24h | 7d | 30d

Overview

  • SolarWinds
  • Serv-U

04 Jun 2026
Published
06 Jun 2026
Updated

CVSS v3.1
HIGH (7.5)
EPSS
6.68%

Description

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

Statistics

  • 6 Posts
  • 1 Interaction

Last activity: Last hour

Fediverse

Profile picture fallback

Geopolitical tensions escalated with Israel and Iran conducting mutual airstrikes (June 8, 2026). In technology, Apple's WWDC unveiled a Gemini-powered Siri (June 7, 2026). Cybersecurity faces immediate threats as CISA warns of active exploitation of a critical SolarWinds Serv-U vulnerability (CVE-2026-28318), urging urgent patching (June 8, 2026). Additionally, phishing now surpasses the Dark Web for stolen personal data.

#AnonNews_irc #Cybersecurity #News

  • 0
  • 1
  • 0
  • 10h ago
Profile picture fallback

CISA adds SolarWinds Serv-U DoS flaw to KEV (CVE-2026-28318, CVSS 7.5, actively exploited). Patch it. But also ask the question most teams skip: what privileged accounts are attached to that server, and when did anyone last review them?

  • 0
  • 0
  • 0
  • 5h ago
Profile picture fallback

📰 CISA Mandates Patch for Actively Exploited SolarWinds DoS Flaw Added to KEV Catalog

📢 CISA KEV ALERT! An actively exploited DoS flaw (CVE-2026-28318) in SolarWinds Serv-U is on the loose. Federal agencies must patch by June 19. All orgs using Serv-U are urged to update immediately! 🚨 #CVE #SolarWinds #Infosec #PatchNow

🌐 cyber[.]netsecops[.]io

🔗 cyber.netsecops.io/articles/ci

  • 0
  • 0
  • 0
  • Last hour

Bluesky

Profile picture fallback
CISAが既知の悪用された脆弱性を1件カタログに追加 CISA Adds One Known Exploited Vulnerability to Catalog #CISA (Jun 5) CVE-2026-28318 SolarWinds Serv-Uのリソース消費制御不能の脆弱性 www.cisa.gov/news-events/...
  • 0
  • 0
  • 0
  • 18h ago
Profile picture fallback
CISA says attackers are exploiting a patched SolarWinds Serv-U flaw, CVE-2026-28318, via crafted POST requests that can crash the service. SolarWinds urges immediate upgrades. #SolarWinds #ServU #CISA
  • 0
  • 0
  • 0
  • 8h ago
Profile picture fallback
CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318) 📖 REad more: www.helpnetsecurity.com/2026/06/08/c... #enterprise #filetransfer #government #vulnerability #cybersecurity #cybersecuritynews
  • 0
  • 0
  • 0
  • 6h ago

Overview

  • checkpoint
  • Quantum Security Gateway

08 Jun 2026
Published
08 Jun 2026
Updated

CVSS
Pending
EPSS
0.01%

KEV

Description

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

Statistics

  • 7 Posts
  • 3 Interactions

Last activity: Last hour

Fediverse

Profile picture fallback

Checkpoint - User Authentication Bypass in VPN Remote Access and Mobile Access

#checkpoint #vulnerabilitymanagement #vulnerability

vulnerability.circl.lu/vuln/CV

  • 1
  • 1
  • 0
  • 1h ago
Profile picture fallback

⚠️ CRITICAL: Check Point links VPN zero-day attacks to Qilin ransomware gang

Check Point VPN authentication bypass vulnerability (CVE-2026-50751) in IKEv1 deployments is actively exploited by Qilin ransomware operators since May 7. A few dozen organizations are affected globally with confirmed ransomware incidents tied to this flaw. Organizations running deprecated IKEv1 ke…

