CVE-2026-89477: Schwachstellen-Eintrag (NVD)
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix NULL deref on untransmitted RECONF completion
sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and
sctp_process_strreset_resp() complete a pending stream reconfiguration
request by stopping the reconf timer on the transport it was sent on:
t = asoc->strreset_chunk->transport;
if (timer_delete(&t->reconf_timer))
sctp_transport_put(t);
chunk->transport is assigned by __sctp_packet_append_chunk() when the
chunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms
the reconf timer at that same point. A request already published in
asoc->strreset_chunk but not yet transmitted has neither, so completing
it dereferences NULL.
Two ways to get there. sctp_send_asconf_del_ip() sets
asoc->src_out_of_asoc_ok without sending anything when the address being
removed is the association's last one, and sctp_outq_flush_ctrl() then
leaves every non-ASCONF control chunk queued; as only
sctp_process_asconf_ack() clears that flag, it persists. An unprivileged
process that removes such an address and then asks for a stream reset
panics the kernel from softirq. A peer needs neither ASCONF nor local
help: sctp_cmd_interpreter() uncorks the outqueue only once the whole
packet has been processed, so a reply built while walking a RECONF chunk
stays untransmitted for the rest of that walk, and one RECONF chunk
carrying [Incoming SSN Reset Request, Outgoing SSN Reset Request,
Response] -- or two RECONF chunks in one packet -- reaches the same
dereference.
KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef]
RIP: 0010:timer_delete+0x67/0x110
Call Trace:
sctp_process_strreset_addstrm_out (net/sctp/stream.c:832)
sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212)
sctp_do_sm (net/sctp/sm_sideeffect.c:1172)
sctp_assoc_bh_rcv (net/sctp/associola.c:1044)
sctp_rcv (net/sctp/input.c:243)
ip_local_deliver (net/ipv4/ip_input.c:262)
process_backlog (net/core/dev.c:6680)
A response can only acknowledge a request that was actually sent, so do
not match asoc->strreset_chunk while chunk->transport is NULL. Guarding
the lookup covers all three completion sites.
- 🔗 git.kernel.org/stable/c/0ee697defc0594f1da810ed75d9d643f…
- 🔗 git.kernel.org/stable/c/25419f516ea84b1e7d3d55aae5215ac8…
- 🔗 git.kernel.org/stable/c/2db9bfa3e27bdea15e05ea70b56bad3d…
- 🔗 git.kernel.org/stable/c/53141db979687eae7dc6d29414cefc77…
- 🔗 git.kernel.org/stable/c/68891125af5a5dfbca728809a16637a8…
- 🔗 git.kernel.org/stable/c/77ea60f2d24002c308f224db44a4542c…
- 🔗 git.kernel.org/stable/c/79ff751311e80fa0370007e46a79a6d6…
- 🔗 git.kernel.org/stable/c/b2d6d873b4dfb5b84194061c4b40a1cd…
Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | 2026-08-29 | 2026-09-15 |
|---|---|---|
| ≥90 % | 4 | 0 |
| ≥50 % | 4 | 0 |
| ≥10 % | 3 | 0 |
| <10 % | 304 | 300 |
Vite-Sicherheitslücke CVE-2026-39364: Angreifer scannen Dev-Server und stehlen Cloud-Zugangsdaten
LONDON (IT BOLTWISE) – Eine groß angelegte Scan-Kampagne nutzt eine Sicherheitslücke in Vite, um auf internetexponierten Entwicklerservern sensible Dateien auszulesen. Angreifer greifen dabei über einen /@fs/-Mechanismus auf Konfigurations-
Cisco Email Gateway Zero-Day Actively Exploited
Cisco has disclosed that attackers are actively exploiting a zero-day SQL injection vulnerability in its Secure Email Gateway appliances. This article has been indexed from CyberMaterial Read the original article: Cisco Email Gateway Zero-D
Marimo-RCE und Redis-Kryptomining: Angreifer wechseln in Sekunden zwischen Ketten
LONDON (IT BOLTWISE) – Eine neue Analyse zeigt, wie ein Angreifer nach Ausnutzung von CVE-2026-39987 in nur acht Sekunden von einem Marimo-Notebook zu einem SSH-Bastion-Host springt. Die Vorgehensweise nutzt ein handgeschriebenes Python-Too
Hackers Exploit WooCommerce Plugin Bug to Take Over WordPress Sites Without Login
Attackers are actively exploiting a critical flaw in a WooCommerce extension to seize control of WordPress sites without a username or password. The issue affects Wholesale Lead Capture and turns a routine file-upload feature into a direct
Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day
Cisco warns of a critical zero-day in Secure Email Gateway, exploited in the wild to gain root access through malicious emails. Cisco disclosed a critical zero-day, tracked as CVE-2026-76461 (CVSS score of 9.8), affecting Secure Email Gatew
CVE-2026-91923 | KubeSphere up to 4.1.3 Git Credential Verification Endpoint server-side request forgery (EUVD-2026-78414)
A vulnerability, which was classified as problematic, was found in KubeSphere up to 4.1.3. This affects an unknown function of the component Git Credential Verification Endpoint. Such manipulation leads to server-side request forgery. This
CVE-2026-91922 | Steedos Platform up to 3.0.15-beta.47 Page Render /api/page/render schemaApi/data cross site scripting (EUVD-2026-78413)
A vulnerability, which was classified as problematic, has been found in Steedos Platform up to 3.0.15-beta.47. The impacted element is an unknown function of the file /api/page/render of the component Page Render. This manipulation of the a
CVE-2026-1759 | Secomea GateManager 11.4.6255150720/11.5;0 permission (EUVD-2026-78412)
A vulnerability classified as problematic has been found in Secomea GateManager 11.5;0/11.4.6255150720. Impacted is an unknown function. The manipulation leads to permission issues. This vulnerability is listed as CVE-2026-1759. The attack
CVE-2026-91924 | sosedoff pgweb up to 0.17.0 improper authorization (EUVD-2026-78415)
A vulnerability described as critical has been identified in sosedoff pgweb up to 0.17.0. This issue affects some unknown processing. Executing a manipulation can lead to improper authorization. This vulnerability is tracked as CVE-2026-919
CVE-2026-91786 | Red Hat Enterprise Linux GNOME Shell out-of-bounds (EUVD-2026-78417)
A vulnerability labeled as critical has been found in Red Hat Enterprise Linux. This affects an unknown part of the component GNOME Shell. Such manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-91786. It
CVE-2026-91925 | Polyaxon up to 2.16.4 Jinja2 queue/namespace/conditions/presets/dependencies code injection (EUVD-2026-78416)
A vulnerability marked as critical has been reported in Polyaxon up to 2.16.4. This vulnerability affects unknown code of the component Jinja2. Performing a manipulation of the argument queue/namespace/conditions/presets/dependencies result
Mass-Scanning missbraucht Vite-Schwachstelle für Cloud-Kredenziale
LONDON (IT BOLTWISE) – Angreifer scannen offenbar massenhaft das Internet nach Vite-Entwicklungsservern, die falsch erreichbar gemacht wurden. Laut F5 Labs nutzt die Kampagne eine Schwachstelle mit der Kennung CVE-2026-39364, um per Anfrage
Marimo-RCE: Menschliche Angreifer pivotieren in acht Sekunden bis zum SSH-Bastion
LONDON (IT BOLTWISE) – Eine Analyse von Sysdig zeigt, wie ein menschlicher Angreifer nach dem Zugriff über eine Marimo-Schwachstelle in nur acht Sekunden zu einem SSH-Bastionhost pivotiert. Die Kette nutzt CVE-2026-39987 mit einem CVSS-Scor
CVE-2026-61907 | cyrus-imapd JMAP privileges management
A vulnerability identified as very critical has been detected in cyrus-imapd. This impacts an unknown function of the component JMAP. This manipulation causes improper privilege management. This vulnerability is handled as CVE-2026-61907. T
CVE-2026-71801 | SPMS-Server up to 1.0 hard-coded credentials
A vulnerability marked as critical has been reported in SPMS-Server up to 1.0. The impacted element is an unknown function. This manipulation causes hard-coded credentials. This vulnerability is handled as CVE-2026-71801. The attack can be
CVE-2026-71616 | GPAC gf_route_media_complete_object denial of service
A vulnerability was found in GPAC. It has been classified as problematic. Affected by this issue is the function gf_route_media_complete_object. This manipulation causes denial of service. This vulnerability is registered as CVE-2026-71616.
