerability, which was classified as problematic, was found in esnet iperf3 up to 3.21. Affected is an unknown function. Executing a manipulation can lead to denial of service. The identification of this vulnerability is CVE-2026-102253. The attack may be launched remotely. There is no exploit available. You should upgrade the affected... Weiterlesen

CVE-2026-92709 | rsyslog up to 8.2610.0 Dynafacility path traversal (WID-SEC-2026-4119)

Sat, 24 Oct 2026 05:00:36 +0200

A vulnerability identified as very critical has been detected in rsyslog up to 8.2610.0. This affects an unknown function of the component Dynafacility. Performing a manipulation results in path traversal. This vulnerability is identified as CVE-2026-92709. The attack can be initiated remotely. There is not any exploit available. Weiterlesen

Decepticon v1.5.4

Sat, 24 Oct 2026 04:54:46 +0200

Autonomous LLM red team agent that plans and executes full attack chains—recon, exploitation, privilege escalation, lateral movement and C2—inside an isolated Kali sandbox. Weiterlesen

CVE-2022-47740 | Seltmann Content Management System 6 /index.php sql injection (EUVD-2022-50499)

Sat, 24 Oct 2026 01:12:47 +0200

A vulnerability was found in Seltmann Content Management System 6 and classified as critical. The impacted element is an unknown function of the file /index.php. The manipulation results in sql injection. This vulnerability is identified as CVE-2022-47740. The attack can only be performed from the local network. Additionally, an exploit exists. Weiterlesen

CVE-2022-47757 | imo.im 2022.11.1051 Shared Library path traversal (GHSA-ghf9-x3c5-3mwj / EUVD-2022-50515)

Sat, 24 Oct 2026 01:12:46 +0200

A vulnerability classified as critical has been found in imo.im 2022.11.1051. Affected by this vulnerability is an unknown functionality of the component Shared Library Handler. The manipulation leads to path traversal. This vulnerability is referenced as CVE-2022-47757. The attack needs to be initiated within the local network. No exploit is... Weiterlesen

CVE-2022-47745 | EasyCorp ZenTao PMS up to 18.0.beta1 sql injection (Issue 106 / EUVD-2022-50504)

Sat, 24 Oct 2026 01:12:46 +0200

A vulnerability was found in EasyCorp ZenTao PMS up to 18.0.beta1. It has been rated as critical. Affected is an unknown function. Performing a manipulation results in sql injection. This vulnerability is cataloged as CVE-2022-47745. It is possible to initiate the attack remotely. There is no exploit available. Weiterlesen

CVE-2026-75525 | open-reception appointment-booking-software up to 2.1.0 improper authorization (EUVD-2026-109159)

Sat, 24 Oct 2026 01:12:46 +0200

A vulnerability classified as critical has been found in open-reception appointment-booking-software up to 2.1.0. This vulnerability affects unknown code. Performing a manipulation results in improper authorization. This vulnerability was named CVE-2026-75525. The attack may be initiated remotely. There is no available exploit. Weiterlesen

CVE-2026-91446 | Oracle Siebel CRM Deployment up to 26.9 Server Infrastructure privileges management (EUVD-2026-106696)

Sat, 24 Oct 2026 01:12:46 +0200

A vulnerability was found in Oracle Siebel CRM Deployment up to 26.9 and classified as problematic. This affects an unknown function of the component Server Infrastructure. Such manipulation leads to improper privilege management. This vulnerability is referenced as CVE-2026-91446. The attack can only be performed from a local environment. No... Weiterlesen

CVE-2026-115800 | UbiquitousLearning mllm up to 2.0.2 Convertor init.py load_model shard_file path traversal (Issue 711 / EUVD-2026-109158)

Sat, 24 Oct 2026 01:12:46 +0200

A vulnerability has been found in UbiquitousLearning mllm up to 2.0.2 and classified as problematic. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_file leads to path traversal. This vulnerability is documented as CVE-2026-115800.... Weiterlesen

CVE-2026-91444 | Oracle Siebel CRM Deployment up to 26.9 Server Infrastructure privileges management (EUVD-2026-106694)

Sat, 24 Oct 2026 01:12:22 +0200

A vulnerability has been found in Oracle Siebel CRM Deployment up to 26.9 and classified as critical. The impacted element is an unknown function of the component Server Infrastructure. This manipulation causes improper privilege management. The identification of this vulnerability is CVE-2026-91444. The attack can only be executed locally. There... Weiterlesen

CVE-2026-91445 | Oracle Siebel CRM End User up to 26.9 Communications Panel/Dashboard privileges management (EUVD-2026-106695)

Sat, 24 Oct 2026 01:12:22 +0200

A vulnerability labeled as critical has been found in Oracle Siebel CRM End User up to 26.9. Affected by this vulnerability is an unknown functionality of the component Communications Panel/Dashboard. The manipulation results in improper privilege management. This vulnerability is reported as CVE-2026-91445. The attack can be launched remotely. No... Weiterlesen

CVE-2026-91443 | Oracle Siebel CRM Deployment up to 26.9 Server Infrastructure improper authorization (EUVD-2026-106693)

