EILMELDUNGEN LIVE News-Tinder DECK
GLOBAL9.3CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.9CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.4CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.8CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.5CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.5CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.8CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.5CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.0CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.9CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.(07.11.2026 um 04:34 Uhr)
•
Sicherheitslücken (CVE)TechLinked: Microslop strikes again(07.11.2026 um 02:52 Uhr)
•
YouTube Security VideosGoogle Cloud Tech: Gemini Flash vs. Pro vs. Flash-Lite: How do you pick the right model for speed, cost, and reasoning?(07.11.2026 um 01:00 Uhr)
•
Windows Tipps & SecurityWorld of Warcraft Forever is the biggest launch in WoW history, beating Wrath of the Lich King(07.11.2026 um 07:22 Uhr)
•
Windows Tipps & SecurityBestseller Festplatten-Dockingstation bei Amazon dank Coupon auf 22,60 Euro redudziert(07.11.2026 um 08:59 Uhr)
•
Windows Tipps & SecurityShare X(07.11.2026 um 09:00 Uhr)
•
Windows Tipps & SecurityOrico Thunderbolt 5 Dock im Test: Üppige Ausstattung inklusive schnellem SSD-Anschluss(07.11.2026 um 09:00 Uhr)
•
Sicherheitslücken (CVE)October 2026 CVE Landscape​​ ​ - Recorded Future(07.11.2026 um 00:13 Uhr)
•
Windows Tipps & SecurityWindows 11: Microsoft führt den Patch-Anstieg auf KI-Scans zurück - ad-hoc-news.de(07.11.2026 um 05:15 Uhr)
•
Sicherheitslücken (CVE)Fragnesia: Linux-Lücke CVE-2026-46300, CVSS 7,8 [2026] - Tech Insider(07.11.2026 um 06:45 Uhr)
•
Unix & Linux ServerSecurity: Aktualisierungen in mozilla-nss (SUSE)(07.11.2026 um 00:05 Uhr)
•
GLOBAL9.3CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.9CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.4CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.8CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.5CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.5CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.8CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.5CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.0CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.9CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.(07.11.2026 um 04:34 Uhr)
•
Sicherheitslücken (CVE)TechLinked: Microslop strikes again(07.11.2026 um 02:52 Uhr)
•
YouTube Security VideosGoogle Cloud Tech: Gemini Flash vs. Pro vs. Flash-Lite: How do you pick the right model for speed, cost, and reasoning?(07.11.2026 um 01:00 Uhr)
•
Windows Tipps & SecurityWorld of Warcraft Forever is the biggest launch in WoW history, beating Wrath of the Lich King(07.11.2026 um 07:22 Uhr)
•
Windows Tipps & SecurityBestseller Festplatten-Dockingstation bei Amazon dank Coupon auf 22,60 Euro redudziert(07.11.2026 um 08:59 Uhr)
•
Windows Tipps & SecurityShare X(07.11.2026 um 09:00 Uhr)
•
Windows Tipps & SecurityOrico Thunderbolt 5 Dock im Test: Üppige Ausstattung inklusive schnellem SSD-Anschluss(07.11.2026 um 09:00 Uhr)
•
Sicherheitslücken (CVE)October 2026 CVE Landscape​​ ​ - Recorded Future(07.11.2026 um 00:13 Uhr)
•
Windows Tipps & SecurityWindows 11: Microsoft führt den Patch-Anstieg auf KI-Scans zurück - ad-hoc-news.de(07.11.2026 um 05:15 Uhr)
•
Sicherheitslücken (CVE)Fragnesia: Linux-Lücke CVE-2026-46300, CVSS 7,8 [2026] - Tech Insider(07.11.2026 um 06:45 Uhr)
•
Unix & Linux ServerSecurity: Aktualisierungen in mozilla-nss (SUSE)(07.11.2026 um 00:05 Uhr)
•
Intelligence View
⚡ tsecurity.de Intelligence

CVE-2025-60537 | kafka-ui 0.6.0/0.7.2 CustomSerdeLoader.java input validation

A vulnerability classified as problematic was found in kafka-ui 0.6.0/0.7.2. The affected element is an unknown function of the file…

Sicherheitslücken (CVE) VulDB Updates 1 Min. Lesezeit TA0005 · T1562.003 0-CLICK
Beitrag
0
Seite
0
↗ Quelle (VulDB Updates)
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!