CVE-2026-71612 | GPAC nhntdmx_process buffer overflow
A vulnerability, which was classified as critical, was found in GPAC. This impacts the function nhntdmx_process. Executing a manipulation can lead to buffer overflow. This vulnerability is tracked as CVE-2026-71612. The attack can be launch
CVE-2026-71614 | GPAC dvb_mpe dvb_mpe.c descriptorTime_slice_fec_identifier code injection (EUVD-2026-75128)
A vulnerability, which was classified as critical, has been found in GPAC. This affects the function descriptorTime_slice_fec_identifier of the file src/media_tools/dvb_mpe.c of the component dvb_mpe. Performing a manipulation results in co
CVE-2026-38998 | Live555 2026.02.26 RTSP RTPInterface.cpp tcpReadHandler1 use after free
A vulnerability, which was classified as critical, was found in Live555 2026.02.26. The affected element is the function SocketDescriptor::tcpReadHandler1 of the file liveMedia/RTPInterface.cpp of the component RTSP Handler. Such manipulati
CVE-2026-52482 | SJRC F11 SJ-GPS-PRO 2019-09-17 inetd service /app/sh_for_telnet information disclosure
A vulnerability was found in SJRC F11 SJ-GPS-PRO 2019-09-17 and classified as problematic. Impacted is an unknown function of the file /app/sh_for_telnet of the component inetd service. Such manipulation leads to information disclosure. Thi
CVE-2026-80914 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 Bluetooth ISO iso_conn_ready use after free
A vulnerability, which was classified as very critical, was found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. This affects the function iso_conn_ready of the component Bluetooth ISO. Such manipulation leads to use after free. This vulnera
Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors
Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin that lets unauthenticated attackers upload malicious PHP files and potentially seize full control of vulnerable WordPress sites.
Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors
Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin that lets unauthenticated attackers upload malicious PHP files and potentially seize full control of vulnerable WordPress sites.
Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Malware
A Chinese-speaking threat actor tracked as Red Heron has exploited a remote-code-execution vulnerability in Gitea to steal source code, establish persistence, and deploy a previously undocumented Linux rootkit. The campaign weaponized CVE-2
Hackers Exploit WooCommerce Plugin Bug to Take Over WordPress Sites Without Login
Attackers are actively exploiting a critical flaw in a WooCommerce extension to seize control of WordPress sites without a username or password. The issue affects Wholesale Lead Capture and turns a routine file-upload feature into a direct
Hackers Exploit WooCommerce Plugin Bug to Take Over WordPress Sites Without Login
Attackers are actively exploiting a critical flaw in a WooCommerce extension to seize control of WordPress sites without a username or password. The issue affects Wholesale Lead Capture and turns a routine file-upload feature into a direct
Hackers Actively Exploiting Gitea n-day RCE Vulnerability in the Wild to Hijack Instances
Hackers are actively exploiting a critical Gitea remote code execution vulnerability, tracked as CVE-2026-60004, to compromise internet-facing source-code management servers. Researchers found that a Chinese-speaking threat actor, named Red
Hackers Actively Exploiting Gitea n-day RCE Vulnerability in the Wild to Hijack Instances
Hackers are actively exploiting a critical Gitea remote code execution vulnerability, tracked as CVE-2026-60004, to compromise internet-facing source-code management servers. Researchers found that a Chinese-speaking threat actor, named Red
Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
A threat actor exploited a critical pre-authentication remote code execution vulnerability in marimo to harvest AWS credentials, retrieve an SSH private key from AWS Secrets Manager, and authenticate to a bastion host in just eight seconds,
Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