threatnoir.com/focus

  • 0
  • 0
  • 0
  • 2h ago

Bluesky

Profile picture fallback
Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751) 📖 Read more: www.helpnetsecurity.com/2026/06/08/c... #cybersecurity #cybersecuritynews #0day #datatheft #ransomware #secureaccess #VPN #vulnerability
  • 1
  • 0
  • 0
  • 4h ago
Profile picture fallback
CVE-2026-50751 in Check Point Remote Access/Mobile Access VPNs using IKEv1 lets attackers bypass password checks via a certificate validation flaw, with Qilin-linked activity observed.
  • 0
  • 0
  • 0
  • 1h ago
Profile picture fallback
CVE-2026-50751 enables unauthenticated attackers to bypass user authentication and establish VPN sessions on IKEv1-based Remote Access/Mobile Access deployments.
  • 0
  • 0
  • 0
  • 1h ago
Profile picture fallback
~Cybergcca~ Check Point VPN authentication bypass (CVE-2026-50751) is under active exploitation. - IOCs: CVE-2026-50751 - #CVE202650751 #CheckPoint #ThreatIntel
  • 0
  • 0
  • 0
  • Last hour
Profile picture fallback
Check Point patched CVE-2026-50751, a critical VPN auth bypass used in zero-day attacks, and found CVE-2026-50752, an IKEv1 flaw tied to Qilin ransomware activity. #CheckPoint #Qilin #VPN
  • 0
  • 0
  • 0
  • 1h ago

Overview

  • Cisco
  • Cisco Catalyst SD-WAN Manager

04 Jun 2026
Published
06 Jun 2026
Updated

CVSS v3.1
HIGH (7.8)
EPSS
0.08%

KEV

Description

A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

Statistics

  • 4 Posts
  • 5 Interactions

Last activity: 3 hours ago

Fediverse

Profile picture fallback

Cisco Murmeltier-Tag

Und (fast) täglich grüßt das Murmeltier ... Auf gefährliche #Zero-Day Sicherheitslücken in #Cisco Produkten zu wetten, ist eine ziemlich sichere Bank. Die neu entdeckte Lücke mit der Nummer CVE-2026-20245 (7,8 von 10) wird bereits für Angriffe ausgenutzt. Es gibt keine vorsorgliche Schutzmaßnahme und – Stand heute – auch noch keine Flicken von Cisco. Sämtliche Formen von SD-WAN sind verwundbar, von selber betrieben (on premise) bis Cloud. Die Schwachstelle ist, wie so oft, eine unzureichende Prüfung von Eingaben (insufficient validation of user-supplied input), eines der klassischen Merkmale von Hintertüren. Mit einer passend gedrechselten

pc-fluesterer.info/wordpress/2

#0day #closedsource #cybercrime #exploits #hersteller #hintertür #sicherheit #UnplugTrump #wissen

  • 2
  • 2
  • 0
  • 3h ago
Profile picture fallback

🚨 New Cisco SD-WAN vulnerability under active exploitation.

CVE-2026-20245 lets authenticated netadmin attackers run commands as root via crafted file uploads.

No patches or mitigations are available.

Check /var/log/scripts.log for IoCs.

Read: thehackernews.com/2026/06/cisc

  • 0
  • 1
  • 0
  • 16h ago
Profile picture fallback

Cisco Catalyst SD-WAN Manager CVE-2026-20245 is being actively exploited with no patch available. CVSS 7.8, affecting on-prem, cloud, and FedRAMP deployments. The CVE is the headline, but it's not the real problem.

  • 0
  • 0
  • 0
  • 5h ago

Bluesky

Profile picture fallback
Cisco Catalyst SD-WAN Managerの脆弱性CVE-2026-20245が悪用されています – パッチは提供されていません Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available #HackerNews (Jun 6) thehackernews.com/2026/06/cisc...
  • 0
  • 0
  • 0
  • 18h ago

Overview

  • WPEverest
  • Everest Forms Pro

31 Mar 2026
Published
08 Apr 2026
Updated

CVSS v3.1
CRITICAL (9.8)
EPSS
0.33%

KEV

Description

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the "Complex Calculation" feature.

Statistics

  • 3 Posts

Last activity: 1 hour ago

Bluesky

Profile picture fallback
Unauthenticated attackers can exploit CVE-2026-3300 in Everest Forms Pro to inject and execute arbitrary PHP via Complex Calculation, enabling site takeover.
  • 0
  • 0
  • 0
  • 4h ago
Profile picture fallback
Defiant varuje před kritickou zranitelností CVE-2026-3300 v pluginu Everest Forms Pro pro WordPress
  • 0
  • 0
  • 0
  • 2h ago
Profile picture fallback
Critical Everest Forms Pro flaw (CVE-2026-3300) has been exploited for months to inject PHP, create admin accounts, and deploy web shells on WordPress sites. #EverestForms #CVE2026 #WordPress
  • 0
  • 0
  • 0
  • 1h ago

