tsecurity.de - News Radar & Live Feeds

CVE-2026-88779 — Citrix NetScaler SAML Memory Overflow, Actively Exploited, CISA KEV

Mon, 05 Oct 2026 03:57:03 +0200

A memory overflow in Citrix NetScaler's SAML handler is being actively exploited as a zero-day. CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities catalog on October 4, 2026. CVE-2026-88779 (CVSS 4.0: 8.7) — Unauthenticated memory overflow (CWE-119) triggered by malicious SAML requests. Crashes the appliance's authentication service,... Weiterlesen

Citrix NetScaler SAML 0-Day Vulnerability Actively Exploited in Attacks

Mon, 05 Oct 2026 03:54:09 +0200

Citrix has released emergency security updates for a NetScaler SAML zero-day vulnerability that attackers are actively exploiting. Tracked as CVE-2026-88779, the flaw affects customer-managed NetScaler ADC and NetScaler Gateway appliances and can cause denial of service, disrupting access to services that depend on these systems. The vulnerability... Weiterlesen

Citrix patches NetScaler SAML zero-day exploited in attacks

Mon, 05 Oct 2026 00:21:23 +0200

Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. [...] Weiterlesen

Exploit-Index

Sun, 04 Oct 2026 17:11:14 +0200

The Ultimate CVE Proof of Concept (PoC) & Exploit Database. A zero-API, high-performance aggregator for 0days, vulnerabilities, and Threat Intelligence. Replacing manual searches for elite SOC teams, DevSecOps, and Bug Bounty Hunters. Weiterlesen

CVE-2024-58288 | Genexus Protection Server 9.7.2.10 Windows Service unquoted search path (Exploit 52065 / EDB-52065)

Sun, 04 Oct 2026 12:43:53 +0200

A vulnerability, which was classified as problematic, was found in Genexus Protection Server 9.7.2.10. This vulnerability affects unknown code of the component Windows Service. Such manipulation leads to unquoted search path. This vulnerability is documented as CVE-2024-58288. The attack needs to be performed locally. Additionally, an exploit... Weiterlesen

CVE-2024-58292 | xmbforum2 XMB Forum 1.9.12.06 Setting cross site scripting (Exploit 52044 / EDB-52044)

Sun, 04 Oct 2026 12:43:50 +0200

A vulnerability classified as problematic was found in xmbforum2 XMB Forum 1.9.12.06. This impacts an unknown function of the component Setting Handler. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2024-58292. It is possible to launch the attack remotely. Furthermore, an exploit is available. Weiterlesen

CVE-2024-58296 | PhoenixCart CE Phoenix 1.0.8.20 Administration Panel title cross site scripting (Exploit 52015 / EDB-52015)

Sun, 04 Oct 2026 12:43:46 +0200

A vulnerability was found in PhoenixCart CE Phoenix 1.0.8.20. It has been declared as problematic. Affected by this issue is some unknown functionality of the component Administration Panel. Such manipulation of the argument Title leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-58296. The attack can be launched... Weiterlesen

CVE-2024-58300 | Siklu MultiHaul TG 1.x Network Request missing authentication (Exploit 51932 / EDB-51932)

Sun, 04 Oct 2026 12:43:45 +0200

A vulnerability was found in Siklu MultiHaul TG 1.x. It has been declared as critical. This affects an unknown function of the component Network Request Handler. Executing a manipulation can lead to missing authentication. This vulnerability is tracked as CVE-2024-58300. The attack can be launched remotely. Moreover, an exploit is present. It is... Weiterlesen

CVE-2024-58290 | Xhibiter NFT Marketplace 1.10.2 Collections Endpoint id sql injection (Exploit 52060 / EDB-52060)

Sun, 04 Oct 2026 12:43:45 +0200

A vulnerability classified as critical was found in Xhibiter NFT Marketplace 1.10.2. This affects an unknown function of the component Collections Endpoint. Such manipulation of the argument ID leads to sql injection. This vulnerability is traded as CVE-2024-58290. The attack may be launched remotely. Furthermore, there is an exploit available. Weiterlesen

CVE-2024-58295 | ElkArte Forum 1.1.9 unrestricted upload (Exploit 52026 / EDB-52026)

Sun, 04 Oct 2026 12:43:45 +0200

A vulnerability marked as critical has been reported in ElkArte Forum 1.1.9. Affected by this issue is some unknown functionality. This manipulation causes unrestricted upload. This vulnerability is handled as CVE-2024-58295. The attack can be initiated remotely. Additionally, an exploit exists. It is suggested to upgrade the affected component. Weiterlesen

CVE-2024-58298 | BMC Compuware iStrobe Web 20.13 JSP Endpoint fileName unrestricted upload (Exploit 51991 / EDB-51991)

Sun, 04 Oct 2026 12:43:43 +0200

A vulnerability was found in BMC Compuware iStrobe Web 20.13 and classified as critical. This vulnerability affects unknown code of the component JSP Endpoint. The manipulation of the argument fileName results in unrestricted upload. This vulnerability is identified as CVE-2024-58298. The attack can be executed remotely. Additionally, an exploit... Weiterlesen

Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure

Sun, 04 Oct 2026 10:47:21 +0200

Warlock ransomware continues to exploit unpatched SharePoint flaws to breach water utilities, telecoms, governments, and universities worldwide. Warlock ransomware made headlines back in mid-2025 for exploiting a chain of SharePoint zero-days collectively dubbed ToolShell. More than a year later, the same group is still using that door, and it’s... Weiterlesen

Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited

Sun, 04 Oct 2026 10:11:07 +0200

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: 16-year-old researcher breaks into Microsoft analytics service with access to 17 trillion rows of data A flaw in Titan, an internal Microsoft analytics service, could have let an attacker read employee records and Bing search analytics, a 16-year-old... Weiterlesen

Microsoft catches hackers exploiting Zimbra bug before disclosure

Sat, 03 Oct 2026 20:42:41 +0200

Attackers were probing the mail server flaw weeks before it had a CVE to its name This article has been indexed from www.theregister.com – Articles Read the original article: Microsoft catches hackers exploiting Zimbra bug before disclosure The post Microsoft catches hackers exploiting Zimbra bug before disclosure appeared first on IT Security... Weiterlesen

Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

Sat, 03 Oct 2026 17:54:06 +0200

The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure,... Weiterlesen

New Citrix NetScaler SAML Flaw Triggers Crashes and Suspected Exploitation Attempts

Sat, 03 Oct 2026 07:52:32 +0200

Citrix NetScaler administrators are reporting repeated appliance crashes and forced reboots after applying emergency updates for recently disclosed zero-day vulnerabilities, with the disruption now linked to a newly observed issue affecting SAML authentication deployments. The incidents have been reported on internet-facing NetScaler ADC and... Weiterlesen

Free malware analysis, reverse engineering and exploit development resources

Sat, 03 Oct 2026 05:04:26 +0200

submitted by /u/Potential-Couple-745 [link] [comments] Weiterlesen

U.S. CISA adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog

Sat, 03 Oct 2026 01:01:36 +0200

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-102489 (CVSS score of 9.4) Zammad GmbH Zammad... Weiterlesen

FortiMail zero-day exploited in attacks as CISA urges immediate patching

Fri, 02 Oct 2026 19:52:46 +0200

A critical zero-day vulnerability in Fortinet FortiMail is being actively exploited in the wild, prompting the US Cybersecurity and Infrastructure Security Agency (CISA) to add the flaw to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2026-104286 and rated 9.8 (Critical) on the CVSS scale, the vulnerability allows... Weiterlesen

Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)

Fri, 02 Oct 2026 19:50:45 +0200

Fortinet is warning customers that attackers are exploiting a zero-day vulnerability (CVE-2026-104286) in FortiMail, its email security gateway. Fortinet says the flaw has been reported to be exploited in the wild, and urges customers to apply the workaround it shared until fixes are available. About CVE-2026-104286 “An Improper Limitation of a... Weiterlesen

NEAR Intents identifiziert Hacker eines $3,8 Millionen Exploits und setzt Frist zur Rückgabe

Fri, 02 Oct 2026 19:47:10 +0200

NEAR Intents hat den Angreifer hinter einem Exploit in Höhe von $3,8 Millionen identifiziert und ihm 48 Stunden Zeit gegeben, die gestohlenen Gelder ... Weiterlesen

Sony PS5 Relapse Jailbreak Exploit Uses JSC Memory Corruption and Kernel UAF

Fri, 02 Oct 2026 19:26:18 +0200

A newly released PlayStation 5 jailbreak chain, called Relapse, targets PS5 and PS5 Pro consoles running firmware versions 7.00 through 13.60. This jailbreak combines a browser-based JavaScriptCore memory corruption technique with a kernel use-after-free race condition. The project’s source code and documentation outline a two-stage chain that... Weiterlesen

MSSQL Post-Exploitation Toolkit Could Enable Credential Theft and Lateral Movement Attacks

Fri, 02 Oct 2026 19:26:10 +0200

An exposed attacker server containing an MSSQL-focused post-exploitation toolkit, credential-harvesting artifacts, and stolen material. The discovery revealed how attackers could use Microsoft SQL Server access to run commands, collect credentials, and prepare attacks against additional systems. The staging server, located at 151.243.232.123, was... Weiterlesen

PS5 Relapse Jailbreak Uses WebKit and Kernel Exploit to Gain Read/Write Access

Fri, 02 Oct 2026 19:26:10 +0200

A newly published proof-of-concept called Relapse-Exploit targets PlayStation 5 consoles running firmware versions 7.00 through 13.60, chaining a browser-based WebKit compromise with a kernel use-after-free vulnerability to obtain kernel-level read/write access. The public project frames the release as material for educational and... Weiterlesen

Zammad 0-Day Vulnerabilities Exploited to Gain Remote Code Execution and Root Access

Fri, 02 Oct 2026 19:25:51 +0200

Two critical Zammad zero-day flaws, reportedly exploited against the Dutch Institute for Vulnerability Disclosure (DIVD), could allow session hijacking, remote command execution as the Zammad service user, and potential root privilege escalation. The vulnerabilities are tracked as CVE-2026-102489 and CVE-2026-102490. DIVD published the findings... Weiterlesen

Fortinet warns that critical flaw in FortiMail is facing exploitation

Fri, 02 Oct 2026 19:25:43 +0200

Security researchers warn that attackers can gain access to credentials, stored mail and other connected systems. This article has been indexed from Cybersecurity Dive – Latest News Read the original article: Fortinet warns that critical flaw in FortiMail is facing exploitation The post Fortinet warns that critical flaw in FortiMail is facing... Weiterlesen

Medusa Ransomware: Why Rapid Exploitation and Data Theft Demand a Prevention-First Strategy

Fri, 02 Oct 2026 19:23:49 +0200

threat intelligence brief · medusa ransomware Sector Medical · Education · Legal · Insurance · Technology · Manufacturing Brief An updated joint advisory from CISA, the FBI, and HHS reports that Medusa has now impacted more than 500 victims across critical infrastructure sectors. Affiliates exploit exposed systems and ⟶ Weiterlesen

Critical Cisco Catalyst SD-WAN Zero-Day Under Active Exploitation

Fri, 02 Oct 2026 19:23:25 +0200

Vulnerability in Cisco Catalyst SD-WAN Manager allows an unauthenticated, remote attacker to access systems with admin privileges Weiterlesen

Two Zero-Days Exploited in Attack on Dutch Institute for Vulnerability Disclosure

Fri, 02 Oct 2026 19:23:25 +0200

The Dutch Institute for Vulnerability Disclosure reveals agentic AI-powered attack using Zammad zero-days Weiterlesen

Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Fri, 02 Oct 2026 19:22:39 +0200

Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. [...] Weiterlesen

BigDiskBuster: Neuer Defender-Exploit soll Updates lahmlegen - B2B Cyber Security

Fri, 02 Oct 2026 19:22:32 +0200

Chaotic Eclipse: Ein Proof-of-Concept mit dem Namen BigDiskBuster zeigt eine neue Schwachstelle im Update-Prozess von Microsoft Defender. Weiterlesen

Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action

Fri, 02 Oct 2026 19:22:17 +0200

CVE-2026-104286 is a critical-severity path traversal vulnerability that could allow attackers to write arbitrary files to the system. The post Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action appeared first on SecurityWeek. Weiterlesen

Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks

Fri, 02 Oct 2026 19:22:17 +0200

The China-based hacking group has been exploiting SharePoint vulnerabilities since July 2025. The post Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks appeared first on SecurityWeek. Weiterlesen

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

Fri, 02 Oct 2026 19:22:11 +0200

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write... Weiterlesen

Microsoft catches hackers exploiting Zimbra bug before disclosure

Fri, 02 Oct 2026 19:21:16 +0200

Attackers were poking at a critical Zimbra mail server bug weeks before it was publicly disclosed, and then moved on to steal credentials, raid mailboxes, and take deeper control of compromised systems. Microsoft Threat Intelligence said it tracked exploitation of CVE-2026-73570, an unauthenticated command injection vulnerability in Zimbra... Weiterlesen

Fortinet sounds the alarm over actively exploited FortiMail zero-day

Fri, 02 Oct 2026 19:21:15 +0200

Fortinet is warning customers to lock down FortiMail after attackers started exploiting a critical bug that lets them write files to vulnerable systems without logging in. The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8 and affects multiple versions of Fortinet's email security platform. Fortinet describes the vulnerability as a... Weiterlesen

Anthropic Finds China’s GLM-5.3 Can Build Working Cyber Exploits

Fri, 02 Oct 2026 19:19:17 +0200

Anthropic found China’s GLM-5.3 can build working cyber exploits with limited human help, with downloadable weights allowing users to alter safeguards. Weiterlesen

Sony PS5 Relapse Jailbreak Exploit Uses JSC Memory Corruption and Kernel UAF

Fri, 02 Oct 2026 19:17:34 +0200

U.S. CISA adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog

Fri, 02 Oct 2026 19:17:30 +0200

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Fortinet FortiMail flaw, tracked as CVE-2026-104286 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is... Weiterlesen