A vulnerability classified as problematic was found in kafka-ui 0.6.0/0.7.2. The affected element is an unknown function of the file /kafka/ui/serdes/CustomSerdeLoader.java. Executing a manipulation can lead to improper input validation. This vulnerability is registered as CVE-2025-60537. The attack requires access to the local network. No exploit... Weiterlesen: CVE-2025-60537 | kafka-ui 0.6.0/0.7.2 CustomSerdeLoader.java input va…

Cyber Threat Intelligence & Forensik

ATT&CK-Navigator · IoC-Radar · Exploit-Belege
MITRE ATT&CK Matrix Navigator
7 belegte Techniken
T1562.003TA0005 · Defense Evasion
Impair Defenses:Impair Command History Logging
Gegenmaßnahme: keine allgemeine in ATT&CK dokumentiert
Quelle: CAPEC-Kette (CWE➔CAPEC➔ATT&CK) · CAPEC-13 (Subverting Environment Variable Values) · Konfidenz 90%
T1574.006TA0004 · Privilege Escalation
Hijack Execution Flow:Dynamic Linker Hijacking
Gegenmaßnahme: keine allgemeine in ATT&CK dokumentiert
Quelle: CAPEC-Kette (CWE➔CAPEC➔ATT&CK) · CAPEC-13 (Subverting Environment Variable Values) · Konfidenz 90%
T1574.007TA0004 · Privilege Escalation
Hijack Execution Flow:Path Interception by PATH Environment Variable
Gegenmaßnahme: keine allgemeine in ATT&CK dokumentiert
Quelle: CAPEC-Kette (CWE➔CAPEC➔ATT&CK) · CAPEC-13 (Subverting Environment Variable Values) · Konfidenz 90%
T1027TA0005 · Defense Evasion
Obfuscated Files or Information
Gegenmaßnahme: keine allgemeine in ATT&CK dokumentiert
Quelle: CAPEC-Kette (CWE➔CAPEC➔ATT&CK) · CAPEC-267 (Leverage Alternate Encoding) · Konfidenz 90%
T1539TA0006 · Credential Access
Steal Web Session Cookie
Gegenmaßnahme: keine allgemeine in ATT&CK dokumentiert
Quelle: CAPEC-Kette (CWE➔CAPEC➔ATT&CK) · CAPEC-31 (Accessing/Intercepting/Modifying HTTP Cookies) · Konfidenz 90%
Cookie-Flags (HttpOnly/Secure/SameSite) setzen, MFA erzwingen, Session-Laufzeiten verkürzen.
OWASP ZAPModSecurity
T1036.001TA0005 · Defense Evasion
Masquerading: Invalid Code Signature
Gegenmaßnahme: keine allgemeine in ATT&CK dokumentiert
Quelle: CAPEC-Kette (CWE➔CAPEC➔ATT&CK) · CAPEC-473 (Signature Spoof) · Konfidenz 90%
T1553.002TA0005 · Defense Evasion
Subvert Trust Controls: Code Signing
Gegenmaßnahme: keine allgemeine in ATT&CK dokumentiert
Quelle: CAPEC-Kette (CWE➔CAPEC➔ATT&CK) · CAPEC-473 (Signature Spoof) · Konfidenz 90%
Privilege Escalation
Defense Evasion
Credential Access
IoC Intelligence
1 Indikatoren · Defanged · STIX 2.1
CVE-2025-60537
Exploit & Remediation Lifecycle
PoC · Ausnutzung · Patch-Stufen
CVE-2025-60537
Entdeckung & Meldung
Schwachstelle identifiziert & registriert
Sicherheits-Advisory
Offizielle Warnung & CVE-Zuweisung
Exploit / PoC
Öffentlicher Nachweis/Code verfügbar (Exploit-DB/EUVD)
In-the-Wild Ausnutzung
Keine Massenausnutzung gemeldet
Patch & Schutzmaßnahmen
Noch kein offizieller Patch dokumentiert
Exploit Weaponization & PoC Radar
Nur belegte Faktoren · kein Score-Theater
CRITICAL WEAPONIZED · Index 75/100
Exploit-DB
Kein EDB-Eintrag
Interaktion
0-Click
Authentifizierung
Nicht erforderlich

CWE-Schwachstellen-Taxonomie & Defensive Architektur

Schwachstellen-Klassen · Root Cause · Mitigation
MITRE CWE Matrix
CWE-20 Software-Schwachstellen-Klasse CWE-20
Allgemeine Sicherheitsarchitektur
Wurzelursache (Root Cause)
Spezifische Schwachstelle gemäß MITRE CWE-Katalog.
Exploitation-Mechanik
Potenzielle Beeinträchtigung von Vertraulichkeit, Integrität oder Verfügbarkeit.
Defensive Architektur
Upstream-Advisory und herstellerspezifische Richtlinien für sichere Programmierung prüfen.

Compliance, SLA & Vendor Adherence

Advisory-Prüfung · Score-Einordnung · Fristen
CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Impact: 2.51 | Exploitability: 3.89
AVN
Netzwerk (Remote)
Aus der Ferne über das Internet ohne Vorbedingungen exploitbar.
ACL
Niedrig (Low)
Wiederholbar und deterministisch ohne spezielle Race Conditions ausnutzbar.
PRN
Keine (Unauthenticated)
Vollständig unauthentifiziert ohne Benutzerkonto exploitbar.
UIN
Keine (Zero-Click)
Autonom ohne menschliches Zutun ausführbar (Zero-Click Exploitation).
SU
Unverändert (Scope Unchanged)
Auswirkungen verbleiben isoliert in der angreifbaren Anwendungskomponente.
CL
Gering (Teilabfluss)
Teilweiser oder kein Datenabfluss.
IL
Gering (Teilweise)
Teilweise oder keine Manipulation.
AN
Keine
Teilweise oder keine Beeinträchtigung.
NVD Primärbewertung & CISA SSVCCVE-2025-60537
NVD: DeferredNVD 6.5 · MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD-Datenstand: 05.11.2026, 22:10 UTC
Ausnutzung beobachtet: Nein Automatisierbar: Nein Technischer Impact: Total
CISA-SSVC-Triage (vulnrichment)CVE-2025-60537
Exploitation: none (Keine bekannte Ausnutzung)Automatable: no (Nicht automatisierbar)Technical Impact: total (Vollständig)
Quelle: CISA-ADP vulnrichment · Stand 2025-10-14T18:28:05.681610Z · CISA Coordinator
Advisory Radar

Hersteller-Sicherheitsmeldungen & Patch-Status

In herstellerseitiger Prüfung
Handlungsempfehlung für Administratoren

Hersteller-Advisory noch nicht formal hinterlegt. Regelmäßiges Re-Scanning der CTI-Quellen anberaumt.

Referenzen aus der Primärquelle („Verifiziert" nur bei Hersteller-Domäne):
Powered by tsecurity.de tsecurity.de Hub
🚀 Auf tsecurity.de entdecken
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
Noch keine Leser-Bewertungen
War diese Seite hilfreich?
0
Jetzt Bewertung abgeben
🟢 Niedrig (1-3.9) 🟡 Mittel (4.0-6.9) 🔴 Hoch (7.0-8.9) Kritisch (9.0-10.0)
Powered by tsecurity.de tsecurity.de Hub
🚀 Auf tsecurity.de entdecken

Verwandte Story-Cluster & Quellen (Vektor-KI)

10 Quellen
CVE-2022-4141 | vim heap-based overflow (EUVD-2022-51503 / Nessus ID 211280)
9 weitere Quellen
VulDB Updatesvor 5 Std.CVE-2022-4143 | GitLab improper authorization (Issue 383776 / EUVD-2022-51505) VulDB Updatesvor 5 Std.CVE-2022-4144 | QEMU QXL Display Device Emulation qxl_phys2virt out-of-bounds (FEDORA-2022-22b1f8dae2 / EUVD-2022-51506) VulDB Updatesvor 5 Std.CVE-2022-4167 | GitLab Enterprise Edition up to 15.5.6/15.6.3/15.7.1 Group Access Token improper authorization (Issue 367740 / EUVD-2022-51528) VulDB Updatesvor 5 Std.CVE-2022-4170 | Marc Lehmann rxvt-unicode Perl Background Extension injection (EUVD-2022-51531) VulDB Updatesvor 4 Std.CVE-2025-61577 | D-Link DIR-816A2 1.10CNB05 dir_setWanWifi statuscheckpppoeuser stack-based overflow VulDB Updatesvor 3 Std.CVE-2026-89092 | GNU C Library up to 2.44 nscd stack-based overflow (Nessus ID 377033 / WID-SEC-2026-3317)
+3
10 Quellen
CVE-2026-120551 | aresit WP Compress Plugin up to 7.22.01 on WordPress authorization (EUVD-2026-115661)
9 weitere Quellen
VulDB Updatesvor 4 Std.CVE-2026-120540 | iubenda Plugin up to 3.13.6 on WordPress HTML Parser parse_comments HTML injection (EUVD-2026-118572) VulDB Updatesvor 4 Std.CVE-2026-119218 | WPSoul Greenshift Plugin up to 13.2.2 on WordPress Comment comment_author_url cross site scripting (EUVD-2026-118571) VulDB Updatesvor 4 Std.CVE-2026-119175 | gijo Flying Images Plugin up to 2.4.15 on WordPress Comment comment cross site scripting (EUVD-2026-118568) VulDB Updatesvor 4 Std.CVE-2026-115816 | extendthemes Kubio AI Page Builder Plugin up to 2.9.4 on WordPress comment cross site scripting (EUVD-2026-118569) VulDB Updatesvor 4 Std.CVE-2026-121515 | Foliovision FV Flowplayer Video Player Plugin up to 7.5.56.7212 on WordPress comment cross site scripting (EUVD-2026-118567) VulDB Updatesvor 4 Std.CVE-2026-104913 | esaia Interactive Real Estate Plugin up to 2.6.0 on WordPress extract_zip_data unrestricted upload (EUVD-2026-118566)
+3
8 Quellen
CVE-2023-3106 | Linux Kernel up to 4.8-rc6 Netlink Socket net/xfrm/xfrm_user.c xfrm_dump_sa null pointer dereference
7 weitere Quellen
VulDB Updatesvor 1 Std.CVE-2026-72222 | Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.4 sunrpc svc_tcp_handshake use after free (Nessus ID 377032) VulDB Updatesvor 1 Std.CVE-2026-72080 | Linux Kernel up to 6.18.41/7.1.4/7.2-rc2 resctrl fs/resctrl resctrl_exit priv use after free (Nessus ID 377032) VulDB Updatesvor 1 Std.CVE-2026-72221 | Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.4 sunrpc svc_tcp_handshake race condition (Nessus ID 377032) VulDB Updatesvor 5 Std.CVE-2022-4139 | Linux Kernel GPU i915 Kernel Driver permissions (EUVD-2022-51501 / Nessus ID 236642) VulDB Updatesvor 4 Std.CVE-2025-39959 | Linux Kernel up to 6.16.8 ASoC set_tdm_slot null pointer dereference (Nessus ID 271155 / WID-SEC-2025-2246) Linux, GNU/Linux, free soft…vor 21 Std.OpenAI finds 948 local privilege escalation bugs in the Linux kernel
+1

Mehr aus dieser Kategorie

TechLinked: Microslop strikes again
07.11.2026
October 2026 CVE Landscape​​ ​ - Recorded Future
07.11.2026
Fragnesia: Linux-Lücke CVE-2026-46300, CVSS 7,8 [2026] - Tech Insider
07.11.2026
CVE-2025-56748 | Creativeitem Academy LMS up to 5.13 Password Reset password recovery
07.11.2026
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
Zum Aktualisieren ziehen
TTS Reader • tsecurity.de Voice
Nächster Beitrag