Sat, 24 Oct 2026 01:12:22 +0200

A vulnerability identified as problematic has been detected in Oracle Siebel CRM Deployment up to 26.9. Affected is an unknown function of the component Server Infrastructure. The manipulation leads to improper authorization. This vulnerability is documented as CVE-2026-91443. The attack can be initiated remotely. There is not any exploit... Weiterlesen

CVE-2026-115801 | Kakao khaiii up to 0.4 JSON Config File Linear.cpp khaiii::nn::Linear::open hidden_dim/class_num out-of-bounds (Issue 129 / EUVD-2026-109192)

Sat, 24 Oct 2026 01:12:22 +0200

A vulnerability was found in Kakao khaiii up to 0.4 and classified as problematic. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hidden_dim/class_num results in out-of-bounds read. This vulnerability only... Weiterlesen

CVE-2026-115897 | Yahoo Serialize JavaScript up to 7.1.2 Escaping Logic toString cross site scripting (EUVD-2026-109190)

Sat, 24 Oct 2026 01:12:22 +0200

A vulnerability was found in Yahoo Serialize JavaScript up to 7.1.2. It has been declared as problematic. Affected is the function toString of the component Escaping Logic. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2026-115897. It is possible to launch the attack remotely. No exploit is... Weiterlesen

CVE-2026-113877 | HTTP::Headers::ActionPack up to 0.9 Accept-Language Header _language_match range resource consumption (EUVD-2026-109147)

Sat, 24 Oct 2026 01:12:22 +0200

A vulnerability identified as problematic has been detected in HTTP::Headers::ActionPack up to 0.9. Affected is the function _language_match of the component Accept-Language Header. The manipulation of the argument range leads to resource consumption. This vulnerability is traded as CVE-2026-113877. It is possible to initiate the attack remotely.... Weiterlesen

CVE-2026-115895 | capricorn86 Happy DOM up to 21.0.3 ECMAScriptModuleCompiler ECMAScriptModuleCompiler.ts initialization (EUVD-2026-109189)

Sat, 24 Oct 2026 01:12:22 +0200

A vulnerability identified as critical has been detected in capricorn86 Happy DOM up to 21.0.3. This affects an unknown part of the file packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts of the component ECMAScriptModuleCompiler. This manipulation causes improper initialization. This vulnerability appears as CVE-2026-115895. The attack may... Weiterlesen

CVE-2026-115845 | AWS MCP Server Python Code Validator run_script input validation (EUVD-2026-109127)

Sat, 24 Oct 2026 01:12:22 +0200

A vulnerability was found in AWS MCP Server and classified as very critical. This affects the function run_script of the component Python Code Validator. Executing a manipulation can lead to improper input validation. This vulnerability is registered as CVE-2026-115845. It is possible to launch the attack remotely. No exploit is available. This... Weiterlesen

CVE-2026-91093 | HP One Agent 1.3.214.7339 privileges management (EUVD-2026-109122)

Sat, 24 Oct 2026 01:12:22 +0200

A vulnerability has been found in HP One Agent 1.3.214.7339 and classified as very critical. Affected by this issue is some unknown functionality. Performing a manipulation results in improper privilege management. This vulnerability is cataloged as CVE-2026-91093. It is possible to initiate the attack remotely. There is no exploit available. The... Weiterlesen

CVE-2026-115893 | Bytecode Alliance Wasmtime up to 36.0.18/48.0.6/49.0.3 Cranelift compiler backend br_table privileges management (EUVD-2026-109188)

Sat, 24 Oct 2026 01:12:22 +0200

A vulnerability labeled as critical has been found in Bytecode Alliance Wasmtime up to 36.0.18/48.0.6/49.0.3. This vulnerability affects the function br_table of the component Cranelift compiler backend. Such manipulation leads to improper privilege management. This vulnerability is traded as CVE-2026-115893. The attack may be launched remotely.... Weiterlesen

CVE-2026-18748 | ZephyrProject Zephyr up to 4.4.2 A2DP Host a2dp.c a2dp_process_config_ind len out-of-bounds (EUVD-2026-107483)

Sat, 24 Oct 2026 01:12:22 +0200

A vulnerability, which was classified as problematic, was found in ZephyrProject Zephyr up to 4.4.2. This impacts the function a2dp_process_config_ind of the file subsys/bluetooth/host/classic/a2dp.c of the component A2DP Host. Executing a manipulation of the argument len can lead to out-of-bounds read. This vulnerability is tracked as... Weiterlesen

CVE-2026-78117 | Zephyr Project up to 4.4.2 Bluetooth HCI Driver hci_infineon_psoc6_bless.c psoc6_bless_send race condition (EUVD-2026-107484)

Sat, 24 Oct 2026 01:12:21 +0200

A vulnerability classified as critical has been found in Zephyr Project Zephyr up to 4.4.2. The affected element is the function psoc6_bless_send of the file drivers/bluetooth/hci/hci_infineon_psoc6_bless.c of the component Bluetooth HCI Driver. This manipulation causes race condition. The identification of this vulnerability is CVE-2026-78117. It... Weiterlesen

CVE-2026-78118 | Zephyr Project up to 4.4.x Wait Queue kernel/include/wait_q.h z_waitq_head wait_q use after free (EUVD-2026-107485)

Sat, 24 Oct 2026 01:12:19 +0200

A vulnerability, which was classified as very critical, has been found in Zephyr Project Zephyr up to 4.4.x. This affects the function z_waitq_head of the file kernel/include/wait_q.h of the component Wait Queue. Performing a manipulation of the argument wait_q results in use after free. This vulnerability is identified as CVE-2026-78118. The... Weiterlesen

CVE-2025-52544 | Copeland LP E3 Supervisory Control up to 2.31F00 Floor Plan input validation

Sat, 24 Oct 2026 01:12:18 +0200

A vulnerability was found in Copeland LP E3 Supervisory Control up to 2.31F00. It has been declared as critical. This vulnerability affects unknown code of the component Floor Plan Handler. Such manipulation leads to improper input validation. This vulnerability is referenced as CVE-2025-52544. It is possible to launch the attack remotely. No... Weiterlesen

CVE-2025-58214 | gavias Indutri Plugin up to 1.2.x on WordPress php file inclusion

Sat, 24 Oct 2026 01:12:17 +0200

A vulnerability, which was classified as problematic, has been found in gavias Indutri Plugin up to 1.2.x on WordPress. The affected element is an unknown function. Performing a manipulation results in improper control of filename for include/require statement in php program. This vulnerability is identified as CVE-2025-58214. The attack can be... Weiterlesen

CVE-2025-6519 | Copeland LP E3 Supervisory Control up to 2.31F00 insufficiently protected credentials (EUVD-2025-28745)

Sat, 24 Oct 2026 01:12:15 +0200

A vulnerability labeled as critical has been found in Copeland LP E3 Supervisory Control up to 2.31F00. The impacted element is an unknown function. The manipulation results in insufficiently protected credentials. This vulnerability is cataloged as CVE-2025-6519. The attack may be launched remotely. There is no exploit available. The affected... Weiterlesen

CVE-2025-52545 | Copeland LP E3 Supervisory Control up to 2.31F00 RCI Service insufficiently protected credentials

Sat, 24 Oct 2026 01:12:12 +0200

A vulnerability was found in Copeland LP E3 Supervisory Control up to 2.31F00. It has been rated as critical. This issue affects some unknown processing of the component RCI Service. Performing a manipulation results in insufficiently protected credentials. This vulnerability is identified as CVE-2025-52545. The attack can be initiated remotely.... Weiterlesen

CVE-2025-52543 | Copeland LP E3 Supervisory Control up to 2.31F00 password hash instead of password for authentication

Sat, 24 Oct 2026 01:12:12 +0200

A vulnerability was found in Copeland LP E3 Supervisory Control up to 2.31F00. It has been classified as problematic. This affects an unknown part. This manipulation causes use of password hash instead of password for authentication. The identification of this vulnerability is CVE-2025-52543. It is possible to initiate the attack remotely. There... Weiterlesen

CVE-2026-115935 | Craft CMS up to 4.18.8/5.11.1 Process API Response Headers system X-Craft-Plugin-Licenses crlf injection (EUVD-2026-109191)

Sat, 24 Oct 2026 01:12:11 +0200

A vulnerability described as critical has been identified in Craft CMS up to 4.18.8/5.11.1. Impacted is the function system of the component Process API Response Headers. Executing a manipulation of the argument X-Craft-Plugin-Licenses can lead to crlf injection. This vulnerability is handled as CVE-2026-115935. The attack can be executed... Weiterlesen

CVE-2026-78119 | Zephyr Project up to 4.4.x Nuvoton NPCX eSPI Driver drivers/espi/espi_npcx.c espi_taf_parse out-of-bounds write (EUVD-2026-107486)

Sat, 24 Oct 2026 01:12:11 +0200

A vulnerability described as critical has been identified in Zephyr Project Zephyr up to 4.4.x. Impacted is the function espi_taf_parse of the file drivers/espi/espi_npcx.c of the component Nuvoton NPCX eSPI Driver. The manipulation results in out-of-bounds write. This vulnerability was named CVE-2026-78119. The attack needs to be approached... Weiterlesen

CVE-2026-79976 | Zephyr Project up to 4.4.2 MCTP-over-I2C+GPIO target binding mctp_i2c_gpio_target.c mctp_i2c_gpio_target_stop reg_addr/rxtx null pointer dereference (EUVD-2026-107487)

Sat, 24 Oct 2026 01:12:11 +0200

A vulnerability classified as critical was found in Zephyr Project Zephyr up to 4.4.2. The impacted element is the function mctp_i2c_gpio_target_stop of the file subsys/pmci/mctp/mctp_i2c_gpio_target.c of the component MCTP-over-I2C+GPIO target binding. Such manipulation of the argument reg_addr/rxtx leads to null pointer dereference. This... Weiterlesen

CVE-2026-115892 | Bytecode Alliance Wasmtime up to 48.0.6/49.0.3 Component Model input validation (EUVD-2026-109187)

