tsecurity.de - Reverse Engineering

AI Didn't Hack OpenAI. A Missed Debian Backport and an SSO Misconfiguration Did

Sun, 20 Sep 2026 05:28:08 +0200

The headline that circulated this week sounds like a movie trailer: hackers breached OpenAI's internal codebase in 72 hours, and an AI model wrote the exploit. Three researchers, a Claude model, a pull request inside OpenAI's private monorepo. The real story is more useful and more uncomfortable. No exotic AI vulnerability was involved. The breach... Weiterlesen

Your AI Agent Should Be a Guest, Not a Tenant

Sun, 20 Sep 2026 04:28:05 +0200

Why standing credentials are the quiet root cause behind this week's agent security headlines, and what zero standing privilege looks like in practice. On Thursday, researchers reported a zero-click remote code execution flaw in four major AI coding agents. The attack chain ran through the plugin supply chain, and reports put the number of... Weiterlesen

Critical 9.8 vulnerability in Unbound up to and including version 1.26.0

Sun, 20 Sep 2026 02:33:12 +0200

submitted by /u/anh0516 [link] [comments] Weiterlesen

xalgorix v4.6.78

Sun, 20 Sep 2026 00:28:08 +0200

Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript. Weiterlesen

StyleSmuggler: How a Payment Failure Email Became a Remote Code Execution Path in Magento

Sat, 19 Sep 2026 22:13:24 +0200

StyleSmuggler: How a Payment Failure Email Became a Remote Code Execution Path in Magento A storefront can pass every routine security check and still be running an exploitable template engine. That is the situation Adobe Commerce and Magento Open Source merchants faced in September 2026, when attackers turned an ordinary transactional email into... Weiterlesen

New weekly CTF challenge is now live. Ranking is based on solve order.

Sat, 19 Sep 2026 21:15:01 +0200

submitted by /u/Electronic-Part6194 [link] [comments] Weiterlesen

Poisoning the Context: Securing RAG Pipelines Against Knowledge Injection Attacks

Sat, 19 Sep 2026 20:29:19 +0200

Originally published on tamiz.pro. The Silent Vulnerability in Retrieval-Augmented Generation Retrieval-Augmented Generation (RAG) has become the de facto standard for grounding Large Language Models (LLMs) in proprietary data. By fetching relevant documents from a vector database and injecting them into the model's context window, RAG mitigates... Weiterlesen

vigolium v0.4.8

Sat, 19 Sep 2026 19:55:00 +0200

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Weiterlesen

Reversecore_MCP v3.0.4

Sat, 19 Sep 2026 19:55:00 +0200

A security-first MCP server that empowers AI agents to perform automated reverse engineering, malware analysis, forensics, vulnerability research, and SAST — powered by Radare2, YARA, LIEF, Capstone, and more. Weiterlesen

CVE-2026-90605 | Totolink A3002MU Hh-B20211125.1046 boa /boafrm/formFilter ip6addr buffer overflow

Sat, 19 Sep 2026 15:42:56 +0200

A vulnerability classified as very critical was found in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. This vulnerability is handled as CVE-2026-90605. The attack can be... Weiterlesen

CVE-2026-90600 | itsourcecode Sales and Inventory System 1.0 /pages/inv_edit1.php ID sql injection

Sat, 19 Sep 2026 15:42:56 +0200

A vulnerability identified as critical has been detected in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit1.php. The manipulation of the argument ID leads to sql injection. This vulnerability is documented as CVE-2026-90600. The attack can be initiated remotely. Additionally, an exploit... Weiterlesen

CVE-2026-90596 | embedded-graphics up to 0.8.2 on 32-bit src/image/image_raw.rs new/bytes_per_row integer overflow (Issue 820)

Sat, 19 Sep 2026 15:42:56 +0200

A vulnerability was found in embedded-graphics up to 0.8.2 on 32-bit. It has been classified as critical. Impacted is the function ImageRaw::new/bytes_per_row of the file src/image/image_raw.rs. This manipulation causes integer overflow. This vulnerability is tracked as CVE-2026-90596. The attack is possible to be carried out remotely. No exploit... Weiterlesen

CVE-2026-90595 | wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0 OnlineController.java OnlineController.getOnlineInfo authorization (Issue 65)

Sat, 19 Sep 2026 15:42:56 +0200

A vulnerability was found in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0 and classified as critical. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The manipulation results in missing authorization. This vulnerability is identified as CVE-2026-90595. The attack... Weiterlesen

CVE-2026-90582 | evanchiu serverless-todo 1.0.3/2.0.0 API Todo Endpoint src/index.js saveTodos event.body resource consumption (Issue 10)

Sat, 19 Sep 2026 15:42:56 +0200

A vulnerability categorized as problematic has been discovered in evanchiu serverless-todo 1.0.3/2.0.0. Impacted is the function saveTodos of the file src/index.js of the component API Todo Endpoint. Such manipulation of the argument event.body leads to resource consumption. This vulnerability is documented as CVE-2026-90582. The attack can be... Weiterlesen

CVE-2026-90583 | kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf Query String Rendering app/sw.py index qs cross site scripting (Issue 854)

Sat, 19 Sep 2026 15:42:56 +0200

A vulnerability identified as problematic has been detected in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. This vulnerability is reported as... Weiterlesen

CVE-2026-90577 | GPAC up to f1219cde MP4Box base_scenegraph.c gf_node_get_field heap-based overflow (Issue 3816)

Sat, 19 Sep 2026 15:42:56 +0200

A vulnerability has been found in GPAC up to f1219cde and classified as problematic. Affected by this vulnerability is the function gf_node_get_field of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. This vulnerability is identified as CVE-2026-90577. The attack is... Weiterlesen

CVE-2026-90601 | getzep graphiti up to 0.30.2 REST API main.py improper authentication (Issue 1716)

Sat, 19 Sep 2026 15:42:56 +0200

A vulnerability labeled as critical has been found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph_service/main.py of the component REST API. The manipulation results in improper authentication. This vulnerability is reported as CVE-2026-90601. The attack can be launched remotely. No exploit exists. The... Weiterlesen

CVE-2023-6710 | Apache HTTP Server mod_proxy_cluster alias cross site scripting (EUVD-2023-58930 / EDB-52010)

Sat, 19 Sep 2026 15:42:56 +0200

A vulnerability was found in Apache HTTP Server. It has been declared as problematic. Affected by this issue is some unknown functionality of the component mod_proxy_cluster. The manipulation of the argument alias results in cross site scripting. This vulnerability is reported as CVE-2023-6710. The attack can be launched remotely. Moreover, an... Weiterlesen

CVE-2026-63349: CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module

Sat, 19 Sep 2026 15:42:19 +0200

CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module Vulnerability ID: CVE-2026-63349 CVSS Score: 7.0 Published: 2026-09-18 CVE-2026-63349 is a critical privilege-dropping bypass vulnerability in the AnyIO asynchronous framework (versions 4.14.0 and 4.14.1) on POSIX platforms. Due to a variable assignment... Weiterlesen

CVE-2026-90716 | marcobambini Gravity up to 0.9.7 Number Parser gravity_parser.c parse_number_expression out-of-bounds (Issue 446)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability classified as problematic has been found in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. This vulnerability is cataloged as CVE-2026-90716. It is possible to... Weiterlesen

CVE-2026-78299 | Eclipse Embedded CDT up to 5.x/6.7 path traversal

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability has been found in Eclipse Embedded CDT up to 5.x/6.7 and classified as critical. This issue affects some unknown processing. Performing a manipulation results in path traversal. This vulnerability is cataloged as CVE-2026-78299. It is possible to initiate the attack remotely. There is no exploit available. The affected component... Weiterlesen

CVE-2026-9812 | Mattermost up to 10.11.22/11.7.7/11.8.4/11.9.0 Playbooks authorization

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability has been found in Mattermost up to 10.11.22/11.7.7/11.8.4/11.9.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Playbooks. This manipulation causes authorization bypass. This vulnerability is registered as CVE-2026-9812. Remote exploitation of the attack is possible. No exploit... Weiterlesen