Overview

  • Pending

Pending
Published
Pending
Updated

CVSS
Pending
EPSS
Pending

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 3 Posts
  • 11 Interactions

Last activity: 1 hour ago

Fediverse

Profile picture fallback

Fedify security updates: 1.9.12, 1.10.11, 2.0.20, 2.1.16, and 2.2.5

If you use Fedify, update to a patched release now. CVE-2026-50131 affects Fedify's public URL validation for remote document and media loading. An attacker could use special-use IP address ranges to bypass Fedify's SSRF protections and cause a Fedify server to initiate requests to non-public or special-use network destinations, depending on the deployment environment and network routing.

Fedify validates remote ActivityPub document and media URLs before fetching them, including direct IP literals and hostnames resolved through DNS. The vulnerable path is validatePublicUrl(): affected versions rejected common private and local addresses, but still treated several special-use IPv4 ranges as public internet destinations. That gap could allow outbound requests to ranges such as carrier-grade NAT, benchmarking, multicast, reserved, and documentation networks.

The fix makes Fedify validate resolved addresses against public-network expectations instead of relying on the incomplete denylist. It rejects additional special-use IPv4 ranges and IPv6 translation or tunneling prefixes, including NAT64, Teredo, and 6to4 addresses, before remote document or media fetching proceeds.

Current patched releases are 1.9.12, 1.10.11, 2.0.20, 2.1.16, and 2.2.5. The GitHub Security Advisory is GHSA-xw9q-2mv6-9fr8, and the CVE ID is CVE-2026-50131.

Update @fedify/fedify:

npm  update  @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update  @fedify/fedify
bun  update  @fedify/fedify
deno update  @fedify/fedify

If your project depends directly on @fedify/vocab-runtime, update that package too.

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to Chaitanya Vilas Garware for the report and responsible disclosure.

If anything is unclear, ask below.

  • 6
  • 2
  • 1
  • 1h ago
Profile picture fallback

Hollo security updates: 0.7.18, 0.8.7, and 0.9.4

If you run Hollo, update to a patched release now. CVE-2026-50131 affects Fedify's SSRF protection, and Hollo depends on Fedify for ActivityPub federation.

Fedify guards against SSRF (Server-Side Request Forgery) when fetching remote ActivityPub objects, documents, and media by validating that the resolved destination is a public IP address. The previous SSRF fix (GHSA-p9cg-vqcc-grcx) blocked common private and local ranges such as 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, and 192.168.0.0/16, but the validation was incomplete—it still treated several special-use IPv4 ranges as public destinations that should have been rejected. These include carrier-grade NAT (100.64.0.0/10), benchmarking and internal testing networks (198.18.0.0/15), multicast (224.0.0.0/4), reserved (240.0.0.0/4), IETF protocol assignments (192.0.0.0/24), and documentation ranges (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24).

An attacker who controls a remote ActivityPub object or media URL could therefore cause a Hollo instance to initiate outbound requests to non-public or special-use network ranges, depending on the deployment environment and network routing.

For full technical details of the underlying vulnerability, see the Fedify security advisory and the Fedify security announcement.

All Hollo versions up to and including 0.7.17, 0.8.6, and 0.9.3 are affected. Patched releases are 0.7.18 for the 0.7.x series, 0.8.7 for the 0.8.x series, and 0.9.4 for the 0.9.x series.

For 0.7.x deployments, update to 0.7.18:

docker pull ghcr.io/fedify-dev/hollo:0.7.18

For 0.8.x deployments, update to 0.8.7:

docker pull ghcr.io/fedify-dev/hollo:0.8.7

For 0.9.x deployments, update to 0.9.4:

docker pull ghcr.io/fedify-dev/hollo:0.9.4

After pulling the new image, restart your Hollo container. If you deploy from source, pull the corresponding release tag and restart.

Thanks to Chaitanya Vilas Garware for the report and responsible disclosure to the Fedify project.

If anything is unclear, ask below.

  • 3
  • 0
  • 0
  • 1h ago

Overview

  • kernel

03 Mar 2022
Published
03 Jun 2026
Updated

CVSS
Pending
EPSS
33.72%

Description

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

Statistics

  • 2 Posts
  • 5 Interactions

Last activity: 6 hours ago

Fediverse

Profile picture fallback

CISA Adds Actively Exploited Linux Kernel CVE-2022-0492 to KEV Catalog — Patch Now
#CyberSecurity
securebulletin.com/cisa-adds-a

  • 5
  • 0
  • 0
  • 6h ago

Bluesky

Profile picture fallback
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on June 2, 2026, added CVE-2022-0492 to its Known Exploited Vulnerabilities (KEV) catalog, formally confirming active in-the-wild exploitation of a high-severity Linux Kernel improper authentication flaw.
  • 0
  • 0
  • 0
  • 8h ago

Overview

  • Apache Software Foundation
  • Apache HTTP Server

08 Jun 2026
Published
08 Jun 2026
Updated

CVSS
Pending
EPSS
Pending

KEV

Description

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

Statistics

  • 2 Posts
  • 1 Interaction

Last activity: 14 hours ago

Fediverse

Profile picture fallback

Patch Apache time.

* Fix CVE-2026-49975 (HTTP/2 Bomb)

The bomb targets HPACK, HTTP/2's header compression scheme: one byte on the wire becomes one full header allocation on the server, repeated thousands of times per request.

The hold is a zero-byte flow-control window that keeps the server from ever freeing any of it.

security-tracker.debian.org/tr

  • 1
  • 0
  • 0
  • 14h ago

Bluesky

Profile picture fallback
⚠️ Atenção, pessoal que gerencia servidores Apache em #Debian: a vulnerabilidade HTTP/2 Bomb (CVE-2026-49975) não é notícia velha – ela ainda afeta qualquer versão 2.4.17 a 2.4.67 com HTTP/2 ligado. Saiba mais:-> tinyurl.com/byaamtm7
  • 0
  • 0
  • 0
  • 22h ago

Overview

  • SourceCodester
  • Class and Exam Timetabling System

08 Jun 2026
Published
08 Jun 2026
Updated

CVSS v4.0
MEDIUM (6.9)
EPSS
0.03%

KEV

Description

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /archive5.php. The manipulation of the argument sy leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

Statistics

  • 2 Posts

Last activity: 2 hours ago

Fediverse

Profile picture fallback

⚠️ CVE-2026-11482: MEDIUM severity SQL injection in SourceCodester Class and Exam Timetabling System 1.0 via 'sy' param in /archive5.php. No official patch yet — apply mitigations & monitor for attacks. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 12h ago
Profile picture fallback

CVE-2026-11482 - SQLi in Sourcecodester Class & Exam Timetabling System 1.0. Remote exploit via /archive5.php?sy. CVSS 7.3. No patch available. Apply WAF rules immediately. #CVE #infosec #cybersecurity

valtersit.com/cve/CVE-2026-114

  • 0
  • 0
  • 0
  • 2h ago

Overview

  • Ivanti
  • Neurons for ITSM (On-Premises)

01 Jun 2026
Published
02 Jun 2026
Updated

CVSS v3.1
HIGH (8.8)
EPSS
0.41%

KEV

Description

An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.

Statistics

  • 1 Post
  • 5 Interactions

Last activity: 6 hours ago

Fediverse

Profile picture fallback

CVE-2026-9614 (CVSS 8.8): Ivanti Neurons for ITSM Flaw Allows Authenticated Attackers to Gain Full Admin Access
#CyberSecurity
securebulletin.com/cve-2026-96

  • 5
  • 0
  • 0
  • 6h ago

Overview

  • Tenda
  • HG7HG9

08 Jun 2026
Published
08 Jun 2026
Updated

CVSS v4.0
CRITICAL (9.3)
EPSS
0.09%

KEV

Description

A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.

Statistics

  • 1 Post
  • 2 Interactions

Last activity: 7 hours ago

Fediverse

Profile picture fallback

🚨 CRITICAL: CVE-2026-11499 in Tenda HG7HG9/HG10 (firmware 300001138_en_xpon) allows remote stack-based buffer overflow via blkDomain in formDOMAINBLK. No patch yet — restrict access and monitor traffic. radar.offseq.com/threat/cve-20

  • 2
  • 0
  • 0
  • 7h ago
Showing 1 to 10 of 47 CVEs