24h | 7d | 30d

CVE-2026-124194

Overview

  • Microsoft
  • Microsoft 365 Apps for Enterprise
10 Nov 2026
Published
13 Nov 2026
Updated
CVSS v3.1
MEDIUM (6.5)
EPSS
1.62%
KEV

Description

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

Statistics

  • 3 Posts
Last activity: 12 hours ago

Bluesky

Profile picture fallback
N_{Dario Fadda} @nuke86.rfeed.it
✨ CVE-2026-124194: lo zero-day di Outlook che ruba l’hash NTLMv2 aprendo un file Office Leggi il blog: spcnet.it/cve-2026-124... 💬 Se ne può parlare sul forum: internet-forum.it
  • 0
  • 0
  • 0
  • 14h ago
Profile picture fallback
Information Security Briefly @infosecbriefly.bsky.social
Prioritize Patch Now for exploited Outlook CVE-2026-124194 and other actively exploited flaws, since Microsoft’s November 2026 updates address 1,240 CVEs including 64 critical.
  • 0
  • 0
  • 0
  • 12h ago
Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 [VULN] CVE-2026-124194 : Zero-Day dans Outlook expose des hachages NTLM Microsoft a corrigé CVE-2026-124194, une vulnérabilité zero-day activement exploitée dans Microsoft Outlook qui peut exposer les informations d’authentification NTLMv2 d’un utilisateur l… #ZeroDay #Vulnérabilité #Cyberveille
  • 0
  • 0
  • 0
  • 12h ago

CVE-2026-129354

Overview

  • D-Link
  • DIR-600L
15 Nov 2026
Published
15 Nov 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
0.87%
KEV

Description

A flaw has been found in D-Link DIR-600L 2.17b02. Affected by this issue is the function hnap_main of the file htdocs/cgibin of the component HNAP Handler. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.

Statistics

  • 3 Posts
  • 4 Interactions
Last activity: 17 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

D-Link DIR-600L (v2.17b02) hit by CRITICAL stack-based buffer overflow (CVE-2026-129354) 🛑 Exploit code is public — RCE or DoS possible. No patch yet; restrict access & monitor HNAP traffic. radar.offseq.com/threat/cve-20

  • 3
  • 1
  • 0
  • 22h ago
Profile picture fallback
OffSequence @offseq

CVE-2026-129354 – CRITICAL stack buffer overflow in D-Link DIR-600L 2.17b02. Remote, unauthenticated RCE possible. Public exploit code released. Isolate affected devices & restrict access; no patch yet. radar.offseq.com/threat/a-flaw

  • 0
  • 0
  • 0
  • 17h ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-129354 | CVSS 10.0 Critical D-Link DIR-600L HNAP Overflow CVE-2026-129354 affects D-Link DIR-600L version 2.17b02. Full analysis: https://t.me/aiutocomputerhelp_lab/1440
  • 0
  • 0
  • 0
  • 22h ago

CVE-2026-111497

Overview

  • Google
  • Brotli
  • github.com/google/brotli
22 Oct 2026
Published
10 Nov 2026
Updated
CVSS v4.0
CRITICAL (9.2)
EPSS
82.64%
KEV

Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 6 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

tvOS 27.2.1 update and HomeView Software 27.2 fix Bluetooth pairing bypasses and Brotli flaw CVE-2026-111497, which CISA lists as exploited.

securityonline.info/tvos-27-2-

  • 1
  • 0
  • 0
  • 9h ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Morphisec~ Node2Shell (CVE-2026-111497), a Brotli decoder RCE in Node.js, is exploited in the wild while AI tools leave multiple unmanaged Node runtimes unpatchable on endpoints. - IOCs: CVE-2026-111497 - #ExploitedVulnerability #RemoteCodeExecution #ThreatIntel #Vulnerability
  • 0
  • 0
  • 0
  • 6h ago

CVE-2026-119618

Overview

  • Apache Software Foundation
  • Apache HTTP Server
11 Nov 2026
Published
15 Nov 2026
Updated
CVSS
Pending
EPSS
1.53%
KEV

Description

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Statistics

  • 2 Posts
Last activity: 10 hours ago

Fediverse

Profile picture fallback
Dantali0n :arch: :i3: @dantalion

Can someone at @nextcloud please fix the version 33 docker images.

They still contain #Apache2 2.69

hub.docker.com/layers/library/

hub.docker.com/layers/library/

#http2 #rce #CVE-2026-119618

  • 0
  • 0
  • 0
  • 10h ago

Bluesky

Profile picture fallback
Information Security Briefly @infosecbriefly.bsky.social
Apache patched CVE-2026-119618, a mod_http2 race-condition flaw enabling unauthenticated remote code execution on HTTP/2-enabled servers.
  • 0
  • 0
  • 0
  • 20h ago

CVE-2026-129444

Overview

  • D-Link
  • DSL-6740C
15 Nov 2026
Published
15 Nov 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
0.61%
KEV

Description

A vulnerability was identified in D-Link DSL-6740C 20131126. This affects an unknown function of the file /etc/templates/ftpd/ftpd_conf.php of the component FTP Daemon. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used.

Statistics

  • 2 Posts
Last activity: 14 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

D-Link DSL-6740C faces CRITICAL risk (CVE-2026-129444, CVSS 10): Hard-coded FTP credentials in /etc/templates/ftpd/ftpd_conf.php enable remote unauthenticated access. Public exploit code available. Restrict FTP & monitor activity. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 14h ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-129444 | CVSS 10.0 Critical D-Link DSL-6740C FTP Vulnerability NVD describes a critical vulnerability in D-Link DSL-6740C version 20131126 involving an unknown function in /etc/templates/ftpd/ftpd_conf.php within the… Full analysis: https://t.me/aiutocomputerhelp_lab/1441
  • 0
  • 0
  • 0
  • 14h ago

CVE-2026-129353

Overview

  • D-Link
  • DIR-600L
14 Nov 2026
Published
14 Nov 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
1.79%
KEV

Description

A vulnerability was detected in D-Link DIR-600L 2.17/2.17b02. Affected by this vulnerability is the function authenticationcgi_main of the file authentication.cgi. Performing a manipulation of the argument id/password results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Statistics

  • 2 Posts
Last activity: 23 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

D-Link DIR-600L (v2.17, 2.17b02) hit by CRITICAL (CVSS 10) stack-based buffer overflow – CVE-2026-129353. Remote, unauthenticated RCE possible. Public exploit out. Limit external exposure & check for vendor updates. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 23h ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-129353 | CVSS 10.0 Critical D-Link DIR-600L Buffer Overflow CVE-2026-129353 affects D-Link DIR-600L versions 2.17 and 2.17b02. Full analysis: https://t.me/aiutocomputerhelp_lab/1439
  • 0
  • 0
  • 0
  • 23h ago

CVE-2026-114713

Overview

  • UnrealIRCd
  • UnrealIRCd
08 Nov 2026
Published
14 Nov 2026
Updated
CVSS v3.1
HIGH (8.6)
EPSS
0.51%
KEV

Description

The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.

Statistics

  • 2 Posts
Last activity: 13 hours ago

Fediverse

Profile picture fallback
Trinacriatech @trinacriatech

UnrealIRCd, CVE-2026-114713: il manutentore dice di vedere sfruttamento in corso; CISA l'ha messa in KEV il 13/11, scadenza FCEB il 16/11.

Il modulo labeled-response non fa escaping del tag IRCv3 "label": un utente qualsiasi, su una rete con due o più server linkati, può iniettare comandi server-to-server con autorità di server.

Colpite le 6.0.0 fino alla 6.2.7.1 esclusa. Fix 6.2.7.1 del 7/11, con hot-patch senza riavvio. Nessun IOC.

#infosec #blueteam thehackernews.com/2026/11/atta

  • 0
  • 0
  • 0
  • 15h ago
Profile picture fallback
ekiledjian @edwardk

Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection

CISA has added a high-severity UnrealIRCd flaw, CVE-2026-114713 (CVSS 8.6), to its Known Exploited Vulnerabilities catalog following reports of active exploitation. The flaw, an improper neutralization of delimiters in the open-source IRC server software, enables server-level command injection. thehackernews.com/2026/11/atta

  • 0
  • 0
  • 0
  • 13h ago

CVE-2026-123039

Overview

  • checkpoint
  • Quantum Security Gateway
12 Nov 2026
Published
14 Nov 2026
Updated
CVSS v3.1
HIGH (7.8)
EPSS
2.19%
KEV

Description

The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.

Statistics

  • 3 Posts
Last activity: 14 hours ago

Fediverse

Profile picture fallback
Michael I Ransier @thecybermind

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-123039 – Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability

Executive risk and governance perspective on CVE-2026-123039, providing leadership with actionable compliance strategies, asset integrity audits, and boardroom oversight metrics....

thecybermind.co/yaps

  • 0
  • 0
  • 1
  • 14h ago

Bluesky

Profile picture fallback
Information Security Briefly @infosecbriefly.bsky.social
Unknown attackers exploited unpatched Check Point Security Gateways using PHP2Shell, then escalated privileges via CVE-2026-123039 to deploy TSGA backdoor and wiper malware.
  • 0
  • 0
  • 0
  • 16h ago

CVE-2026-65339

Overview

  • Apple
  • iOS and iPadOS
17 Aug 2026
Published
26 Oct 2026
Updated
CVSS
Pending
EPSS
0.15%
KEV

Description

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to leak sensitive user information.

Statistics

  • 1 Post
  • 9 Interactions
Last activity: 14 hours ago

Fediverse

Profile picture fallback
Catalin Cimpanu @campuscodi

Meta's red team and Nik Tsytsarkin have published a technical write-up into a bug that allowed sandboxed apps to record audio via the microphone without the proper permissions or being logged.

This was patched back in August

rtx.meta.security/exploitation

  • 6
  • 3
  • 0
  • 14h ago

CVE-2026-98432

Overview

  • Linux
  • Linux
15 Oct 2026
Published
03 Nov 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.78%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build(). A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.

Statistics

  • 1 Post
  • 5 Interactions
Last activity: 4 hours ago

Fediverse

Profile picture fallback
bodems @bodems

RE: mastodon.social/@derdreschi85/

Wir schaffen es auch Wochen, nachdem andere Distributionen den Kernel gegen CVE-2026-98432 gepatcht haben, keinen neuen Kernel auszuliefern, aber lassen jetzt AI Patches schreiben für Sicherheitslücken 🤡

  • 1
  • 4
  • 0
  • 4h ago
Showing 1 to 10 of 44 CVEs