CVE-2026-13417 | Mattermost up to 10.11.22/11.7.7/11.8.4/11.9.0 Boards fields.properties unusual condition

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability identified as problematic has been detected in Mattermost up to 10.11.22/11.7.7/11.8.4/11.9.0. This issue affects some unknown processing of the component Boards. The manipulation of the argument fields.properties leads to improper check for unusual conditions. This vulnerability is uniquely identified as CVE-2026-13417. The attack... Weiterlesen

CVE-2026-10556 | Mattermost up to 10.11.22/11.7.7/11.8.4/11.9.0 Calendar Plugin unusual condition

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability, which was classified as problematic, has been found in Mattermost up to 10.11.22/11.7.7/11.8.4/11.9.0. The impacted element is an unknown function of the component Calendar Plugin. Performing a manipulation results in improper check for unusual conditions. This vulnerability is cataloged as CVE-2026-10556. It is possible to... Weiterlesen

CVE-2026-90705 | D-Link DWR-M921 1.1.52 Boa Dispatch Table /boafrm/formsysCmd os command injection

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability was found in D-Link DWR-M921 1.1.52 and classified as critical. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. This vulnerability is handled as CVE-2026-90705. The attack can be executed... Weiterlesen

CVE-2026-90710 | taisan tarzan-cms 1.0.0 Theme Download Function ThemeService.java openConnection httpUrl server-side request forgery (IK768M)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability categorized as critical has been discovered in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file com/tarzan/cms/modules/admin/service/biz/ThemeService.java of the component Theme Download Function. Executing a manipulation of the argument httpUrl can lead to server-side request forgery. The... Weiterlesen

CVE-2026-90695 | SourceCodester Inventory Management System 1.0 Vendor Management /api/vendors_handler.php cross site scripting

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability classified as problematic has been found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /api/vendors_handler.php of the component Vendor Management. Performing a manipulation results in cross site scripting. This vulnerability is reported as CVE-2026-90695.... Weiterlesen

CVE-2026-90700 | itsourcecode Sales and Inventory System 1.0 /pages/pro_edit1.php prodcode sql injection

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability was found in itsourcecode Sales and Inventory System 1.0 and classified as critical. Impacted is an unknown function of the file /pages/pro_edit1.php. Such manipulation of the argument prodcode leads to sql injection. This vulnerability is uniquely identified as CVE-2026-90700. The attack can be launched remotely. Moreover, an... Weiterlesen

CVE-2026-90690 | 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04 API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection (Issue 224)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability categorized as critical has been discovered in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrike_server.py of the component API Tools Endpoint. Executing a manipulation of the argument... Weiterlesen

CVE-2026-78030 | DBI up to 1.652 require dbm_type/dbm_mldbm code injection (EUVD-2026-83584)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability was found in DBI up to 1.652. It has been rated as critical. This issue affects the function require. The manipulation of the argument dbm_type/dbm_mldbm leads to code injection. This vulnerability is traded as CVE-2026-78030. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected... Weiterlesen

CVE-2026-9858 | wpexpertshub Partial Shipment for WooCommerce Plugin up to 3.4 on WordPress AJAX handlers woocommerce-partial-shipment.php order_id improper authorization (EUVD-2026-83570)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability described as critical has been identified in wpexpertshub Partial Shipment for WooCommerce Plugin up to 3.4 on WordPress. Affected by this vulnerability is an unknown functionality of the file woocommerce-partial-shipment.php of the component AJAX handlers. Executing a manipulation of the argument order_id can lead to improper... Weiterlesen

CVE-2026-93742 | Totolink A3002MU Hh-B20211125.1046 /boafrm/formWsc localPin command injection (EUVD-2026-83583)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability marked as very critical has been reported in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. This vulnerability is handled as CVE-2026-93742. The attack can be initiated remotely. Additionally, an... Weiterlesen

CVE-2026-9613 | Datalogics Ecommerce Delivery Plugin up to 2.6.65 on WordPress authorization (EUVD-2026-83569)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability, which was classified as critical, was found in Datalogics Ecommerce Delivery Plugin up to 2.6.65 on WordPress. This issue affects some unknown processing. Such manipulation leads to authorization bypass. This vulnerability is documented as CVE-2026-9613. The attack can be executed remotely. There is not any exploit available. Weiterlesen

CVE-2026-1256 | ysinnovations YS LeadGen Plugin up to 2.1.4 on WordPress cross site scripting (EUVD-2026-83567)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability was found in ysinnovations YS LeadGen Plugin up to 2.1.4 on WordPress. It has been rated as problematic. This impacts an unknown function. This manipulation causes cross site scripting. This vulnerability is handled as CVE-2026-1256. The attack can be initiated remotely. There is not any exploit available. Weiterlesen

CVE-2026-76579 | LiteSpeed Technologies LiteSpeed Cache Plugin up to 7.9 on WordPress ESI esi cross site scripting (EUVD-2026-83568)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability classified as problematic has been found in LiteSpeed Technologies LiteSpeed Cache Plugin up to 7.9 on WordPress. Affected by this issue is some unknown functionality of the component ESI. The manipulation of the argument esi leads to cross site scripting. This vulnerability is listed as CVE-2026-76579. The attack may be initiated... Weiterlesen

CVE-2026-9289 | WordLift Plugin up to 3.54.10 on WordPress JSON-LD REST API /wordlift/v1/jsonld get_post access control (EUVD-2026-83565)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability was found in WordLift Plugin up to 3.54.10 on WordPress. It has been classified as problematic. The impacted element is the function get_post of the file /wordlift/v1/jsonld of the component JSON-LD REST API. The manipulation leads to improper access controls. This vulnerability is traded as CVE-2026-9289. It is possible to... Weiterlesen

CVE-2026-9766 | Empik for Woocommerce Plugin up to 1.5.1 on WordPress authorization (EUVD-2026-83566)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability has been found in Empik for Woocommerce Plugin up to 1.5.1 on WordPress and classified as problematic. Impacted is an unknown function. Performing a manipulation of the argument _empik_logistic_klass/_empik_product_state/_empik_product_state_all_variants results in authorization bypass. This vulnerability is reported as... Weiterlesen

CVE-2026-1255 | YS Innovations YS LeadGen Plugin up to 2.1.4 on WordPress ysleadgen_get_captured_data information disclosure (EUVD-2026-83564)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability, which was classified as problematic, has been found in YS Innovations YS LeadGen Plugin up to 2.1.4 on WordPress. This vulnerability affects the function ysleadgen_get_captured_data. This manipulation causes information disclosure. This vulnerability is registered as CVE-2026-1255. Remote exploitation of the attack is possible. No... Weiterlesen

CVE-2026-8354 | celomitan Gum Addon for Elementor Plugin up to 1.3.15 on WordPress pop_tag cross site scripting (EUVD-2026-83562)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability was found in celomitan Gum Addon for Elementor Plugin up to 1.3.15 on WordPress. It has been declared as problematic. This affects an unknown function. The manipulation of the argument pop_tag results in cross site scripting. This vulnerability is known as CVE-2026-8354. It is possible to launch the attack remotely. No exploit is... Weiterlesen

CVE-2026-18346 | TikTok Plugin up to 1.4.1 on WordPress authorization (EUVD-2026-83563)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability was found in TikTok Plugin up to 1.4.1 on WordPress and classified as critical. The affected element is an unknown function. Executing a manipulation can lead to authorization bypass. This vulnerability appears as CVE-2026-18346. The attack may be performed from remote. There is no available exploit. Weiterlesen

CVE-2026-5410 | davidanderson Redux Framework Plugin up to 4.5.13 on WordPress Spinner class-redux-spinner.php user_meta_save spinner cross site scripting (EUVD-2026-83561)

Sat, 19 Sep 2026 14:16:04 +0200

A vulnerability classified as problematic was found in davidanderson Redux Framework Plugin up to 4.5.13 on WordPress. This affects the function user_meta_save of the file class-redux-spinner.php of the component Spinner. The manipulation of the argument spinner results in cross site scripting. This vulnerability is cataloged as CVE-2026-5410. The... Weiterlesen