Sat, 24 Oct 2026 01:12:11 +0200

A vulnerability categorized as problematic has been discovered in Bytecode Alliance Wasmtime up to 48.0.6/49.0.3. Affected by this issue is some unknown functionality of the component Component Model. The manipulation results in improper input validation. This vulnerability is reported as CVE-2026-115892. The attack can be launched remotely. No... Weiterlesen

CVE-2026-115889 | Bytecode Alliance Wasmtime up to 36.0.18/42.x Cranelift compiler backend indices type confusion (EUVD-2026-109186)

Sat, 24 Oct 2026 01:12:06 +0200

A vulnerability was found in Bytecode Alliance Wasmtime up to 36.0.18/42.x. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the component Cranelift compiler backend. The manipulation of the argument indices leads to type confusion. This vulnerability is documented as CVE-2026-115889. The attack can be... Weiterlesen

CVE-2026-19947 | Zephyr Project up to 4.4.x Device Multiplexer Pseudo-Driver devmux.c z_vrfy_devmux_select_get/z_vrfy_devmux_select_set improper authorization (EUVD-2026-107488)

Sat, 24 Oct 2026 01:12:06 +0200

A vulnerability marked as very critical has been reported in Zephyr Project Zephyr up to 4.4.x. This issue affects the function z_vrfy_devmux_select_get/z_vrfy_devmux_select_set of the file drivers/misc/devmux/devmux.c of the component Device Multiplexer Pseudo-Driver. The manipulation leads to improper authorization. This vulnerability is... Weiterlesen

CVE-2026-111804 | Apache Traffic Server up to 10.1.4/10.2.0 experimental wasm plugin transaction-close handler use after free (EUVD-2026-107490)

Sat, 24 Oct 2026 01:12:06 +0200

A vulnerability was found in Apache Traffic Server up to 10.1.4/10.2.0. It has been classified as critical. This impacts the function transaction-close handler of the component experimental wasm plugin. The manipulation leads to use after free. This vulnerability is documented as CVE-2026-111804. The attack can be initiated remotely. There is not... Weiterlesen

CVE-2026-114375 | leomoon-studios wiki-go up to 1.9.1 Files Rename API files.go RenameFileHandler currentPath/newName path traversal (GHSA-xg75-vx57-m5mx / EUVD-2026-107543)

Sat, 24 Oct 2026 01:12:06 +0200

A vulnerability classified as critical has been found in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. This vulnerability is identified as... Weiterlesen

CVE-2026-115887 | graphql-hive graphql-scalars prior 2.0.1 PhoneNumber PhoneNumber.ts parseLiteral/parseValue/serialize redos (EUVD-2026-109185)

Sat, 24 Oct 2026 01:12:05 +0200

A vulnerability has been found in graphql-hive graphql-scalars and classified as problematic. The impacted element is the function parseLiteral/parseValue/serialize of the file src/scalars/PhoneNumber.ts of the component PhoneNumber. This manipulation of the argument PhoneNumber causes inefficient regular expression complexity. This vulnerability... Weiterlesen

Detecting CVE-2026-96655 exploitation in Plex logs

Sat, 24 Oct 2026 01:10:12 +0200

Detecting CVE-2026-96655 exploitation in Plex logs Patching Plex Media Server to 1.43.3.10861 removes the SSRF described in CVE-2026-96655. It does not tell you whether someone already used it. That question is answerable, but only if you know what the server records. The flaw lets an authenticated user supply a path parameter to... Weiterlesen

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)

Sat, 24 Oct 2026 00:59:50 +0200

Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information... Weiterlesen

CVE-2022-47703 | TIANJIE CPE906-3 information disclosure (EUVD-2022-50462)

Fri, 23 Oct 2026 23:57:19 +0200

A vulnerability was found in TIANJIE CPE906-3. It has been classified as problematic. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2022-47703. The attack can only be performed from the local network. There is not any exploit... Weiterlesen

CVE-2022-47714 | Last Yard 22.09.8-1 cleartext transmission (EUVD-2022-50473)

Fri, 23 Oct 2026 23:57:18 +0200

A vulnerability identified as problematic has been detected in Last Yard 22.09.8-1. This issue affects some unknown processing. This manipulation causes cleartext transmission of sensitive information. The identification of this vulnerability is CVE-2022-47714. It is possible to initiate the attack remotely. There is no exploit available. Weiterlesen

CVE-2022-47715 | Last Yard 22.09.8-1 Cookie cleartext transmission (EUVD-2022-50474)

Fri, 23 Oct 2026 23:57:18 +0200

A vulnerability described as problematic has been identified in Last Yard 22.09.8-1. The impacted element is an unknown function of the component Cookie Handler. Executing a manipulation can lead to cleartext transmission of sensitive information. This vulnerability is tracked as CVE-2022-47715. The attack can be launched remotely. No exploit... Weiterlesen

CVE-2022-47717 | Last Yard 22.09.8-1 cross-domain policy (EUVD-2022-50476)

