CVE-2026-99999

Overview

Linux
Linux

15 Oct 2026

Published

17 Oct 2026

Updated

CVSS v3.1

CRITICAL (9.3)

EPSS

0.21%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.

Statistics

17 Posts
10 Interactions

Last activity: 2 hours ago

Fediverse

ぽな (C.Ponapalt) @ponapalt

CVE-2026-99999が意図的に選ばれたものでは？とか話題になってるけど、もう10万番まで進んでるから、偶然アレな数字が割り付けられた説のほうがありそう…

2
0
0
22h ago

Juja @ymd

Linuxカーネル脆弱性CVE-2026-99999って、偶然にしては出来すぎてる番号かと思ってたらわざとつけたのか

1
2
0
10h ago

Daily CyberSecurity @DailyCyberSecurity

Discover the details of a new Linux kernel critical vulnerability (CVE-2026-99999). Learn how to patch this virtualization flaw to protect your host machines.

#Debian #Cybersecurity #Vulnerability #CloudSecurity

https://dailytechnow.com/linux-kernel-critical-vulnerability/

0
1
0
2h ago

benzogaga33 :verified: @benzogaga33

PwnEscape : une faille Linux permet de s’évader d’une VM KVM https://www.it-connect.fr/pwnescape-cve-2026-99999-faille-noyau-linux-evasion-vm/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Linux

0
0
0
12h ago

Bluesky

Spiegel's crawler @crawler.baldanders.info

＞ Linuxカーネルの深刻な脆弱性「PwnEscape」（CVE-2026-99999）、ゲストの仮想マシンからホスト側Linux OSに不正なコードを実行できる可能性 https://www.publickey1.jp/blog/26/linuxpwnescapecve-2026-99999linux_os.html

1
0
1
6h ago

Calimeg @calimegai.bsky.social

PwnEscape (CVE-2026-99999): faille critique du noyau Linux permettant aux VM invitées de lire la mémoire hôte. Démontrée sur les sandboxes de Vercel et confirmée. 🔓 #Vercel #Linux thehackernews.com/2026/10/crit...

0
2
0
14h ago

NVD - Home https://nvd.nist.gov/vuln/detail/cve-2026-99999

0
1
0
22h ago

nilab (in Bluesky) @nilab.bsky.social

CVE Record: CVE-2026-99999, Severity: CRITICAL, Score: 9.3 "Title: ipv4: validate checksum_start before completing checksum" "Published: 2026-10-15" "In the Linux kernel, the following vulnerability has been resolved" www.cve.org/CVERecord?id...

0
0
0
23h ago

さくらのVPSにおけるLinuxカーネルの脆弱性（CVE-2026-99999）への対応状況について https://vps.sakura.ad.jp/contents/info/202610-pendingapply/

0
0
0
22h ago

さくらのクラウドにおけるLinuxカーネルの脆弱性（CVE-2026-99999）への対応状況について https://cloud.sakura.ad.jp/news/2026/10/16/cve-2026-99999/

0
0
0
21h ago

CVE-2026-99999（PwnEscape）を読み解く──「KVMの脆弱性」ではなく、Linuxネットワークスタックの脆弱性 - Qiita https://qiita.com/k2_naka/items/fa87685231377f15e7e3

0
0
0
19h ago

セキュリティ対策Lab @securitylab-jp.bsky.social

さくらインターネット、Linuxカーネル重大な脆弱性「CVE-2026-99999」対応で新規申込を一時停止―クラウド・VPSなど影響調査 rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース

0
0
0
19h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

CVE-2026-99999 (PwnEscape) lets guest-controlled packets disclose host memory and may enable host compromise. Root execution was demonstrated only in researchers’ lab; update and reboot affected host kernels.

0
0
0
15h ago

Undercode Testing @undercode.bsky.social

PwnEscape: Linux Kernel Virtual Machine Escape Vulnerability (CVE-2026-99999) and AI-Driven Threat Discovery + Video Introduction: The discovery of PwnEscape (CVE-2026-99999, CVSS 9.3) highlights a critical vulnerability within the Linux kernel's networking subsystem that allows a guest virtual…

0
0
0
15h ago

AWS セキュリティ速報 2026-137-AWS（CVE-2026-99999）は通常の EC2 は対象外。影響範囲を確認してみた | DevelopersIO https://dev.classmethod.jp/articles/aws-security-bulletin-2026-137-kvm-kernel/

0
0
0
14h ago

feedbot.unronritaro.net @feedbot.unronritaro.net

Linuxカーネルの深刻な脆弱性「PwnEscape」（CVE-2026-99999）、ゲストの仮想マシンからホスト側Linux OSに不正なコードを実行できる可能性 | Publickey

0
0
0
8h ago

CVE-2026-102764

Overview

BeyondTrust
Remote Support

15 Oct 2026

Published

17 Oct 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

1.18%

MITRE

KEV

Description

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

Statistics

6 Posts
7 Interactions

Last activity: 4 hours ago

Fediverse

CyberNetsecIO @netsecio

📰 China-Linked Group Exploits BeyondTrust Zero-Day in Espionage Attacks

A China-linked group, Armory Castle, is actively exploiting a critical zero-day (CVE-2026-102764) in BeyondTrust Remote Support appliances to gain root access and steal credentials. Patching is urgent. #CyberSecurity #ThreatIntel #ZeroDay #CVE

🔗 https://cyber.netsecops.io/articles/china-linked-hackers-exploit-beyondtrust-zero-day-in-espionage-campaign/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

0
0
0
5h ago

ekiledjian @edwardk

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added a Fortinet multiple-products path traversal flaw (CVE-2025-61624) and a BeyondTrust Remote Support authentication bypass (CVE-2026-102764) to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize remediation of KEV-listed flaws on publicly exposed assets. https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog

0
0
0
4h ago

Bluesky

Aiutocomputerhelp.it @aiuto-ch.bsky.social

Incident Radar | ARMORY CASTLE Exploited BeyondTrust Remote Support Zero-Day Mandiant identified evidence that ARMORY CASTLE exploited CVE-2026-102764 in BeyondTrust Remote Support appliances as a zero-day… Source: Google Threat Intelligence Full analysis: https://t.me/aiutocomputerhelp_lab/1284

2
2
0
15h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

BeyondTrust says suspected China-linked actor ARMORY CASTLE exploited CVE-2026-102764 in Remote Support appliances. The article details the attack and recommends patching affected self-hosted systems and investigating appliances exposed while vulnerable.

1
1
0
15h ago

boredchilada @cyfar.ca

~Cisa~ Attackers exploit an authentication bypass in self-hosted BeyondTrust Remote Support; patch immediately. - IOCs: CVE-2026-102764 - #BeyondTrust #CVE2026102764 #ThreatIntel

0
1
0
18h ago

Eyal Estrin ☁️ @eyalestrin.bsky.social

CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support (CVE-2026-102764) #patchmanagement

0
0
0
9h ago

CVE-2026-110447

Overview

Collabora
Collabora Online - Built-in CODE Server
richdocumentscode

14 Oct 2026

Published

14 Oct 2026

Updated

CVSS v4.0

CRITICAL (9.2)

EPSS

1.22%

MITRE

KEV

Description

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

Statistics

2 Posts
16 Interactions

Last activity: 13 hours ago

Fediverse

nicolas @nschont

Vérifiez vos nextcloud avec collabora CODE
https://www.it-connect.fr/nextcloud-collabora-built-in-code-faille-webshell-cve-2026-110447/

15
1
0
13h ago

The CyberSec Guru @guru

Critical Nextcloud Collabora Flaw Enables Unauthenticated Command Execution Through Built-in CODE Server

CVE-2026-110447 is a critical Nextcloud Collabora RCE flaw exploited in the wild. Learn affected versions, attack details, web shell indicators, and fixes

https://thecybersecguru.com/exploits/nextcloud-cve-2026-110447-collabora-rce/

0
0
0
13h ago

CVE-2026-103849

Overview

Adobe
Adobe Commerce

13 Oct 2026

Published

15 Oct 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

0.78%

MITRE

KEV

Description

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

Statistics

3 Posts

Last activity: 8 hours ago

Fediverse

Mike | Raymond Tec @mike

Online Ads Delivered Spyware, Plus 3 Stories https://raymondtec.com/2026/10/online-ads-delivered-spyware-plus-3-stories/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief

Online ads became a zero-click spyware pipeline. Plus a critical Magento flaw, state lawsuits over ChatGPT safety, and new Temu limits in Texas.

#TechNews #AdobeCommerce #Candiru #CVE2026103849 #Magento #OpenAI #Spyware

0
0
0
12h ago

Bluesky

Abijita Foundation @abijita.bsky.social

Critical Magento Flaw Could Let Hackers Execute PHP Code on E-Commerce Servers Security researchers warn that CVE-2026-103849, dubbed BlockStrap, could allow unauthenticated attackers to execute arbitrary PHP code on vulnerable Magento and Adobe Commerce servers.

0
0
0
10h ago

Eyal Estrin ☁️ @eyalestrin.bsky.social

BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849) #patchmanagement

0
0
0
8h ago

CVE-2025-61624

Overview

Fortinet
FortiOS

14 Apr 2026

Published

17 Oct 2026

Updated

CVSS v3.1

MEDIUM (5.4)

EPSS

1.08%

MITRE

KEV

Description

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

Statistics

2 Posts

Last activity: 4 hours ago

Fediverse

ekiledjian @edwardk

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added a Fortinet multiple-products path traversal flaw (CVE-2025-61624) and a BeyondTrust Remote Support authentication bypass (CVE-2026-102764) to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize remediation of KEV-listed flaws on publicly exposed assets. https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog

0
0
0
4h ago

Bluesky

Aiutocomputerhelp.it @aiuto-ch.bsky.social

CISA KEV | CVE-2025-61624 | Fortinet / Multiple Products CISA lists this vulnerability as exploited in the wild. Check affected products and vendor guidance. Source: CISA KEV Full analysis: https://t.me/aiutocomputerhelp_lab/1286

0
0
0
4h ago

CVE-2026-104736

Overview

thimpress
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

17 Oct 2026

Published

17 Oct 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

0.44%

MITRE

KEV

Description

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.

Statistics

2 Posts

Last activity: 12 hours ago

Fediverse

OffSequence @offseq

CVE-2026-104736: LearnPress (≤4.4.10) has a CRITICAL PHP Object Injection flaw (CVSS 9.8) via 'checkout-email' — enables unauth RCE & system takeover. No patch yet; restrict AJAX checkout now. https://radar.offseq.com/threat/cve-2026-104736-cwe-502-deserialization-of-untrusted-data-in-thimpress-learnpress-wordpress-lms-plugin-da26ea8c610f8fca #OffSeq #WordPress #Vuln #Infosec

0
0
0
18h ago

Bluesky

Undercode Testing @undercode.bsky.social

Critical CVE-2026-104736 and CVE-2026-110653: Unauthenticated Flaws in LearnPress and LatePoint Threatening WordPress Deployments + Video Introduction: Recent threat intelligence highlights two critical, unauthenticated vulnerabilities affecting widely used WordPress plugins—LearnPress…

0
0
0
12h ago

CVE-2026-110653

Overview

latepoint
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

17 Oct 2026

Published

17 Oct 2026

Updated

CVSS v3.1

CRITICAL (9.1)

EPSS

0.40%

MITRE

KEV

Description

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.

Statistics

2 Posts

Last activity: 12 hours ago

Fediverse

OffSequence @offseq

CVE-2026-110653 | CRITICAL flaw in LatePoint Appointment Booking Plugin (<=5.7.4) for WordPress: Race condition in OTP lets attackers bypass authentication & seize user accounts. Restrict OTP endpoints, monitor now. https://radar.offseq.com/threat/cve-2026-110653-cwe-287-improper-authentication-in-latepoint-appointment-booking-plugin-latepoint-084a535b1718f8eb #OffSeq #WordPress #CVE2026110653

0
0
0
16h ago

Bluesky

Undercode Testing @undercode.bsky.social

Critical CVE-2026-104736 and CVE-2026-110653: Unauthenticated Flaws in LearnPress and LatePoint Threatening WordPress Deployments + Video Introduction: Recent threat intelligence highlights two critical, unauthenticated vulnerabilities affecting widely used WordPress plugins—LearnPress…

0
0
0
12h ago

CVE-2026-81469

Overview

Dell
Inventory Collector Client

21 Sep 2026

Published

24 Sep 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

0.19%

MITRE

KEV

Description

Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges

Statistics

1 Post
1 Interaction

Last activity: 10 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-81469: unquoted search path in Dell Inventory Collector Client under 15.0.0 lets a local low-priv attacker run code and escalate privileges. CVSS 7.8, no patch yet. Isolate or remove the client until Dell ships a fix. https://www.valtersit.com/cve/CVE-2026-81469/ #CVE #infosec #Dell

1
0
0
10h ago

CVE-2025-30156

Overview

ceph
ceph

27 Aug 2026

Published

01 Sep 2026

Updated

CVSS v3.1

HIGH (8.9)

EPSS

0.09%

MITRE

KEV

Description

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message authentication, allowing an attacker to forge credentials and gain cluster-wide access. Because the ciphertext is malleable and the monitor will encrypt attacker-chosen entity names, an attacker holding one low-privilege key and able to observe CephX traffic can use the monitor as an encryption oracle and splice ciphertext blocks into valid tickets for privileged entities such as Manager, MDS, and OSD. The same lack of authentication also lets an attacker with CephX permissions escalate privileges by flipping a single bit in a service ticket to set its allow_all field to true. This issue is fixed in versions 20.2.4 and 19.2.6.

Statistics

1 Post
1 Interaction

Last activity: 1 hour ago

Fediverse

Michael @mmeier

New blog post: https://blog.mei-home.net/posts/ceph-cve-2025-30156-update/

I mitigate a Ceph CVE and have to decommission one of my hosts because its CPU doesn't support Rocky Linux 10 anymore, due to packages there being build with a newer x86-64 instruction set.

#HomeLab #Ceph #blog

0
1
0
1h ago

CVE-2026-49811

Overview

Dell
Command | Monitor (DCM)

21 Sep 2026

Published

22 Sep 2026

Updated

CVSS v3.1

HIGH (8.4)

EPSS

0.14%

MITRE

KEV

Description

Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

Statistics

1 Post

Last activity: 16 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-49811: Dell Command | Monitor before 10.13.2 has incorrect permission assignment, letting a local low-priv attacker escalate to full privileges. CVSS 8.4. No patch confirmed yet; update immediately. https://www.valtersit.com/cve/CVE-2026-49811/ #CVE #infosec #Dell

0
0
0
16h ago

Quick check

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Critical Nextcloud Collabora Flaw Enables Unauthenticated Command Execution Through Built-in CODE Server

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Overview

Description

Statistics

Fediverse

Overview

Description

Statistics

Fediverse