IT Security News Hourly Summary 2026-09-19 14h : 3 posts

Sat, 19 Sep 2026 14:08:51 +0200

3 posts published in the last hour 11:31SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE 11:31Forget the AI Slowdown—the Vulnerability Explosion Is Already Happening 11:31Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws The post IT Security News Hourly Summary 2026-09-19 14h : 3 posts... Weiterlesen

SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE

Sat, 19 Sep 2026 14:04:55 +0200

SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an unauthenticated remote code execution vulnerability. The vulnerability, tracked as CVE-2026-28326, is rated 8.8 out of 10.0 on the CVSS scoring system. The issue affects all versions of Access... Weiterlesen

CVE-2026-91147 | Red Hat Enterprise Linux/OpenShift Dev Spaces cockpit-ws denial of service (Nessus ID 348262)

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability, which was classified as critical, was found in Red Hat Enterprise Linux and OpenShift Dev Spaces. This affects an unknown part of the component cockpit-ws. The manipulation results in denial of service. This vulnerability is known as CVE-2026-91147. It is possible to launch the attack remotely. No exploit is available. Weiterlesen

CVE-2026-81000 | Linux Kernel up to 6.12.108/6.18.49/7.2.3 Tun tun_get_user align allocation of resources (Nessus ID 348261)

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability was found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. It has been rated as very critical. This affects the function tun_get_user of the component Tun. The manipulation of the argument align leads to allocation of resources. This vulnerability is listed as CVE-2026-81000. The attack may be initiated remotely. There is no available... Weiterlesen

CVE-2026-88859 | Red Hat Enterprise Linux Trusted JavaScript cross site scripting (Nessus ID 348257)

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability identified as problematic has been detected in Red Hat Enterprise Linux. This affects an unknown part of the component Trusted JavaScript Handler. This manipulation causes cross site scripting. The identification of this vulnerability is CVE-2026-88859. It is possible to initiate the attack remotely. There is no exploit available. Weiterlesen

CVE-2026-80844 | Linux Kernel up to 7.2.2 xfrm ipv6_rearrange_rthdr out-of-bounds (Nessus ID 348261)

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 7.2.2. Affected is the function ipv6_rearrange_rthdr of the component xfrm. Executing a manipulation can lead to out-of-bounds read. This vulnerability is registered as CVE-2026-80844. It is possible to launch the attack remotely. No exploit is available. It is... Weiterlesen

CVE-2021-43818 | lxml up to 4.6.4 lxml.html cross site scripting (GHSA-55x5-fj6c-h6m8 / Nessus ID 348247)

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability was found in lxml up to 4.6.4. It has been rated as problematic. This affects an unknown part of the file lxml.html. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2021-43818. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is... Weiterlesen

CVE-2026-90496 | Fengoffice Feng Office up to 3.11.13.11 Reorder Handlers MoreController.class.php update_system_module_order/update_dimension_order modules/dims sql injection

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability identified as problematic has been detected in Fengoffice Feng Office up to 3.11.13.11. Affected is the function update_system_module_order/update_dimension_order of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims results in sql... Weiterlesen

CVE-2026-90506 | vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46 Save Account Job race condition

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. It has been classified as problematic. This impacts an unknown function of the component Save Account Job. This manipulation causes race condition. This vulnerability only affects products that are no longer supported by the maintainer. This... Weiterlesen

CVE-2026-90511 | GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea listSplit Interface BooksServlet.java column sql injection

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability labeled as critical has been found in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea. This vulnerability affects unknown code of the file src/cn/ylcto/book/servlet/BooksServlet.java of the component listSplit Interface. The manipulation of the argument column results in sql injection. This vulnerability was... Weiterlesen

CVE-2026-90501 | lenve vhr 1.0-SNAPSHOT HrMapper.xml HrInfoController.updateHr Password privileges management

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability classified as critical was found in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. This vulnerability is listed as CVE-2026-90501. The attack may be performed from remote. In addition, an... Weiterlesen

CVE-2026-90508 | Chengdu Qilu Technology Ludashi 6.1026.4715.714 Message Dispatch ProtectFilter64.sys MessageNotifyCallback authorization

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability was found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. It has been rated as problematic. Affected by this vulnerability is the function MessageNotifyCallback in the library ProtectFilter64.sys of the component Message Dispatch Handler. Performing a manipulation results in missing authorization. This vulnerability is known as... Weiterlesen

CVE-2026-90514 | SourceCodester School Registration and Fee System 1.0 save_stud.php Status sql injection

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability described as critical has been identified in SourceCodester School Registration and Fee System 1.0. Impacted is an unknown function of the file /bilal/normal/save_stud.php. Such manipulation of the argument Status leads to sql injection. This vulnerability is referenced as CVE-2026-90514. It is possible to launch the attack... Weiterlesen

CVE-2026-90503 | Chengdu Qilu Technology Ludashi 6.1026.4715.714 ComputerZ_x64.sys sub_11008 PhysicalAddress information disclosure

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability, which was classified as problematic, was found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. This vulnerability is registered as CVE-2026-90503. The... Weiterlesen

CVE-2026-90498 | lenve vhr 1.0-SNAPSHOT vhr.sql default credentials

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability marked as critical has been reported in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. This vulnerability is referenced as CVE-2026-90498. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The... Weiterlesen

CVE-2026-29811 | CyberPanel up to 2.4.3 comparison using wrong factors

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability labeled as problematic has been found in CyberPanel up to 2.4.3. Affected is an unknown function. Executing a manipulation can lead to comparison using wrong factors. This vulnerability is handled as CVE-2026-29811. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded. Weiterlesen

CVE-2026-90573 | GPAC up to f1219cde MP4Box scenegraph/vrml_tools.c gf_sg_mfurl_del null pointer dereference (Issue 3814)

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability classified as problematic has been found in GPAC up to f1219cde. The impacted element is the function gf_sg_mfurl_del of the file scenegraph/vrml_tools.c of the component MP4Box. The manipulation leads to null pointer dereference. This vulnerability is uniquely identified as CVE-2026-90573. Local access is required to approach this... Weiterlesen

CVE-2026-90575 | PHPGurukul Small CRM 4.0 Login Success /crm/login.php unserialize geopluginURL deserialization

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability, which was classified as problematic, has been found in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. The identification of this vulnerability is CVE-2026-90575. It is possible... Weiterlesen

CVE-2026-90619 | 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04 Execute Endpoint hexstrike_server.py code/script os command injection (Issue 222)

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability classified as critical has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrike_server.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. This vulnerability is traded as CVE-2026-90619. It... Weiterlesen

CVE-2026-90613 | GPAC up to f1219cde MP4Box isomedia/stbl_read.c stbl_GetSampleInfos assertion (Issue 3822)

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability categorized as problematic has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stbl_GetSampleInfos of the file isomedia/stbl_read.c of the component MP4Box. The manipulation results in reachable assertion. This vulnerability is cataloged as CVE-2026-90613. The attack must be initiated from a... Weiterlesen

CVE-2026-90608 | Totolink A3002MU Hh-B20211125.1046 boa /boafrm/formPortFw service_type buffer overflow

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability has been found in Totolink A3002MU Hh-B20211125.1046 and classified as very critical. The affected element is the function formPortFw of the file /boafrm/formPortFw of the component boa. This manipulation of the argument service_type causes buffer overflow. The identification of this vulnerability is CVE-2026-90608. It is possible... Weiterlesen

CVE-2026-90598 | jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2 UserController.java UserController.updateUser userid authorization (Issue 172)

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability was found in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. It has been rated as critical. The impacted element is the function UserController.updateUser of the file UserController.java. Performing a manipulation of the argument userid results in authorization bypass. This vulnerability is... Weiterlesen

CVE-2026-90603 | Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0 S3 Upload /api/upload-binary x-proxy-target-url unrestricted upload (Issue 310)