A threat actor exploited a critical pre-authentication remote code execution vulnerability in marimo to harvest AWS credentials, retrieve an SSH private key from AWS Secrets Manager, and authenticate to a bastion host in just eight seconds,
WooCommerce Plugin Bug Lets Remote Attackers Create Admin Accounts and Take Over Sites
A critical security flaw in the WooCommerce Wholesale Lead Capture plugin is being actively exploited, allowing remote attackers to upload malicious files and potentially take full control of vulnerable WordPress sites. The vulnerability, t
Hackers Exploit Marimo RCE to Steal AWS Credentials and Reach Bastion Host in 8 Seconds
Threat actors have been observed exploiting a critical remote code execution vulnerability in the Marimo notebook platform to steal AWS credentials and authenticate to an SSH bastion host within eight seconds. The attack, documented by the
Hackers Exploit Marimo RCE to Steal AWS Credentials and Reach Bastion Host in 8 Seconds
Threat actors have been observed exploiting a critical remote code execution vulnerability in the Marimo notebook platform to steal AWS credentials and authenticate to an SSH bastion host within eight seconds. The attack, documented by the
Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
A threat actor exploited a pre-authentication remote code execution flaw in marimo to harvest AWS credentials, retrieve an SSH private key from AWS Secrets Manager, and authenticate to a bastion host in eight seconds. Tracked as CVE-2026-39
CVE-2026-76461 bei Cisco Secure Email Gateway: Root-Command-Ausführung aktiv ausgenutzt
LONDON (IT BOLTWISE) – Cisco warnt vor einer kritischen Schwachstelle in der AsyncOS-Implementierung des Cisco Secure Email Gateway, die bereits aktiv ausgenutzt wird. Die Lücke mit der Kennung CVE-2026-76461 erreicht einen CVSS-Wert von 9,
Schwachstelle in LiteSpeed Enterprise: Root-Zugriff für Shared-Hosting-Accounts möglich
LONDON (IT BOLTWISE) – Eine kritische Sicherheitslücke in LiteSpeed Web Server Enterprise könnte es Nutzern mit niedrigem Privileg auf Shared-Hosting-Servern ermöglichen, Root-Zugriff zu erlangen. Betroffen sind Versionen vor 6.3.7; cPanel
Cisco AsyncOS: CVE-2026-76461 wird aktiv ausgenutzt – Patch bis 17. September 2026
LONDON (IT BOLTWISE) – Cisco warnt, dass die Lücke in AsyncOS für den Secure Email Gateway bereits aktiv ausgenutzt wird. Die Schwachstelle CVE-2026-76461 (CVSS 9,8/10) kann laut Hersteller einem unauthentifizierten Angreifer das Ausführen
Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges
Security researchers have disclosed a local privilege escalation vulnerability in the Linux kernel related to the Reliable Datagram Sockets (RDS) zero-copy send path. This vulnerability could let an unprivileged local attacker gain root pri
Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges
Security researchers have disclosed a local privilege escalation vulnerability in the Linux kernel related to the Reliable Datagram Sockets (RDS) zero-copy send path. This vulnerability could let an unprivileged local attacker gain root pri
Non-Zero-Day VPN Flaw Left Japan ‘s Government Shared Network Platform Exposed: 246,000 Records at Risk
Japan ‘s Digital Agency disclosed a VPN breach exposing 246,000 government employee records across 23 ministries. Detected June 25, publicly disclosed September 11. Japan ‘s Digital Agency disclosed that attackers exploited a vulnerability
GRIMWEDGE nutzt Chrome-Windows Patch-Gap: Mehrstufige Zero-Day Kette im Fokus
LONDON (IT BOLTWISE) – Ein von Volexity beobachteter chinesisch zugeordneter Angriffscluster nutzt eine Spear-Phishing-Kampagne, um eine mehrstufige Zero-Day-Chain aus Chrome- und Windows-Schwächen auszulösen. Der Einstieg erfolgt über eine
Nintendo Switch Vulnerability Lets Nearby Attackers Run Unauthorized Code via QR Codes
Nintendo has patched a high-severity vulnerability in the Nintendo Switch that could allow nearby attackers to execute unauthorized code or access information stored on affected consoles by abusing QR-code-based local wireless connections.