Fri, 23 Oct 2026 23:57:16 +0200

A vulnerability labeled as problematic has been found in Last Yard 22.09.8-1. Impacted is an unknown function. Such manipulation leads to permissive cross-domain policy with untrusted domains. This vulnerability is referenced as CVE-2022-47717. It is possible to launch the attack remotely. No exploit is available. Weiterlesen

CVE-2026-63848 | Linux Kernel up to 6.6.140/6.12.90/6.18.32/7.0.9 Drm Amdgpu Jpeg drm/amdgpu/jpeg Local Privilege Escalation

Fri, 23 Oct 2026 23:57:16 +0200

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.6.140/6.12.90/6.18.32/7.0.9. This issue affects some unknown processing of the file drm/amdgpu/jpeg of the component Drm Amdgpu Jpeg. Executing a manipulation can lead to Local Privilege Escalation. The identification of this vulnerability is CVE-2026-63848.... Weiterlesen

CVE-2026-63887 | Linux Kernel up to 7.0.11 SCSI Target iSCSI iscsi_encode_text_output heap-based overflow (Nessus ID 334954)

Fri, 23 Oct 2026 23:57:16 +0200

A vulnerability classified as very critical has been found in Linux Kernel up to 7.0.11. This vulnerability affects the function iscsi_encode_text_output of the component SCSI Target iSCSI. Performing a manipulation results in heap-based buffer overflow. This vulnerability is known as CVE-2026-63887. Remote exploitation of the attack is possible.... Weiterlesen

CVE-2026-24401 | Avahi up to 0.9rc2 mDNS/DNS-SD lookup_handle_cname recursion (ID 501 / EUVD-2026-4603)

Fri, 23 Oct 2026 23:57:16 +0200

A vulnerability marked as problematic has been reported in Avahi up to 0.9rc2. Impacted is the function lookup_handle_cname of the component mDNS/DNS-SD. This manipulation causes uncontrolled recursion. This vulnerability is tracked as CVE-2026-24401. The attack is possible to be carried out remotely. No exploit exists. To fix this issue, it is... Weiterlesen

CVE-2026-63844 | Linux Kernel up to 6.6.140/6.12.90/6.18.32/7.0.9 Amdgpu Jpeg drm/amdgpu/jpeg unusual condition

Fri, 23 Oct 2026 23:57:14 +0200

A vulnerability classified as very critical was found in Linux Kernel up to 6.6.140/6.12.90/6.18.32/7.0.9. The impacted element is an unknown function of the file drm/amdgpu/jpeg of the component Amdgpu Jpeg. Such manipulation leads to improper check for unusual conditions. This vulnerability is documented as CVE-2026-63844. The attack can be... Weiterlesen

CVE-2026-63860 | Linux Kernel up to 7.0.9 RDMA Core nla_strcmp null termination

Fri, 23 Oct 2026 23:57:13 +0200

A vulnerability was found in Linux Kernel up to 7.0.9. It has been classified as very critical. Affected by this vulnerability is the function nla_strcmp of the component RDMA Core. This manipulation causes improper null termination. This vulnerability appears as CVE-2026-63860. The attack may be initiated remotely. There is no available exploit.... Weiterlesen

CVE-2026-63886 | Linux Kernel up to 7.0.11 Iscsi chap_server_compute_hash chap_r allocation of resources (Nessus ID 340744)

Fri, 23 Oct 2026 23:57:11 +0200

A vulnerability described as very critical has been identified in Linux Kernel up to 6.1.175/6.6.142/6.12.92/6.18.34/7.0.11. This affects the function chap_server_compute_hash of the component Iscsi. The manipulation of the argument chap_r results in allocation of resources. This vulnerability is reported as CVE-2026-63886. The attack can be... Weiterlesen

CVE-2026-63850 | Linux Kernel up to 6.12.90/6.18.32/7.0.9 Vcn Encoder drm/amdgpu/vcn

Fri, 23 Oct 2026 23:57:11 +0200

A vulnerability labeled as problematic has been found in Linux Kernel up to 6.12.90/6.18.32/7.0.9. The affected element is an unknown function of the file drm/amdgpu/vcn of the component Vcn Encoder. The manipulation results in an unknown weakness. This vulnerability is identified as CVE-2026-63850. The attack can be executed remotely. There is... Weiterlesen

CVE-2026-63849 | Linux Kernel up to 6.18.32/7.0.9 Vcn Encoder drm/amdgpu/vcn set_no_user_fence

Fri, 23 Oct 2026 23:57:11 +0200

A vulnerability identified as problematic has been detected in Linux Kernel up to 6.18.32/7.0.9. Impacted is the function set_no_user_fence of the file drm/amdgpu/vcn of the component Vcn Encoder. The manipulation of the argument user_fence leads to an unknown weakness. This vulnerability is referenced as CVE-2026-63849. The attack can only be... Weiterlesen

CVE-2026-63846 | Linux Kernel up to 6.6.140/6.12.90/6.18.32/7.0.9 Drm Amdgpu Jpeg drm/amdgpu/jpeg