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability described as critical has been identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. This vulnerability is traded as... Weiterlesen

CVE-2026-90580 | FlowiseAI Flowise up to 3.0.2 Evaluations Endpoint index.ts axios.post Host/X-Forwarded-Proto server-side request forgery (Issue 6687)

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. It has been declared as critical. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side request forgery. This... Weiterlesen

CVE-2026-90593 | embedded-graphics up to 0.8.2 src/image/image_raw.rs ImageRaw::draw_sub_image width integer overflow (Issue 821)

Sat, 19 Sep 2026 13:30:36 +0200

A vulnerability, which was classified as critical, was found in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of the file src/image/image_raw.rs. Executing a manipulation of the argument width can lead to integer overflow. The identification of this vulnerability is CVE-2026-90593. The attack may be launched... Weiterlesen

Rotating Secrets After an AI-Tooling Compromise: A Checklist for the September 2026 KEV Wave

Sat, 19 Sep 2026 13:29:58 +0200

Rotating Secrets After an AI-Tooling Compromise: A Checklist for the September 2026 KEV Wave Three of the seven vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog on September 2, 2026 targeted AI and workflow tooling: BerriAI LiteLLM's authentication flaw CVE-2026-59822, the Kestra orchestrator's unauthenticated... Weiterlesen

SolarWinds fixt ARM-Fall mit Hard-Coded-Key: Patch für CVE-2026-28326

Sat, 19 Sep 2026 13:23:13 +0200

LONDON (IT BOLTWISE) – SolarWinds hat Sicherheitsupdates für den Access Rights Manager (ARM) veröffentlicht, um eine kritische Schwachstelle zu schließen. Die Lücke mit der Kennung CVE-2026-28326 beruht auf einem hard-codierten statischen Schlüssel und könnte bei erfolgreicher Ausnutzung zu einer Remote-Code-Execution ohne Authentifizierung... Weiterlesen

IT Security News Hourly Summary 2026-09-19 12h : 5 posts

Sat, 19 Sep 2026 13:23:06 +0200

5 posts published in the last hour 09:316 Best VPN Services (2026), Tested and Reviewed 09:31Drug trafficking investigation leads to some of the world’s biggest underground bankers 09:31North Korean WaterPlum Hackers Target IT Professionals With Fake Job Interviews to Steal Crypto 09:02Critical Pre-Auth RCE in Orkes Conductor Workflow Platform... Weiterlesen

Forget the AI Slowdown—the Vulnerability Explosion Is Already Happening

Sat, 19 Sep 2026 13:15:32 +0200

AI labs are toying with an industry-wide pact to slow development. Meanwhile, widely available AI chatbots are already helping uncover a tidal wave of security flaws. Weiterlesen

CVE-2026-72708 | SPIP up to 4.4.17 Sitemap Endpoint ecrire/req/mysql.php spip_mysql_cite annee sql injection

Sat, 19 Sep 2026 11:59:52 +0200

A vulnerability, which was classified as critical, was found in SPIP up to 4.4.17. The affected element is the function spip_mysql_cite of the file ecrire/req/mysql.php of the component Sitemap Endpoint. The manipulation of the argument annee results in sql injection. This vulnerability is cataloged as CVE-2026-72708. The attack may be launched... Weiterlesen

CVE-2026-90533 | FlowiseAI Flowise up to 3.1.3 /api/v1/organizationuser access control

Sat, 19 Sep 2026 11:59:52 +0200

A vulnerability marked as problematic has been reported in FlowiseAI Flowise up to 3.1.3. This affects an unknown part of the file /api/v1/organizationuser. This manipulation causes improper access controls. This vulnerability is handled as CVE-2026-90533. The attack can be initiated remotely. There is not any exploit available. It is suggested to... Weiterlesen

CVE-2026-90535 | FlowiseAI Flowise up to 3.1.3 Text To Speech Abort abort chatflowId/chatId denial of service

Sat, 19 Sep 2026 11:59:52 +0200

A vulnerability categorized as problematic has been discovered in FlowiseAI Flowise up to 3.1.3. Affected is an unknown function of the file /api/v1/text-to-speech/abort of the component Text To Speech Abort. Executing a manipulation of the argument chatflowId/chatId can lead to denial of service. This vulnerability appears as CVE-2026-90535. The... Weiterlesen

CVE-2026-67211 | Apache OpenNLP up to 3.0.0-M5 opennlp-spellcheck extension SymSpellModelSerializer.create unigramCount/bigramCount allocation of resources

Sat, 19 Sep 2026 11:59:52 +0200

A vulnerability, which was classified as problematic, has been found in Apache OpenNLP up to 3.0.0-M5. This affects the function SymSpellModelSerializer.create of the component opennlp-spellcheck extension. This manipulation of the argument unigramCount/bigramCount causes allocation of resources. This vulnerability is tracked as CVE-2026-67211.... Weiterlesen

CVE-2026-82617 | Apache OpenNLP up to 2.5.11/3.0.0-M5 RegexNameFinder RegexNameFinderFactory.java RegexNameFinder.find String[] resource consumption

Sat, 19 Sep 2026 11:59:52 +0200

A vulnerability, which was classified as problematic, was found in Apache OpenNLP up to 2.5.11/3.0.0-M5. This impacts the function RegexNameFinder.find of the file RegexNameFinderFactory.java of the component RegexNameFinder. Such manipulation of the argument String[] leads to resource consumption. This vulnerability is listed as CVE-2026-82617.... Weiterlesen

CVE-2026-90534 | FlowiseAI Flowise up to 3.1.3 Credential Resolution /api/v1/node-load-method getCredentialData nodeName permission

Sat, 19 Sep 2026 11:59:52 +0200

A vulnerability was found in FlowiseAI Flowise up to 3.1.3. It has been rated as critical. This impacts the function getCredentialData of the file /api/v1/node-load-method of the component Credential Resolution. Performing a manipulation of the argument nodeName results in permission issues. This vulnerability is reported as CVE-2026-90534. The... Weiterlesen

CVE-2026-79035 | Zeta Marketing Platform 1.0 p.rfihub.com ca cross site scripting

Sat, 19 Sep 2026 11:59:52 +0200

A vulnerability has been found in Zeta Marketing Platform 1.0 and classified as problematic. The affected element is an unknown function of the component p.rfihub.com. Performing a manipulation of the argument ca results in cross site scripting. This vulnerability was named CVE-2026-79035. The attack may be initiated remotely. There is no... Weiterlesen

CVE-2026-89332 | AWS Kiro IDE up to 0.8.134 Kiro Powers redirect

Sat, 19 Sep 2026 11:59:52 +0200

A vulnerability identified as problematic has been detected in AWS Kiro IDE up to 0.8.134. Affected by this vulnerability is an unknown functionality of the component Kiro Powers. This manipulation causes open redirect. This vulnerability appears as CVE-2026-89332. The attack may be initiated remotely. There is no available exploit. You should... Weiterlesen

CVE-2026-81910 | Concrete CMS up to 9.5.2 Theme Customizer special elements in template engine

Sat, 19 Sep 2026 11:59:52 +0200

A vulnerability labeled as problematic has been found in Concrete CMS up to 9.5.2. This impacts an unknown function of the component Theme Customizer. The manipulation results in improper neutralization of special elements used in a template engine. This vulnerability is known as CVE-2026-81910. It is possible to launch the attack remotely. No... Weiterlesen

CVE-2026-79394 | XiongMai Sofia IPC daemon up to 0608.1837 RTSP Server access control

Sat, 19 Sep 2026 11:59:52 +0200

A vulnerability described as problematic has been identified in XiongMai Sofia IPC daemon up to 0608.1837. Affected by this vulnerability is an unknown functionality of the component RTSP Server. Such manipulation leads to improper access controls. This vulnerability is uniquely identified as CVE-2026-79394. The attack can be launched remotely. No... Weiterlesen

Orkes Conductor: kritische RCE-Lücke wird aktiv ausgenutzt – Update dringend

Sat, 19 Sep 2026 11:53:09 +0200

LONDON (IT BOLTWISE) – Eine kritische Sicherheitslücke in Orkes Conductor wird laut Fortinet aktiv ausgenutzt. Betroffen ist CVE-2026-58138 mit 9,8 (CVSS v3.1) bzw. 9,3 (CVSS v4) und einer unauthentifizierten Remote-Code-Execution vor der Anmeldung. Angreifer senden speziell präparierte Workflow-Definitionen an die Conductor-Workflow-API, um über... Weiterlesen

Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

Sat, 19 Sep 2026 11:49:14 +0200

A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138 (CVSS v3.1 score: 9.8/CVSS v4 score: 9.3), which relates to a case of unauthenticated remote code execution. "Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote... Weiterlesen

CVE-2026-93741 | Totolink A3002MU Hh-B20211125.1046 /boafrm/formWlWds submit-url buffer overflow (EUVD-2026-83497)

Sat, 19 Sep 2026 10:43:25 +0200

A vulnerability labeled as very critical has been found in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. This vulnerability is known as CVE-2026-93741. It is possible to launch the attack remotely.... Weiterlesen

CVE-2026-92435 | WooCommerce Mailchimp for WooCommerce Plugin up to 6.1.0 on WordPress Permission Callback authorization (EUVD-2026-83517)

Sat, 19 Sep 2026 10:43:25 +0200

A vulnerability marked as critical has been reported in WooCommerce Mailchimp for WooCommerce Plugin up to 6.1.0 on WordPress. This issue affects some unknown processing of the component Permission Callback. The manipulation leads to missing authorization. This vulnerability is listed as CVE-2026-92435. The attack may be initiated remotely. There... Weiterlesen

CVE-2026-92430 | Rede Itaú for WooCommerce Plugin up to 5.4.6 on WordPress authorization (EUVD-2026-83516)

Sat, 19 Sep 2026 10:43:25 +0200

A vulnerability described as problematic has been identified in Rede Itaú for WooCommerce Plugin up to 5.4.6 on WordPress. This affects an unknown part. Executing a manipulation can lead to missing authorization. This vulnerability is registered as CVE-2026-92430. It is possible to launch the attack remotely. No exploit is available. Upgrading the... Weiterlesen

CVE-2026-92425 | Hydra Booking Plugin up to 1.2.3 on WordPress authorization (EUVD-2026-83515)

Sat, 19 Sep 2026 10:43:25 +0200

A vulnerability marked as problematic has been reported in Hydra Booking Plugin up to 1.2.3 on WordPress. Affected by this issue is some unknown functionality. Performing a manipulation results in authorization bypass. This vulnerability is cataloged as CVE-2026-92425. It is possible to initiate the attack remotely. There is no exploit available.... Weiterlesen

CVE-2026-92421 | Hydra Booking Plugin up to 1.2.2 on WordPress authorization (EUVD-2026-83514)

Sat, 19 Sep 2026 10:43:25 +0200

A vulnerability was found in Hydra Booking Plugin up to 1.2.2 on WordPress. It has been rated as critical. Affected by this vulnerability is an unknown functionality. This manipulation causes authorization bypass. The identification of this vulnerability is CVE-2026-92421. It is possible to initiate the attack remotely. There is no exploit... Weiterlesen

CVE-2026-92420 | Hydra Booking Plugin up to 1.2.1 on WordPress authorization (EUVD-2026-83513)

Sat, 19 Sep 2026 10:43:25 +0200

A vulnerability was found in Hydra Booking Plugin up to 1.2.1 on WordPress. It has been declared as problematic. Affected is an unknown function. The manipulation results in authorization bypass. This vulnerability was named CVE-2026-92420. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the... Weiterlesen

CVE-2026-92404 | MgoSync Plugin up to 2.1.6 on WordPress REST API Endpoint information disclosure (EUVD-2026-83512)

Sat, 19 Sep 2026 10:43:25 +0200

A vulnerability labeled as problematic has been found in MgoSync Plugin up to 2.1.6 on WordPress. Affected by this vulnerability is an unknown functionality of the component REST API Endpoint. Such manipulation leads to information disclosure. This vulnerability is listed as CVE-2026-92404. The attack may be performed from remote. There is no... Weiterlesen

CVE-2026-92403 | Secure Custom Fields Plugin up to 6.9.3 on WordPress authorization (EUVD-2026-83511)

Sat, 19 Sep 2026 10:43:24 +0200

A vulnerability identified as problematic has been detected in Secure Custom Fields Plugin up to 6.9.3 on WordPress. Affected is an unknown function. This manipulation causes incorrect authorization. This vulnerability is tracked as CVE-2026-92403. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the... Weiterlesen

CVE-2026-92099 | WPGraphQL Smart Cache Plugin up to 2.3.1 on WordPress access control (EUVD-2026-83510)

Sat, 19 Sep 2026 10:43:24 +0200

A vulnerability was found in WPGraphQL Smart Cache Plugin up to 2.3.1 on WordPress. It has been classified as problematic. This impacts an unknown function. The manipulation leads to improper access controls. This vulnerability is uniquely identified as CVE-2026-92099. The attack is possible to be carried out remotely. No exploit exists. Upgrading... Weiterlesen

CVE-2026-91847 | Online Scheduling and Appointment Booking System Plugin authorization (EUVD-2026-83509)

Sat, 19 Sep 2026 10:43:17 +0200

A vulnerability was found in Online Scheduling and Appointment Booking System Plugin up to 28.1 on WordPress and classified as critical. This affects an unknown function. Executing a manipulation can lead to authorization bypass. This vulnerability is handled as CVE-2026-91847. The attack can be executed remotely. There is not any exploit... Weiterlesen

CVE-2026-88926 | VikRentItems Flexible Rental Management System Plugin sql injection (EUVD-2026-83508)

Sat, 19 Sep 2026 10:43:15 +0200

A vulnerability has been found in VikRentItems Flexible Rental Management System Plugin up to 1.2.3 on WordPress and classified as critical. The impacted element is an unknown function. Performing a manipulation results in sql injection. This vulnerability is known as CVE-2026-88926. Remote exploitation of the attack is possible. No exploit is... Weiterlesen

Never installable

Sat, 19 Sep 2026 10:41:53 +0200

For three days of real-device testing, the app worked, or seemed to. Every test passed. Every review came back clean. On a real phone, it had never once been installable, and nothing had ever said so. This is a proof-of-concept, not an NHS product. It was built by one technical person working alongside an NHS dietetic team. No patient data exists... Weiterlesen

CVE-2026-77179: Docker's hypervisor for Mac compromised (Docker Desktop, Docker Sandboxes)

Sat, 19 Sep 2026 10:41:01 +0200

submitted by /u/natcoba [link] [comments] Weiterlesen

CVE-2022-44427 | Unisoc S8000 WLAN Driver denial of service (EUVD-2022-47370)

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability marked as problematic has been reported in Unisoc SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T610, T618, T606, T612, T616, T760, T770, T820 and S8000. This issue affects some unknown processing of the component WLAN Driver. This manipulation causes denial of service. This vulnerability is registered as CVE-2022-44427. The... Weiterlesen

CVE-2022-44429 | Unisoc S8000 WLAN Driver denial of service (EUVD-2022-47372)

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability classified as problematic has been found in Unisoc SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T610, T618, T606, T612, T616, T760, T770, T820 and S8000. The affected element is an unknown function of the component WLAN Driver. Performing a manipulation results in denial of service. This vulnerability is reported as... Weiterlesen

CVE-2022-44428 | Unisoc S8000 WLAN Driver denial of service (EUVD-2022-47371)

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability described as problematic has been identified in Unisoc SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T610, T618, T606, T612, T616, T760, T770, T820 and S8000. Impacted is an unknown function of the component WLAN Driver. Such manipulation leads to denial of service. This vulnerability is documented as CVE-2022-44428. The... Weiterlesen

CVE-2022-44430 | Unisoc S8000 WLAN Driver denial of service (EUVD-2022-47373)

