CVE-2026-18577

Overview

N-able
N-central

02 Aug 2026

Published

03 Aug 2026

Updated

CVSS v4.0

HIGH (8.2)

EPSS

1.48%

MITRE

KEV

Description

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

Statistics

5 Posts
17 Interactions

Last activity: 2 hours ago

Fediverse

Harry Sintonen @harrysintonen

Some time ago I discovered a meddler in the middle vulnerability between N-able agent and nCentral server that allowed full SYSTEM compromise of the endpoints, but this vulnerability in nCentral server is far far far worse:

https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/

#nablencentral #CVE_2026_18577 #infosec #cybersecurity

5
5
0
9h ago

Daily CyberSecurity @DailyCyberSecurity

CVE-2026-18577 is being exploited in the wild for N-central account takeover. An incomplete patch let attackers gain admin access. Update to 2026.3.1.7.

#Nable #Ncentral #CVE202618577 #AccountTakeover #RMM #CyberSecurity

https://securityonline.info/cve-2026-18577-n-central-account-takeover/?utm_source=mastodon&utm_medium=jetpack_social

1
0
0
3h ago

Bluesky

BleepingComputer @bleepingcomputer.com

N-able is warning customers that hackers are exploiting an authentication bypass vulnerability (CVE-2026-18577) affecting both hosted and on-premises N-central servers.

2
2
0
2h ago

Information Security Briefly @infosecbriefly.bsky.social

CVE-2026-18577 enables authentication bypass in N-central, letting attackers take over accounts, gain admin access, and persist via Cloudflare tunnels.

1
0
0
7h ago

Help Net Security @helpnetsecurity.com

Attackers exploit N-able N-central flaw to reach managed endpoints (CVE-2026-18577) 🔗 Read more: www.helpnetsecurity.com/2026/08/03/c... #vulnerability #remotemanagement #cybersecuritynews

1
0
0
5h ago

CVE-2026-66066

Overview

rails
rails

30 Jul 2026

Published

01 Aug 2026

Updated

CVSS v4.0

CRITICAL (9.5)

EPSS

1.70%

MITRE

KEV

Description

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Statistics

4 Posts

Last activity: 3 hours ago

Fediverse

CyberNetsecIO @netsecio

📰 Ruby on Rails Patches Critical RCE Flaw (CVE-2026-66066)

Ruby on Rails patches critical RCE vulnerability CVE-2026-66066 (CVSS 9.5). The flaw in Active Storage allows arbitrary file read via crafted image uploads, leading to potential RCE. Update immediately. #RubyOnRails #CVE #CyberSecurity

🔗 https://cyber.netsecops.io/articles/ruby-on-rails-patches-critical-rce-flaw-cve-2026-66066/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

0
0
0
3h ago

Bluesky

Help Net Security @helpnetsecurity.com

KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066) 📖 Read more: www.helpnetsecurity.com/2026/08/03/k... #securityupdate #tips #vulnerability #webapplicationsecurity #cybersecurity #cybersecuritynews @rubyonrails.org.web.brid.gy @ethiack.com

0
0
0
8h ago

CyberVeille @cyberveille-ch.bsky.social

📢 Ruby on Rails corrige une vulnérabilité critique RCE via lecture arbitraire de fichiers (CVE-2026-66066) 📰 Source : SecurityWeek, publié le 1er août 2026. L'article rapporte la publication de correctifs par les mainteneurs de Ruby… 🟡 vérification factuelle moyenne #RCE #RubyOnRails #Cyberveille

0
0
0
4h ago

CyberVeille @cyberveille-ch.bsky.social

📢 CVE-2026-66066 : faille critique dans Rails Active Storage avec potentiel RCE 📰 Source : BleepingComputer — publié le 1er août 2026 🔍 Contexte Les mainteneurs de Ruby on Rails ont publié un avis de sécurité concernant… 🟡 vérification factuelle moyenne #ActiveStorage #RCE #Cyberveille

0
0
0
3h ago

CVE-2026-42897

Overview

Microsoft
Microsoft Exchange Server 2016 Cumulative Update 23

14 May 2026

Published

19 Jun 2026

Updated

CVSS v3.1

HIGH (8.1)

EPSS

70.31%

MITRE

KEV

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Statistics

3 Posts
2 Interactions

Last activity: 3 hours ago

Fediverse

Cybersecurity & cyberwarfare @cybersecurity

Falla in Outlook: apri un’e-mail e ti infettano, non servono più link o allegati

@informatica
Il gruppo criminale filorusso TA488 sfrutta la CVE-2026-42897, falla XSS in Outlook Web Access, con un exploit half-click: basta aprire l'email per installare OWAReaper, una backdoor che sopravvive a reset password e reimaging. Colpiti enti

2
0
0
7h ago

CyberNetsecIO @netsecio

📰 Russian Group Midnight Blizzard Exploits Outlook XSS Flaw (CVE-2026-42897)

Russian actor Midnight Blizzard (Storm-2945) exploits Outlook XSS flaw CVE-2026-42897 to access mailboxes. Also hijacks hotel Wi-Fi in 'CaptiveCrunch' campaign to steal M365 tokens with CornFlake & ChocoShell malware. #ThreatIntel #APT