Fri, 23 Oct 2026 23:57:10 +0200

A vulnerability was found in Linux Kernel up to 6.6.140/6.12.90/6.18.32/7.0.9. It has been rated as problematic. This vulnerability affects unknown code of the file drm/amdgpu/jpeg of the component Drm Amdgpu Jpeg. Performing a manipulation results in an unknown weakness. This vulnerability was named CVE-2026-63846. The attack needs to be... Weiterlesen

CVE-2026-63845 | Linux Kernel up to 6.6.140/6.12.90/6.18.32/7.0.9 amdgpu/jpeg drm/amdgpu/jpeg

Fri, 23 Oct 2026 23:57:07 +0200

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 6.6.140/6.12.90/6.18.32/7.0.9. This affects an unknown function of the file drm/amdgpu/jpeg of the component amdgpu/jpeg. Performing a manipulation results in an unknown weakness. This vulnerability is reported as CVE-2026-63845. The attack requires a local... Weiterlesen

CVE-2026-96655 on a small business network

Fri, 23 Oct 2026 23:55:23 +0200

CVE-2026-96655 on a small business network Small organisations run media servers more often than their IT documentation admits. A Plex Media Server on the office network that streams training material or plays music in a lobby is a normal deployment. It is also an SSRF-capable host on the same segment as file shares, the NAS backup target, and the... Weiterlesen

Abandoned Popcorn Time app exposed millions of devices to RCE attacks

Fri, 23 Oct 2026 23:40:50 +0200

Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...] Weiterlesen

CVE-2022-47698 | Comfast CF-WR623N 2.3.0.1 URL Filtering cross site scripting (EUVD-2022-50457)

Fri, 23 Oct 2026 22:41:26 +0200

A vulnerability was found in Comfast CF-WR623N 2.3.0.1. It has been classified as problematic. The impacted element is an unknown function of the component URL Filtering. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2022-47698. Remote exploitation of the attack is possible. No exploit is available. Weiterlesen

CVE-2022-47699 | Comfast CF-WR623N 2.3.0.1 access control (EUVD-2022-50458)

Fri, 23 Oct 2026 22:41:26 +0200

A vulnerability was found in Comfast CF-WR623N 2.3.0.1. It has been declared as critical. This affects an unknown function. The manipulation results in improper access controls. This vulnerability is identified as CVE-2022-47699. The attack can only be performed from the local network. There is not any exploit available. Weiterlesen

CVE-2022-47700 | Comfast CF-WR623N up to 2.3.0.1 improper authentication (EUVD-2022-50459)

Fri, 23 Oct 2026 22:41:26 +0200

A vulnerability, which was classified as critical, was found in Comfast CF-WR623N up to 2.3.0.1. This issue affects some unknown processing. Such manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2022-47700. The attack can only be initiated within the local network. No exploit exists. Weiterlesen

CVE-2022-47701 | Comfast CF-WR623N 2.3.0.1 cross site scripting (EUVD-2022-50460)

Fri, 23 Oct 2026 22:41:26 +0200

A vulnerability identified as problematic has been detected in Comfast CF-WR623N 2.3.0.1. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2022-47701. It is possible to initiate the attack remotely. There is no exploit available. Weiterlesen

CVE-2026-91399 | Oracle Primavera P6 Enterprise Project Portfolio Management Web Access improper authorization (EUVD-2026-106653)

Fri, 23 Oct 2026 22:41:26 +0200

A vulnerability was found in Oracle Primavera P6 Enterprise Project Portfolio Management. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Web Access. Such manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-91399. The attack may be launched... Weiterlesen

CVE-2026-111332 | AtalayaLabs OxiCloud up to 0.9.3 /api/files/{id} improper authorization (EUVD-2026-102486)

Fri, 23 Oct 2026 22:41:26 +0200

A vulnerability was found in AtalayaLabs OxiCloud up to 0.9.3. It has been declared as problematic. This affects an unknown part of the file /api/files/{id}. The manipulation results in improper authorization. This vulnerability is reported as CVE-2026-111332. The attack can be launched remotely. No exploit exists. Weiterlesen

CVE-2026-111352 | ThinkCMF up to 8.0.1 RestAdminBaseController Auth::check improper authorization (EUVD-2026-102496)

Fri, 23 Oct 2026 22:41:26 +0200

A vulnerability was found in ThinkCMF up to 8.0.1 and classified as problematic. This vulnerability affects the function Auth::check of the component RestAdminBaseController. The manipulation results in improper authorization. This vulnerability is cataloged as CVE-2026-111352. The attack may be launched remotely. There is no exploit available. Weiterlesen

CVE-2026-111384 | nezhahq Nezha up to 2.3.14 File Manager /api/v1/ws/file/:id SetReadLimit memory allocation (EUVD-2026-102565)

Fri, 23 Oct 2026 22:41:26 +0200

A vulnerability was found in nezhahq Nezha up to 2.3.14. It has been rated as problematic. This issue affects the function SetReadLimit of the file /api/v1/ws/file/:id of the component File Manager. Performing a manipulation of the argument ID results in uncontrolled memory allocation. This vulnerability is cataloged as CVE-2026-111384. It is... Weiterlesen

CVE-2026-18963 | Red Hat Build of Keycloak keycloak-services password recovery (EUVD-2026-61063 / EDB-52699)

Fri, 23 Oct 2026 22:41:26 +0200

A vulnerability labeled as critical has been found in Red Hat Build of Keycloak. Affected by this vulnerability is an unknown functionality of the component keycloak-services. The manipulation results in weak password recovery. This vulnerability is reported as CVE-2026-18963. The attack can be launched remotely. Moreover, an exploit is present. Weiterlesen

CrowdStrike: PHP2Shell: Are Your Systems Exposed?

Fri, 23 Oct 2026 22:34:31 +0200

YouTube Video

Is your organization exposed to PHP2Shell?

See how the CrowdStrike Falcon platform helps security teams identify affected systems and container images, assess vulnerability risk, and investigate potential exploitation.

The apps are only the beginning.

Fri, 23 Oct 2026 22:32:40 +0200

Attackers target critical PHP flaws, and former CISA director Chris Krebs weighs in on AI’s role in the vulnerability surge. Railway confirms a cyberattack. HPE patches critical ArubaOS flaws. Quest Diagnostics investigates a disruptive intrusion. Capcom reports a data breach. China-linked hackers put AI-powered attacks on autopilot. And... Weiterlesen

Popcorn Time updater flaw exposed millions of devices to hijacking

Fri, 23 Oct 2026 22:32:30 +0200

Eye Research delivered more than two million update downloads in an operation to disable an abandoned Popcorn Time updater that could have allowed attackers to hijack Windows and macOS systems with full privileges. The vulnerability, tracked as CVE-2026-30612, affected the Time4Popcorn fork. Its update mechanism trusted unsigned executables... Weiterlesen

(Reliable)? php2shell exploitability, (Fri, Oct 23rd)

Fri, 23 Oct 2026 22:30:52 +0200

Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability. However, after looking closely at some published PoC's - and there is an unbelievable amount of AI generated - erm, slop - it looks like building a universal, reliable, one click exploit is quite difficult (unless I'm missing something, so... Weiterlesen

Google Alert – it security: PHP SECURITY VULNERABILITY: Citizens fear for their data – Authorities react! - YouTube

Fri, 23 Oct 2026 22:25:14 +0200

YouTube Video

There's a third PHP2Shell bug, but it won't get an emergency fix

Fri, 23 Oct 2026 22:25:10 +0200

As the PHP2Shell chaos continues, researchers have found a third PHP vulnerability that could allow attackers to take over websites or remotely run malware on vulnerable systems. But this one won’t receive an emergency fix. The PHP Foundation on Friday told The Register that it has reserved a CVE identifier (CVE-2026-115560) for a third RCE flaw... Weiterlesen

CVE-2026-79881 | HPE AOS-8 up to 8.10.0.23/8.13.3.0 improper authentication (WID-SEC-2026-4125)

Fri, 23 Oct 2026 21:49:47 +0200

A vulnerability has been found in HPE AOS-8 up to 8.10.0.23/8.13.3.0 and classified as critical. Affected by this issue is some unknown functionality. Performing a manipulation results in improper authentication. This vulnerability is reported as CVE-2026-79881. The attack is possible to be carried out remotely. No exploit exists. The affected... Weiterlesen

PHP2Shell: Exposure and Response with the CrowdStrike Falcon Platform

Fri, 23 Oct 2026 21:44:14 +0200

YouTube Video

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) introduces two critical remote code execution vulnerabilities affecting PHP, making it important for security teams to identify affected systems, understand their exposure, and investigate potential exploitation.

In this demo, see how the CrowdStrike Falcon® platform provides visibility into PHP2Shell vulnerabilities across endpoints and container images. Explore how Falcon helps security teams assess asset-level risk, review AI-generated vulnerability insights and remediation guidance, and investigate potential exploitation through behavioral detections and Falcon Next-Gen SIEM.

Discover how CrowdStrike connects vulnerability visibility, threat detection, and actionable security context to help organizations prioritize remediation and respond to PHP2Shell.

Learn more about CrowdStrike Falcon: https://cs.link/ut1tQ

📣 Connect With Us:
► LinkedIn:
https://www.linkedin.com/company/crowdstrike
► X:
https://twitter.com/CrowdStrike
► Facebook:
https://www.facebook.com/crowdstrike
► Instagram:
https://www.instagram.com/crowdstrike

🔔 Subscribe and stay updated!

#CrowdStrike #PHP2Shell #ProactiveSecurity

Hak5: Did Ukraine's Drone Strikes Really Take Down Russian Bots? | Threat Wire

Fri, 23 Oct 2026 21:43:02 +0200

YouTube Video

Did Ukraine’s drone strikes on Russian data centers really knock bot traffic down by 90%—and what does that mean for online disinformation? This week on Hack5’s Threat Wire, Ali breaks down Cloudflare’s findings, revisits research showing how just 250 malicious documents could poison an AI model, and explores a critical Linux KVM escape vulnerability discovered with the help of AI.

⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️

@endingwithali →
Twitch: https://twitch.tv/endingwithali
Twitter: https://twitter.com/endingwithali
YouTube: https://youtube.com/@endingwithali
Everywhere else: https://links.ali.dev

Want to work with Ali? hak5@endingwithali.com

[❗] Join the Patreon→ https://patreon.com/threatwire

LINKS
🔗 Story 1: A New Kind of Linux Escape
https://vercel.com/blog/one-million-dollar-hacker-challenge-for-vercel-sandbox
https://pwn.ai/blog/pwnescape
https://access.redhat.com/security/cve/cve-2026-99999
https://x.com/PaulosYibelo/status/2112200668257665149?s=46
https://www.cve.org/CVERecord/?id=CVE-2026-99999
🔗 Story 2: Bot Arms And Bot Farms
https://blog.cloudflare.com/yandex-outage/
https://www.theregister.com/security/2026/10/15/x-purges-13000-accounts-linked-to-suspected-meddling-ahead-of-us-midterms/5303234
https://x.com/GlobalAffairs/status/2110430142199644314
https://united24media.com/war-in-ukraine/russian-bot-activity-collapses-by-84-after-strikes-on-yandex-data-centers-23546
https://www.theguardian.com/world/2026/oct/13/ukrainian-strikes-russian-datacentres-online-disinformation-bots
https://www.bbc.com/news/articles/c9y7l0pm8jkko
https://x.com/GlobalAffairs/status/2110430142199644314
🔗 Story 3: A Throw Back Story
https://www.youtube.com/watch?v=7rg46Z6ZwCc
🔗 Story 4: BSides News
https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/
https://thehackernews.com/2026/10/opencode-console-breach-may-have.html
https://www.bbc.com/news/articles/cjkgeq0k1wevo
https://zmain.info/blog/plex2shell
https://www.bleepingcomputer.com/news/artificial-intelligence/openai-engineer-arrested-for-allegedly-planting-spy-device-in-office/
-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
____________________________________________

Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.

Engineering a Truly AI Agentic Penetration Testing Platform

Fri, 23 Oct 2026 21:38:40 +0200

A research and implementation guide to autonomous external web application and API security testing Autonomous penetration testing is evolving from conventional vulnerability scanning toward systems that can discover an application’s attack surface, form hypotheses about potential weaknesses, select appropriate tests, interpret results, adapt... Weiterlesen

PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches

Fri, 23 Oct 2026 21:33:04 +0200

PHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released. PHP has warned of a new code execution vulnerability, tracked as CVE-2026-115560, just two days after releasing emergency patches for the critical PHP2Shell flaws. The vulnerability affects only a specific PHP... Weiterlesen

The Morpheus Tutorials: Gleiches Modell und völlig unbrauchbar?! CLI Test Teil 2

Fri, 23 Oct 2026 21:04:25 +0200

YouTube Video

Hier geht's zu WECHSELPILOT: https://wechselpilot.short.gy/morpheus [Werbung]
Mit dem Code MORPHEUS bekommt ihr zusätzlich 20 € Cashback auf den ersten Wechsel.

Teil 2 vom CLI-Benchmark: GitHub Copilot CLI, OpenCode und Kilo Code bekommen dasselbe Modell wie die Tools aus Teil 1, Gemini 3.7 Flash, und dieselbe Aufgabe: MorphCook mit genau einem Prompt bauen. Ich schaue mir an, was jeder Harness daraus macht, wer mitten in der Arbeit stehen bleibt und was das am Ende kostet.

Quellen zum Video:
https://github.com/TheMorpheus407/morphcook
https://github.com/github/copilot-cli
https://github.com/anomalyco/opencode
https://github.com/Kilo-Org/kilocode

MorphReader im PlayStore:
https://play.google.com/store/apps/details?id=de.themorpheus.morph_reader_app&hl=de

MorphReader im App Store:
https://apps.apple.com/de/app/morphreader/id6741467699?platform=iphone

Newsletter und RSS-Feeds:
https://www.patreon.com/collection/880029?view=expanded

Kostenlos Informatik lernen mit der Bootstrap Academy:
https://bootstrap.academy/
https://github.com/Bootstrap-Academy/

Instagram:
https://www.instagram.com/themorpheustuts/

Meine anderen Kanäle und Projekte:
https://the-morpheus.de/

Discord:
https://the-morpheus.de/discord.html

Unterstützt mich – danke!
https://www.patreon.com/user?u=5322110
https://www.paypal.me/TheMorpheus

Kapitel:
0:00 Intro
1:22 Werbung: WECHSELPILOT
2:56 Grundlagen: Testaufbau, Modell, Sandbox, Kosten
8:48 GitHub Copilot CLI: Intro
11:11 GitHub Copilot CLI: Auswertung
21:21 OpenCode: Intro
22:57 OpenCode: Auswertung des Neulaufs
35:40 Kilo Code: Intro
37:51 Kilo Code: Auswertung
46:26 Fazit & Ausblick auf Teil 3

CVE-2025-58611 | Tickera Plugin up to 3.5.5.6 on WordPress cross-site request forgery