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability classified as problematic was found in Unisoc SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T610, T618, T606, T612, T616, T760, T770, T820 and S8000. The impacted element is an unknown function of the component WLAN Driver. Executing a manipulation can lead to denial of service. This vulnerability appears as CVE-2022-44430.... Weiterlesen

CVE-2022-44431 | Unisoc S8000 WLAN Driver denial of service (EUVD-2022-47374)

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability, which was classified as problematic, has been found in Unisoc SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T610, T618, T606, T612, T616, T760, T770, T820 and S8000. This affects an unknown function of the component WLAN Driver. The manipulation leads to denial of service. This vulnerability is traded as CVE-2022-44431. An... Weiterlesen

CVE-2026-65381 | Apple macOS up to 15.7/26/26.6 Entitlement Verification sandbox

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability was found in Apple macOS up to 15.7/26/26.6 and classified as critical. This affects an unknown function of the component Entitlement Verification. Such manipulation leads to sandbox issue. This vulnerability is uniquely identified as CVE-2026-65381. Local access is required to approach this attack. No exploit exists. It is... Weiterlesen

CVE-2026-65377 | Apple iOS/iPadOS/macOS/tvOS/visionOS/watchOS prior 26.7/27/15.8 memory corruption

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability, which was classified as very critical, has been found in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Impacted is an unknown function. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2026-65377. It is possible to initiate the attack remotely. There is no exploit available. It is advisable... Weiterlesen

CVE-2026-65376 | Apple macOS up to 15.7/26/26.6 out-of-bounds

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability classified as problematic was found in Apple macOS up to 15.7/26/26.6. This issue affects some unknown processing. Executing a manipulation can lead to out-of-bounds read. This vulnerability appears as CVE-2026-65376. The attack requires local access. There is no available exploit. Upgrading the affected component is advised. Weiterlesen

CVE-2026-65375 | Apple macOS up to 15.7/26/26.5 improper authentication

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability classified as problematic has been found in Apple macOS up to 15.7/26/26.5. This vulnerability affects unknown code. Performing a manipulation results in improper authentication. This vulnerability is reported as CVE-2026-65375. The attack requires a local approach. No exploit exists. It is recommended to upgrade the affected... Weiterlesen

CVE-2026-65369 | Apple macOS up to 15.7/26/26.6 Gatekeeper state issue

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability was found in Apple macOS up to 15.7/26/26.6. It has been declared as very critical. The impacted element is an unknown function of the component Gatekeeper. Such manipulation leads to state issue. This vulnerability is referenced as CVE-2026-65369. It is possible to launch the attack remotely. No exploit is available. It is... Weiterlesen

CVE-2026-65371 | Apple iPadOS/iOS/macOS/tvOS/visionOS/watchOS Kernel information disclosure

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability labeled as problematic has been found in Apple iPadOS, iOS, macOS, tvOS, visionOS and watchOS. Affected by this vulnerability is an unknown functionality of the component Kernel. The manipulation results in information disclosure. This vulnerability is cataloged as CVE-2026-65371. The attack may be launched remotely. There is no... Weiterlesen

CVE-2026-65360 | Apple iPadOS/iOS/macOS/tvOS/visionOS/watchOS prior 26.7/15.8/27 race condition

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability classified as problematic was found in Apple iPadOS, iOS, macOS, tvOS, visionOS and watchOS. Affected by this issue is some unknown functionality. Such manipulation leads to race condition. This vulnerability is traded as CVE-2026-65360. An attack has to be approached locally. There is no exploit available. Upgrading the affected... Weiterlesen

CVE-2026-65361 | Apple macOS up to 15.7/26/26.6 information disclosure

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability, which was classified as problematic, was found in Apple macOS up to 15.7/26/26.6. This vulnerability affects unknown code. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE-2026-65361. It is possible to launch the attack on the local host. There is not any exploit available. You... Weiterlesen

CVE-2026-65359 | Apple iOS/iPadOS/macOS/tvOS/visionOS/watchOS prior 26.7/27/15.8/Golden Gate 27/Tahoe 26.7 out-of-bounds

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability was found in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS. It has been classified as problematic. This vulnerability affects unknown code. The manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-65359. The attack can only be performed from a local environment. No exploit is available.... Weiterlesen

CVE-2026-65358 | Apple iPadOS/iOS/macOS/tvOS/visionOS/watchOS prior 27 race condition

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability classified as problematic has been found in Apple iPadOS, iOS, macOS, tvOS, visionOS and watchOS. Affected by this vulnerability is an unknown functionality. This manipulation causes race condition. This vulnerability appears as CVE-2026-65358. The attack requires local access. There is no available exploit. It is recommended to... Weiterlesen

CVE-2026-65378 | Apple macOS up to 15.7/26/26.6 privileges management

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability, which was classified as problematic, was found in Apple macOS up to 15.7/26/26.6. The affected element is an unknown function. The manipulation results in improper privilege management. This vulnerability is known as CVE-2026-65378. It is possible to launch the attack remotely. No exploit is available. You should upgrade the... Weiterlesen

CVE-2026-65357 | Apple iPadOS/iOS/macOS/tvOS/visionOS/watchOS up to 26.5 memory corruption

Sat, 19 Sep 2026 09:42:00 +0200

A vulnerability was found in Apple iPadOS, iOS, macOS, tvOS, visionOS and watchOS up to 26.5 and classified as very critical. This affects an unknown part. Executing a manipulation can lead to memory corruption. The identification of this vulnerability is CVE-2026-65357. The attack can only be executed locally. There is no exploit available. It is... Weiterlesen

CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

Sat, 19 Sep 2026 09:33:12 +0200

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2025-39682 (CVSS score: 9.8) - An improper check for unusual or exceptional... Weiterlesen

CVE-2026-71641 | ZJU-FAST-Lab EGO-Planner-v2 EGOReplanFSM denial of service

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability was found in ZJU-FAST-Lab EGO-Planner-v2 and classified as problematic. Affected is an unknown function of the component EGOReplanFSM. Such manipulation leads to denial of service. This vulnerability is traded as CVE-2026-71641. The attack may be launched remotely. There is no exploit available. A patch should be applied to... Weiterlesen

CVE-2026-89060 | Red Hat Advanced Cluster Management for Kubernetes multicluster-observability-addon information disclosure

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability, which was classified as problematic, was found in Red Hat Advanced Cluster Management for Kubernetes. Affected by this issue is some unknown functionality of the component multicluster-observability-addon. The manipulation results in information disclosure. This vulnerability was named CVE-2026-89060. The attack may be performed... Weiterlesen

CVE-2026-82100 | IBM DataStage on Cloud Pak for Data 5.4.0.0 path traversal

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability was found in IBM DataStage on Cloud Pak for Data 5.4.0.0. It has been classified as problematic. This vulnerability affects unknown code. This manipulation causes path traversal. This vulnerability is registered as CVE-2026-82100. Remote exploitation of the attack is possible. No exploit is available. Weiterlesen

CVE-2026-78135 | strongSwan up to 6.0.7 libcharon improper authentication

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability was found in strongSwan up to 6.0.7. It has been declared as very critical. Affected is an unknown function of the component libcharon. The manipulation results in improper authentication. This vulnerability is cataloged as CVE-2026-78135. The attack may be launched remotely. There is no exploit available. It is recommended to... Weiterlesen

CVE-2026-43696 | Apple macOS up to 26 improper authorization

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability marked as problematic has been reported in Apple macOS up to 26. Affected by this vulnerability is an unknown functionality. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-43696. An attack has to be approached locally. There is no exploit available. It is suggested to upgrade the affected... Weiterlesen

CVE-2026-43674 | Apple iOS/iPadOS up to 26 improper authentication

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability was found in Apple iOS and iPadOS up to 26. It has been classified as problematic. Affected is an unknown function. This manipulation causes improper authentication. This vulnerability is registered as CVE-2026-43674. The attack needs to be launched locally. No exploit is available. Upgrading the affected component is recommended. Weiterlesen

CVE-2026-43762 | Apple iOS/iPadOS/macOS/visionOS up to 26.5 information disclosure

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability was found in Apple iOS, iPadOS, macOS and visionOS up to 26.5. It has been declared as problematic. This impacts an unknown function. Such manipulation leads to information disclosure. This vulnerability is listed as CVE-2026-43762. The attack must be carried out locally. There is no available exploit. It is recommended to upgrade... Weiterlesen

CVE-2026-43737 | Apple iOS/iPadOS/macOS/tvOS/watchOS prior 26.7/27/15.8 improper authorization

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability, which was classified as problematic, was found in Apple iOS, iPadOS, macOS, tvOS and watchOS. Impacted is an unknown function. Executing a manipulation can lead to improper authorization. The identification of this vulnerability is CVE-2026-43737. The attack can only be executed locally. There is no exploit available. You should... Weiterlesen

CVE-2026-43702 | Apple iPadOS/iOS/macOS/tvOS/watchOS Video File memory corruption

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability, which was classified as very critical, has been found in Apple iPadOS, iOS, macOS, tvOS and watchOS. This issue affects some unknown processing of the component Video File Handler. Performing a manipulation results in memory corruption. This vulnerability was named CVE-2026-43702. The attack may be initiated remotely. There is no... Weiterlesen

CVE-2026-43719 | Apple macOS up to 15.7/26/26.6 SMB use after free

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability classified as very critical has been found in Apple macOS up to 15.7/26/26.6. This affects an unknown part of the component SMB Handler. This manipulation causes use after free. This vulnerability is handled as CVE-2026-43719. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the... Weiterlesen

CVE-2026-43695 | Apple iPadOS/iOS/macOS/tvOS/visionOS/watchOS prior prior iOS 27 improper authorization

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability labeled as problematic has been found in Apple iPadOS, iOS, macOS, tvOS, visionOS and watchOS. Affected is an unknown function. Executing a manipulation can lead to improper authorization. This vulnerability appears as CVE-2026-43695. The attack may be performed from remote. There is no available exploit. The affected component... Weiterlesen

CVE-2026-43697 | Apple macOS up to 15.7/26/26.6 out-of-bounds

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability was found in Apple macOS up to 15.7/26/26.6. It has been rated as problematic. The impacted element is an unknown function. This manipulation causes out-of-bounds read. This vulnerability is registered as CVE-2026-43697. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is... Weiterlesen

CVE-2026-43690 | Apple macOS up to 15.7/26/26.6 race condition

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability, which was classified as problematic, has been found in Apple macOS up to 15.7/26/26.6. Affected by this issue is some unknown functionality. This manipulation causes race condition. The identification of this vulnerability is CVE-2026-43690. The attack can only be executed locally. There is no exploit available. It is advisable to... Weiterlesen

CVE-2026-43688 | Apple iOS/iPadOS/macOS up to 26 memory corruption

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability classified as very critical was found in Apple iOS, iPadOS and macOS up to 26. Affected by this vulnerability is an unknown functionality. The manipulation results in memory corruption. This vulnerability was named CVE-2026-43688. The attack may be performed from remote. There is no available exploit. Upgrading the affected... Weiterlesen

CVE-2026-43683 | Apple macOS up to 15.7/26.6/26.x out-of-bounds

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability marked as problematic has been reported in Apple macOS up to 15.7/26.6/26.x. This affects an unknown function. Performing a manipulation results in out-of-bounds read. This vulnerability is known as CVE-2026-43683. Attacking locally is a requirement. No exploit is available. It is suggested to upgrade the affected component. Weiterlesen

CVE-2026-65348 | Apple iOS/iPadOS/macOS prior 26.7/27/15.8 permission

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability labeled as critical has been found in Apple iOS, iPadOS and macOS. This affects an unknown function. Executing a manipulation can lead to permission issues. This vulnerability is registered as CVE-2026-65348. The attack needs to be launched locally. No exploit is available. The affected component should be upgraded. Weiterlesen

CVE-2026-65354 | Apple iOS/iPadOS/macOS up to 26 sandbox

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability described as very critical has been identified in Apple iOS, iPadOS and macOS up to 26. Affected is an unknown function. The manipulation results in sandbox issue. This vulnerability is reported as CVE-2026-65354. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended. Weiterlesen

CVE-2026-43785 | Apple iOS/iPadOS/macOS/tvOS/visionOS prior 27 privileges management

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability was found in Apple iOS, iPadOS, macOS, tvOS and visionOS and classified as critical. The impacted element is an unknown function. The manipulation results in improper privilege management. This vulnerability is identified as CVE-2026-43785. The attack can be executed remotely. There is not any exploit available. It is suggested to... Weiterlesen

CVE-2026-43790 | Apple macOS up to 15.7/26/26.6 Kernel memory corruption

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability categorized as very critical has been discovered in Apple macOS up to 15.7/26/26.6. Affected by this vulnerability is an unknown functionality of the component Kernel. Executing a manipulation can lead to memory corruption. This vulnerability is registered as CVE-2026-43790. It is possible to launch the attack remotely. No exploit... Weiterlesen

CVE-2026-65345 | Apple iOS/iPadOS/macOS prior 26.7/27/15.8 permission

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability identified as problematic has been detected in Apple iOS, iPadOS and macOS. The impacted element is an unknown function. Performing a manipulation results in permission issues. This vulnerability is cataloged as CVE-2026-65345. The attack must be initiated from a local position. There is no exploit available. You should upgrade the... Weiterlesen

CVE-2026-65344 | Apple iOS/iPadOS/macOS/tvOS/visionOS prior 26.7/27/15.8 out-of-bounds write

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability categorized as very critical has been discovered in Apple iOS, iPadOS, macOS, tvOS and visionOS. The affected element is an unknown function. Such manipulation leads to out-of-bounds write. This vulnerability is listed as CVE-2026-65344. The attack may be performed from remote. There is no available exploit. It is advisable to... Weiterlesen

CVE-2026-65342 | Apple macOS up to 15.7/26/26.6 permission

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability was found in Apple macOS up to 15.7/26/26.6. It has been rated as problematic. Impacted is an unknown function. This manipulation causes permission issues. This vulnerability is tracked as CVE-2026-65342. The attack is restricted to local execution. No exploit exists. Upgrading the affected component is advised. Weiterlesen

CVE-2026-43791 | Apple macOS up to 15.7/26/26.6 information disclosure

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability was found in Apple macOS up to 15.7/26/26.6. It has been declared as problematic. Affected by this issue is some unknown functionality. Executing a manipulation can lead to information disclosure. This vulnerability is tracked as CVE-2026-43791. The attack can be launched remotely. No exploit exists. It is recommended to upgrade... Weiterlesen

CVE-2026-43808 | Apple iPadOS/iOS/macOS/tvOS/watchOS up to 26.5 use after free

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability was found in Apple iPadOS, iOS, macOS, tvOS and watchOS up to 26.5. It has been rated as very critical. This affects an unknown part. The manipulation leads to use after free. This vulnerability is listed as CVE-2026-43808. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is... Weiterlesen

CVE-2026-43787 | Apple macOS up to 15.7/26/26.6 information disclosure

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability classified as problematic was found in Apple macOS up to 15.7/26/26.6. The affected element is an unknown function. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE-2026-43787. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component... Weiterlesen

CVE-2026-43789 | Apple macOS up to 15.7/26/26.6 Sandbox privileges management

Sat, 19 Sep 2026 08:39:15 +0200

A vulnerability was found in Apple macOS up to 15.7/26/26.6. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Sandbox. Performing a manipulation results in improper privilege management. This vulnerability is identified as CVE-2026-43789. The attack can be initiated remotely. There is... Weiterlesen

CVE-2026-80434 | IBM DataStage on Cloud Pak for Data 5.4.0.0 resource injection

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability identified as critical has been detected in IBM DataStage on Cloud Pak for Data 5.4.0.0. The affected element is an unknown function. Performing a manipulation results in improper control of resource identifiers. This vulnerability was named CVE-2026-80434. The attack may be initiated remotely. There is no available exploit. Weiterlesen