GRIMWEDGE & BlueMoon: Chrome-Windows-Zero-Day-Kette über reflektiertes XSS
LONDON (IT BOLTWISE) – Forschende ordnen einen Spear-Phishing-Angriff zu, der eine reflektierte XSS-Schwachstelle auf einer U.S.-Uni-Webseite missbraucht. Die Angreifer kombinieren drei zuvor gepatchte Lücken in Google Chrome und Windows, u
Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation
An unauthenticated attacker can exploit CVE-2026-76461 to execute arbitrary commands on the underlying OS with root privileges. The post Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation appeared first on SecurityWee
A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure trove
Yet another security vulnerability has been discovered in GitLab infrastructure, this one a perfect 10 in severity. CVE-2026-85706, the second flaw GitLab has disclosed in just a month, is a maximum-severity vulnerability that allows attack
A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure trove
Yet another security vulnerability has been discovered in GitLab infrastructure, this one a perfect 10 in severity. CVE-2026-85706, the second flaw GitLab has disclosed in just a month, is a maximum-severity vulnerability that allows attack
Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation
Categories: Threat ResearchTags: advisory, vulnerability, Cisco Weiterlesen
Angriffe auf öffentlich erreichbare Vite-Dev-Server: Hacker suchen AWS- und Azure-Geheimnisse
LONDON (IT BOLTWISE) – Eine groß angelegte Scanning-Kampagne zielt auf öffentlich erreichbare Vite-Entwicklungsserver. Laut F5 missbrauchen Angreifer eine Schwachstelle CVE-2026-39364, um Datei- und Zugriffsbeschränkungen zu umgehen und sen
Red Heron nutzt Gitea-RCE und Rootkit SIXZUT für 13 kompromittierte Ziele
LONDON (IT BOLTWISE) – Ein mutmaßlich China-gebundenes Akteurscluster soll eine neu offengelegte Schwachstelle in Gitea (CVE-2026-60004) schnell zu einem automatisierten Angriffsframework ausgebaut haben. Dabei wird von 1.386 gescannten Git
GitLab warnt nach „In-the-wild“-Hinweisen vor Path-Traversal (CVE-2026-85706)
LONDON (IT BOLTWISE) – Hinweise auf „In-the-wild“-Ausnutzung rücken eine GitLab-Schwachstelle mit maximaler Kritikalität in den Fokus. Betroffen ist CVE-2026-85706, das Angreifern unter bestimmten Bedingungen den Zugriff auf beliebige Datei
Logitech Options+ flaw lets attackers gain Windows SYSTEM privileges
A vulnerability in Logitech Options+ allows a standard Windows user to gain SYSTEM-level privileges by exploiting a weakness in the software’s updater service. Tracked as CVE-2026-12518, the issue requires no administrator rights, network a
Nintendo warns of Switch code execution flaw via on-screen QR codes
Nintendo has patched a high-severity Nintendo Switch vulnerability that could allow a nearby attacker to execute unauthorized code or access information stored on the console. The flaw, tracked as CVE-2026-82079, affects Switch systems runn
CISA warnt: GitLab-Schlagloch CVE-2026-85706 aktiv ausgenutzt
USA / LONDON (IT BOLTWISE) – Die US-Cybersicherheitsbehörde CISA meldet, dass Angreifer eine GitLab-Sicherheitslücke maximaler Schwere (CVE-2026-85706) bereits ausnutzen. Betroffen ist ein DevSecOps-Feature, bei dem fehlende Authentifizieru
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
Ravie LakshmananSep 11, 2026Vulnerability / Malware Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center (FMC)
Imperva Customers Protected Against StyleSmuggler (CVE-2026-75650) in Adobe Commerce and Magento Open Source
TL;DR: CVE-2026-75650, dubbed StyleSmuggler, is a critical vulnerability affecting Adobe Commerce and Magento Open Source. The vulnerability allows an unauthenticated attacker to inject malicious PHP code into Magento’s template system and
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. First, CVE-2026-20079 is an authentication bypass vulnerability in unpatched instances of Cisco’s Secure F
Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical."Microsoft notes that 2 of the vulnerabiliti
Nightmare Eclipse drops a CrowdStrike zero-day.
Extortion group leaks alleged Manchester Airports Group data. France's CNIL fines hospital over 2025 data breach. Weiterlesen
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added seven security flaws to its Known Exploited Vulnerabilities (KEV) catalog after they landed in attackers’ crosshairs. The vulnerabilities are as follows – C
CVE-2026-75757 | Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegE
Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin'