A critical vulnerability in Google’s shared DevSite platform allowed unauthenticated attackers to forge Flask session cookies and trigger remote code execution through unsafe Python deserialization. Disclosed on October 12, 2026, Simonkoeck describes an unusual failure: the session cookie contained the same secret used to sign it. Google awarded a... Weiterlesen: Critical Google DevSite Flaw Let Attackers Execute Remote Code Using …
Intelligence View
⚡ tsecurity.de Intelligence
Critical Google DevSite Flaw Let Attackers Execute Remote Code Using Forged Flask Sessions
A critical vulnerability in Google’s shared DevSite platform allowed unauthenticated attackers to forge Flask session cookies and trigger remote code execution …
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
🔍 CTI & Forensik
2
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
MITRE ATT&CK Matrix Navigator
T1190TA0001 · Initial Access
Exploit Public-Facing Application
Mitigation: M1042 Network Segmentation & WAF Rule Enforcement
Quelle: Kontext-Klassifikation des Artikeltextes
Initial Access
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — free The top security news daily · unsubscribe anytime
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
No reader ratings yet
Was this page helpful?
0
Powered by tsecurity.de
tsecurity.de Hub
Related story clusters & sources (vector AI)
21 sources
CVE-2026-111906 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha Elasticsearch/OpenSearch Administration API cross-site request forgery (EUVD-2026-103314)
20 more sources
VVulDB Updates4 hours agoCVE-2026-111905 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha {userId} userId resource injection (EUVD-2026-103315) VVulDB Updates4 hours agoCVE-2026-111904 | thorsten phpMyFAQ 4.2.0-alpha Open Question Controller /api/v4.0/open-questions OpenQuestionController information disclosure (EUVD-2026-103316) VVulDB Updates4 hours agoCVE-2026-111903 | thorsten phpMyFAQ 4.2.0-alpha SvgSanitizer cross site scripting (EUVD-2026-103317) VVulDB Updates4 hours agoCVE-2026-111894 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha cleanUpContent cross site scripting (EUVD-2026-103325) VVulDB Updates4 hours agoCVE-2026-111893 | Thorsten phpMyFAQ 4.2.0-alpha GroupController category-restrictions saveCategoryRestrictions categoryIds privileges management (EUVD-2026-103326) VVulDB Updates4 hours agoCVE-2026-111892 | thorsten phpMyFAQ up to 4.2.0-alpha.2 Rate Limiting allocation of resources (EUVD-2026-103327)
+14
8 sources
CVE-2026-98418 | Linux Kernel up to 7.2.7/7.3-rc3 sched/core kernel/sched/core.c set_task_cpu locking (Nessus ID 366864)
7 more sources
VVulDB Updates5 hours agoCVE-2026-98396 | Linux Kernel up to 7.2.6/7.3-rc2 powerpc kup.h arch_exit_to_user_mode_prepare race condition (Nessus ID 366869) VVulDB Updates11 hours agoCVE-2026-63902 | Linux Kernel up to 7.0.11 Cypress M8 cypress_m8.c cypress_read_int_callback out-of-bounds (Nessus ID 366749) VVulDB Updates11 hours agoCVE-2026-63903 | Linux Kernel up to 7.0.11 Belkin Sa Serial Driver belkin_sa.c belkin_sa_read_int_callback out-of-bounds (Nessus ID 366749) VVulDB Updates11 hours agoCVE-2026-63904 | Linux Kernel up to 7.0.11 Usbtmc actual_length out-of-bounds (Nessus ID 366749) VVulDB Updates11 hours agoCVE-2026-63942 | Linux Kernel up to 7.0.11 Parport parport_pc.c device_add race condition (Nessus ID 366749) VVulDB Updates11 hours agoCVE-2026-63957 | Linux Kernel up to 7.0.11 Safe Serial memory corruption (Nessus ID 366749)
+1
7 sources
CVE-2026-92883 | GitLab up to 19.2.7/19.3.4/19.4.1 HTML Attributes HTML injection (Nessus ID 366859)
6 more sources
VVulDB Updates1 hour agoCVE-2026-85529 | GitLab up to 19.2.7/19.3.4/19.4.1 GraphQL API improper authorization (Nessus ID 366858) VVulDB Updates1 hour agoCVE-2026-100755 | GitLab up to 19.2.7/19.3.4/19.4.1 Package Registry privileges management (Nessus ID 366855 / WID-SEC-2026-3858) VVulDB Updates1 hour agoCVE-2026-14210 | GitLab up to 19.2.7/19.3.4/19.4.1 Labels improper authorization (Nessus ID 366853) VVulDB Updates3 hours agoCVE-2026-92528 | GitLab up to 19.2.7/19.3.4/19.4.1 privileges management (Nessus ID 366866) VVulDB Updates3 hours agoCVE-2026-101168 | GitLab up to 19.2.7/19.3.4/19.4.1 Pages information disclosure (Nessus ID 366862 / WID-SEC-2026-3858) VVulDB Updates5 hours agoCVE-2026-96893 | GitLab up to 19.2.7/19.3.4/19.4.1 AI Conversation Context Construction neutralization (Nessus ID 366872)
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/en/4268248/vulnerabilities-cve/critical-google-devsite-flaw-let-attackers-execute-remote-code-using-forged-flask-sessions/