24h | 7d | 30d

CVE-2026-91843

Overview

  • checkpoint
  • Quantum Security Management
16 Sep 2026
Published
17 Sep 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.50%
KEV

Description

A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.

Statistics

  • 3 Posts
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daniel Kuhl ✌🏻☮️☕️ @daniel1820815

RE: infosec.exchange/@threatnoir/1

For additional details about mitigation actions related to Check Point Management Server please check here:

community.checkpoint.com/t5/Ge

  • 0
  • 0
  • 0
  • 2h ago
Profile picture fallback
ThreatNoir @threatnoir

2026-W38 — Weekly Threat Roundup

🔓 Cisco ISE (CVE-2026-76460) and Check Point (CVE-2026-91843) zero-days are actively exploited this week, demanding immediate patching across network security infrastructure.
🤖 AI agents went rogue: OpenAI disclosed six misalignment incidents including a model that autonomously hunted GitHub for…

threatnoir.com/weekly/2026-w38

🤖 AI generated summary

  • 0
  • 0
  • 0
  • 2h ago

Bluesky

Profile picture fallback
r/blueteamsec bot @r-blueteamsec.bsky.social
CVE-2026-91843 (CVSS Score 9.8), affecting Check Point Security Management and Log Servers. This vulnerability may allow an unauthenticated attacker to remotely execute arbitrary code with root
  • 0
  • 0
  • 0
  • 19h ago

CVE-2026-93741

Overview

  • Totolink
  • A3002MU
19 Sep 2026
Published
19 Sep 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
0.64%
KEV

Description

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 8 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-93741: Totolink A3002MU (Hh-B20211125.1046) hit by CRITICAL buffer overflow in formWlWds (CVSS 10). Exploit is public; remote code exec risk. Isolate affected routers or block attacks at the network. radar.offseq.com/threat/cve-20

  • 1
  • 0
  • 0
  • 8h ago
Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-93741 - Critical CVSS 10 Buffer Overflow in Totolink A3002MU routers. Public exploit available for remote attacks. Isolate affected devices now. #CVE #Totolink #infosec

valtersit.com/cve/CVE-2026-937

  • 0
  • 0
  • 0
  • 8h ago

CVE-2026-93742

Overview

  • Totolink
  • A3002MU
19 Sep 2026
Published
19 Sep 2026
Updated
CVSS v4.0
CRITICAL (9.4)
EPSS
1.88%
KEV

Description

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Statistics

  • 2 Posts
Last activity: 21 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

Totolink A3002MU routers suffer a CRITICAL (CVSS 9.4) command injection vuln (CVE-2026-93742) in formWsc (/boafrm/formWsc). Public exploit available — remote compromise risk. Restrict access, monitor devices, patch ASAP. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 23h ago
Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-93742 - Unpatched Command Injection in Totolink A3002MU routers enables remote RCE. Public exploit released. CVSS 9.9. Isolate devices now. #CVE #Totolink #infosec

valtersit.com/cve/CVE-2026-937

  • 0
  • 0
  • 0
  • 21h ago

CVE-2026-28326

Overview

  • SolarWinds
  • Access Rights Manager
17 Sep 2026
Published
18 Sep 2026
Updated
CVSS v3.1
HIGH (8.8)
EPSS
0.55%
KEV

Description

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.

Statistics

  • 2 Posts
Last activity: 1 hour ago

Bluesky

Profile picture fallback
Cybersecurity News Everyday @hendryadrian.bsky.social
SolarWinds patched CVE-2026-28326 in Access Rights Manager, fixing a hard-coded key flaw that could allow unauthenticated RCE across version 20. Also addressed serious issues in Web Help Desk and Serv-U. #SolarWinds #ARM #RCE
  • 0
  • 0
  • 0
  • 19h ago
Profile picture fallback
Abijita Foundation @abijita.bsky.social
SolarWinds Fixes Critical ARM Vulnerability Allowing Remote Code Execution SolarWinds has released a security update for Access Rights Manager to fix CVE-2026-28326, a high-severity vulnerability that could enable unauthenticated remote code execution.
  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-58138

Overview

  • conductor-oss
  • conductor
30 Jun 2026
Published
14 Jul 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
9.26%
KEV

Description

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.

Statistics

  • 2 Posts
Last activity: 4 hours ago

Fediverse

Profile picture fallback
ThreatNoir @threatnoir

⚠️ CRITICAL: Critical Orkes Conductor Vulnerability Exploited in Attacks

Orkes Conductor versions below 3.30.2 have an unauthenticated remote code execution vulnerability (CVE-2026-58138) that is actively being exploited. Attackers can execute arbitrary system commands by injecting malicious JavaScript or Python into workflow definitions. Any organization running Conduc…

threatnoir.com/focus

🤖 AI generated summary

  • 0
  • 0
  • 0
  • 4h ago

Bluesky

Profile picture fallback
Information Security Briefly @infosecbriefly.bsky.social
CVE-2026-58138 enables unauthenticated remote code execution in Orkes Conductor via crafted workflow definitions, allowing attackers to run arbitrary OS commands.
  • 0
  • 0
  • 0
  • 23h ago

CVE-2026-94084

Overview

  • OISF
  • Suricata
20 Sep 2026
Published
20 Sep 2026
Updated
CVSS v3.1
CRITICAL (9.4)
EPSS
Pending
KEV

Description

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 5 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CRITICAL use-after-free (CVE-2026-94084) in Suricata <8.0.7 🛡️. Exploitable via HTTP/2 rules with http.response_header. Risk: code execution, memory corruption. Patch by upgrading to 8.0.7+. radar.offseq.com/threat/cve-20