CVE-2026-88011 | Traefik up to 2.11.55/3.7.11 Header Normalization improper authentication

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability described as critical has been identified in Traefik up to 2.11.55/3.7.11. This issue affects some unknown processing of the component Header Normalization. The manipulation results in improper authentication. This vulnerability is known as CVE-2026-88011. It is possible to launch the attack remotely. No exploit is available.... Weiterlesen

CVE-2026-82092 | IBM DataStage on Cloud Pak for Data 5.4.0.0 path traversal

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability was found in IBM DataStage on Cloud Pak for Data 5.4.0.0 and classified as critical. This affects an unknown part. The manipulation results in path traversal. This vulnerability is cataloged as CVE-2026-82092. The attack may be launched remotely. There is no exploit available. Weiterlesen

CVE-2026-81554 | IBM DataStage 5.4.0.0 path traversal

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability, which was classified as very critical, was found in IBM DataStage 5.4.0.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to path traversal. This vulnerability is tracked as CVE-2026-81554. The attack can be launched remotely. No exploit exists. Weiterlesen

CVE-2026-81551 | IBM DataStage on Cloud Pak for Data 5.4.0.0 path traversal

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability, which was classified as very critical, has been found in IBM DataStage on Cloud Pak for Data 5.4.0.0. Affected is an unknown function. Performing a manipulation results in path traversal. This vulnerability is identified as CVE-2026-81551. The attack can be initiated remotely. There is not any exploit available. Weiterlesen

CVE-2026-80378 | IBM DataStage on Cloud Pak for Data 5.4.0.0 improper authorization

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability was found in IBM DataStage on Cloud Pak for Data 5.4.0.0 and classified as critical. This issue affects some unknown processing. The manipulation results in improper authorization. This vulnerability is reported as CVE-2026-80378. The attack can be launched remotely. No exploit exists. Weiterlesen

CVE-2026-9327 | IBM WebSphere Application Server 8.5/9.0 privileges management (WID-SEC-2026-3255)

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability, which was classified as critical, was found in IBM WebSphere Application Server 8.5/9.0. The impacted element is an unknown function. The manipulation results in improper privilege management. This vulnerability is reported as CVE-2026-9327. The attack can be launched remotely. No exploit exists. Weiterlesen

CVE-2026-52098 | FlowiseAI Flowise 3.1.2 /api/v1/prediction code injection

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability, which was classified as critical, was found in FlowiseAI Flowise 3.1.2. This vulnerability affects unknown code of the file /api/v1/prediction. Such manipulation leads to code injection. This vulnerability is uniquely identified as CVE-2026-52098. The attack can be launched remotely. No exploit exists. Weiterlesen

CVE-2026-14276 | IBM i Access Family up to 1.1.9.15 Emulator Macro RunProgram os command injection

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability classified as critical was found in IBM i Access Family up to 1.1.9.15. This affects the function RunProgram of the component Emulator Macro. Executing a manipulation can lead to os command injection. The identification of this vulnerability is CVE-2026-14276. The attack may be launched remotely. There is no exploit available. Weiterlesen

CVE-2026-19542 | GNU glibc tdelete memory corruption (WID-SEC-2026-3014)

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability identified as very critical has been detected in GNU glibc. Impacted is the function tdelete. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2026-19542. It is possible to initiate the attack remotely. There is no exploit available. Weiterlesen

CVE-2026-13285 | IBM MQ up to 10.0.0.0 xml external entity reference

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability was found in IBM MQ up to 10.0.0.0 and classified as critical. Affected by this issue is some unknown functionality. Such manipulation leads to xml external entity reference. This vulnerability is listed as CVE-2026-13285. The attack may be performed from remote. There is no available exploit. Weiterlesen

CVE-2026-18119 | Concrete CMS up to 9.5.2 Block Design Dialog cross site scripting

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability classified as problematic was found in Concrete CMS up to 9.5.2. Affected is an unknown function of the component Block Design Dialog. Executing a manipulation can lead to cross site scripting. This vulnerability is tracked as CVE-2026-18119. The attack can be launched remotely. No exploit exists. Weiterlesen

CVE-2026-28836 | Apple macOS up to 14.8.7 privileges management

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability was found in Apple macOS up to 14.8.7. It has been classified as problematic. The impacted element is an unknown function. The manipulation leads to improper privilege management. This vulnerability is documented as CVE-2026-28836. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected... Weiterlesen

CVE-2026-14275 | IBM i Access Family up to 1.1.9.15 os command injection

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability classified as critical has been found in IBM i Access Family up to 1.1.9.15. The impacted element is an unknown function. Performing a manipulation results in os command injection. This vulnerability was named CVE-2026-14275. The attack may be initiated remotely. There is no available exploit. Weiterlesen

CVE-2026-28938 | Apple iOS/iPadOS up to 26.5 information disclosure

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability labeled as problematic has been found in Apple iOS and iPadOS up to 26.5. This issue affects some unknown processing. The manipulation results in information disclosure. This vulnerability is known as CVE-2026-28938. Attacking locally is a requirement. No exploit is available. The affected component should be upgraded. Weiterlesen

CVE-2026-28937 | Apple macOS up to 26 information disclosure

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability identified as problematic has been detected in Apple macOS up to 26. This vulnerability affects unknown code. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2026-28937. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component. Weiterlesen

CVE-2026-28899 | Apple macOS up to 15.7/26/26.5/26.6 Gatekeeper privileges management

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability, which was classified as very critical, has been found in Apple macOS up to 15.7/26/26.5/26.6. The affected element is an unknown function of the component Gatekeeper. Performing a manipulation results in improper privilege management. This vulnerability is identified as CVE-2026-28899. The attack can be initiated remotely. There... Weiterlesen

CVE-2026-28966 | Apple iOS/iPadOS/macOS/tvOS/visionOS prior 26.7/27/15.8 out-of-bounds write

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability has been found in Apple iOS, iPadOS, macOS, tvOS and visionOS and classified as critical. This affects an unknown function. The manipulation leads to out-of-bounds write. This vulnerability is listed as CVE-2026-28966. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded. Weiterlesen

CVE-2026-28935 | Apple iPadOS/iOS/macOS/tvOS/visionOS/watchOS prior 27 memory corruption

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability classified as critical has been found in Apple iPadOS, iOS, macOS, tvOS, visionOS and watchOS. This issue affects some unknown processing. This manipulation causes memory corruption. The identification of this vulnerability is CVE-2026-28935. The attack can only be executed locally. There is no exploit available. It is recommended... Weiterlesen

CVE-2026-28968 | Apple iOS/iPadOS/macOS/tvOS/visionOS/watchOS prior 26.7/27 out-of-bounds write

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability classified as very critical was found in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Impacted is an unknown function. Such manipulation leads to out-of-bounds write. This vulnerability is referenced as CVE-2026-28968. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component... Weiterlesen

CVE-2026-20683 | Apple iOS/iPadOS/macOS/visionOS prior 27/15.8/26.7 improper authentication

Sat, 19 Sep 2026 07:23:40 +0200

A vulnerability was found in Apple iOS, iPadOS, macOS and visionOS. It has been declared as critical. This affects an unknown function. The manipulation results in improper authentication. This vulnerability is reported as CVE-2026-20683. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component. Weiterlesen

Click2Shell WordPress Flaw Lets Attackers Gain RCE With a Single Malicious Link

Sat, 19 Sep 2026 07:21:25 +0200

WordPress administrators are being urged to update after researchers disclosed Click2Shell, an exploit chain that can turn one malicious link into remote code execution (RCE) on a vulnerable website. The issue begins with a WordPress Core theme-preview weakness that silently installs an attacker-selected theme from the official directory, then... Weiterlesen

CVE-2026-47753 | LXC Incus up to 7.0.x Backup backend.go (*backend).CreateInstanceFromBackup null pointer dereference