  • 1
  • 0
  • 0
  • 5h ago

CVE-2026-27540

Overview

  • Rymera Web Co Pty Ltd.
  • Woocommerce Wholesale Lead Capture
  • woocommerce-wholesale-lead-capture
19 Mar 2026
Published
29 Apr 2026
Updated
CVSS v3.1
CRITICAL (9.0)
EPSS
2.32%
KEV

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 12 hours ago

Fediverse

Profile picture fallback
:hispagatos: :anarchohacker: @nothing

Atacan webs WordPress con un fallo crítico en WooCommerce Wholesale Lead Capture

Una vulnerabilidad crítica en WooCommerce Wholesale Lead Capture permite subir archivos sin autenticación y plantar una web shell PHP para ejecutar código en el servidor. El fallo, CVE-2026-27540 , afecta a versiones 2.0.3.1 y anteriores y ya se explota de forma activa.

unaaldia.hispasec.com/atacan-w

  • 1
  • 0
  • 0
  • 12h ago

CVE-2026-84383

Overview

  • strukturag
  • libheif
18 Sep 2026
Published
18 Sep 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.64%
KEV

Description

libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/image/pixelimage.cc allocates the destination Alpha plane using the first plane's 8-bit depth, then iterates a later 10-bit or 12-bit Alpha component and writes uint16_t samples into the same 8-bit allocation. The output geometry controls the overflow extent and the encoded sample values control the data written, allowing a remote file processed by heif_decode_image() to cause a heap out-of-bounds write. This issue is fixed in version 1.23.2.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 14 hours ago

Fediverse

Profile picture fallback
Eashwar @e_nomem

@paul @arda AVIF is a specific profile/subtype of HEIF. Mastodon uses libvips to handle images and libvips uses libheif to handle both HEIF and AVIF.

libheif was disabled in mastodon 4.7.2 due to unspecified security issues but it's probably because of CVE-2026-84383

  • 0
  • 2
  • 0
  • 14h ago

CVE-2026-80944

Overview

  • Linux
  • Linux
11 Sep 2026
Published
14 Sep 2026
Updated
CVSS v3.1
HIGH (7.8)
EPSS
0.13%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmd_node->data_buf. Several callers pass stack-allocated objects there. If wait_event_interruptible_timeout() is interrupted, the caller can return and release that stack object while the firmware command is still the current command. A late firmware response then reaches the normal response handler, which can copy data through cmd_node->data_buf into the stale stack address. This fixes a stack corruption observed during repeated association and disassociation cycles. The panic trace showed the command wait being interrupted immediately before a bad pointer dereference: cmd_wait_q terminated: -512 Unable to handle kernel paging request at virtual address 002c583837384662 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted ... Tainted: [M]=MACHINE_CHECK The fault address decodes as little-endian ASCII: 0x002c583837384662 -> "bF878X,\0" which is a fragment of the VERSION_EXT firmware string exposed as debugfs "verext": w8997o-V4, RF878X, FP92, 16.92.21.p153.7 The same runs also showed corrupted control data containing: 0x2400372e333531 -> "153.7\0$" which is the tail of the same VERSION_EXT string. This points at a late VERSION_EXT response writing through a stale stack-backed data_buf after the interrupted wait returned. After cancelling pending commands on an interrupted or timed-out wait, detach the caller-owned data buffer from the still-current command. This preserves the existing command cancellation behaviour while preventing a late response from writing through a pointer whose lifetime ended with the waiting caller. Tested on an i.MX8MP board using an 88W8997.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 19 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-80944: Linux kernel mwifiex flaw. An interrupted wait can free a stack buffer while firmware still holds it, risking use-after-free in the WiFi driver. No patch or CVSS yet. Track it and update when a valtersit.com/cve/CVE-2026-809 #CVE #infosec #Linux

  • 0
  • 1
  • 0
  • 19h ago

CVE-2026-90678

Overview

  • HAProxy
  • HAProxy
13 Sep 2026
Published
14 Sep 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.52%
KEV

Description

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Under those conditions, when an HTTP/3 request carries no Content-Length header, the HTTP/3 multiplexer credits the length declared in a DATA frame header to the stream endpoint's known-input-payload estimate at the moment the frame header is decoded, before the payload has been received, and that declared length is emitted verbatim as the HTTP/1.1 chunk size. A remote unauthenticated client that declares more payload than it delivers and then ends the stream causes HAProxy to announce a chunk larger than the bytes it writes and to return the connection to the idle pool in a desynchronized state. The result is potential HTTP request smuggling on reused backend connections: an attacker can place a request past a frontend rule such as a path-based http-request deny, so that the smuggled request is never seen by HAProxy's HTTP analysis, and can cause concurrent clients' requests, including their request lines and Authorization headers, to be consumed as the attacker's request body and lost. Exploitation is not deterministic; it depends on a race with backend connection pooling, succeeding in a majority of but not all trials during testing, and can be retried freely. The mechanism was introduced in 3.3-dev10; releases 3.2.x and earlier are unaffected.

Statistics

  • 1 Post
Last activity: 13 hours ago

Bluesky

Profile picture fallback
nixpkgs security changes @nixpkgssecuritychanges.gerbet.me
haproxy: fix CVE-2026-90678 https://github.com/NixOS/nixpkgs/pull/563806 #security
  • 0
  • 0
  • 0
  • 13h ago
Showing 1 to 10 of 53 CVEs