🔗 https://cyber.netsecops.io/articles/russian-hackers-exploit-outlook-flaw-in-widespread-campaign/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

0
0
0
3h ago

Bluesky

boredchilada @cyfar.ca

~Checkpoint~ Critical vulnerabilities in VMware, Cisco, and JetBrains are actively exploited alongside state-sponsored phishing and supply chain attacks. - IOCs: CVE-2026-59309, CVE-2026-20316, CVE-2026-42897 - #Phishing #ThreatIntel #Vulnerabilities

0
0
0
3h ago

CVE-2026-12935

Overview

TP-Link Systems Inc.
TL-WR940N v6

29 Jul 2026

Published

30 Jul 2026

Updated

CVSS v4.0

HIGH (8.7)

EPSS

0.81%

MITRE

KEV

Description

The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client initiates a connection to a malicious RTSP server controlled by an attacker. A specially crafted RTSP message may trigger improper memory handling within the kernel module Successful exploitation of this vulnerability may result in a denial-of-service (DoS) condition or allow remote code execution (RCE), potentially leading to full compromise of the device. This vulnerability can be exploited by an unauthenticated attacker under the device's default configuration.

Statistics

2 Posts
2 Interactions

Last activity: 14 hours ago

Fediverse

Daily CyberSecurity @DailyCyberSecurity

A TP-Link TL-WR940N flaw, CVE-2026-12935, allows unauthenticated remote code execution via an RTSP stack buffer overflow. Update the router firmware now.

#TPLink #TLWR940N #CVE202612935 #RCE #RouterSecurity #InfoSec

https://securityonline.info/tp-link-wr940n-cve-2026-12935/?utm_source=mastodon&utm_medium=jetpack_social

1
1
0
18h ago

Bluesky

キタきつね @kitafox.bsky.social

TP-Link TL-WR940N CVE-2026-12935 認証なしでのリモートコード実行を可能にする脆弱性 TP-Link TL-WR940N CVE-2026-12935 Allows Unauthenticated Remote Code Execution #DailyCyberSecurity (Aug 3) securityonline.info/tp-link-wr94...

0
0
0
14h ago

CVE-2026-18574

Overview

checkpoint
Security Management Server

03 Aug 2026

Published

03 Aug 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

Pending

MITRE

KEV

Description

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system. Check Point discovered this issue internally and has no indication of active exploitation.

Statistics

2 Posts
1 Interaction

Last activity: 3 hours ago

Fediverse

OffSequence @offseq

CRITICAL auth bypass (CVE-2026-18574, CVSS 9.3) affects Check Point Security Management Server & MDS. Remote attackers can execute commands w/o auth. No patch yet — restrict management access. https://radar.offseq.com/threat/cve-2026-18574-cwe-288-authentication-bypass-using-an-alternate-path-or-channel-in-checkpoint-security-b30ba167a9a0b365 #OffSeq #CVE202618574 #CheckPoint #Infosec 🔒

0
1
0
6h ago

Daily CyberSecurity @DailyCyberSecurity

CVE-2026-18574 is a Check Point authentication bypass rated CVSS 9.3, letting attackers run commands as admin. Patch via the latest Jumbo Hotfix.

#CheckPoint #CVE202618574 #AuthenticationBypass #SecurityManagement #CyberSecurity #Firewall

https://securityonline.info/cve-2026-18574-check-point-authentication-bypass/?utm_source=mastodon&utm_medium=jetpack_social

0
0
0
3h ago

CVE-2026-54121

Overview

Microsoft
Windows 10 Version 1607

14 Jul 2026

Published

30 Jul 2026

Updated

CVSS v3.1

HIGH (8.8)

EPSS

1.05%

MITRE

KEV

Description

Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

Statistics

2 Posts

Last activity: 3 hours ago

Fediverse

:hispagatos: :anarchohacker: @nothing

Certighost: cuando un usuario de dominio puede acabar obteniendo un certificado de un Domain Controller (CVE-2026-54121)

Si durante los últimos años ha habido una tecnología de Active Directory que ha pasado de ser la gran olvidada a convertirse en uno de los objetivos favoritos de Red Teams y atacantes reales, esa es Active Directory Certificate Services (AD CS). Desde la publicación de Certified Pre-Owned...

https://www.hackplayers.com/2026/07/certighost-cuando-un-usuario-de-dominio.html

0
0
0
7h ago

Bluesky

TugaTech @tugate.ch

Microsoft trava falha Certighost que entregava controlo total de redes corporativas. A Microsoft disponibilizou atualizações de segurança para corrigir a CVE-2026-54121, uma falha de gravidade alta no Active Directory Certificate Services (ADCS) que permitia a um utilizador com acessos básicos manip

0
0
0
3h ago

CVE-2026-48449

Overview

Adobe
Adobe Campaign Classic

30 Jul 2026

Published

03 Aug 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

0.54%

MITRE

KEV

Description

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Statistics

2 Posts

Last activity: 4 hours ago

Fediverse

Günter Born @gborn

Nutzt wer Adobe Campaign Classic (ACC) und hat noch nicht gepatcht? Zwei fette Sicherheitslücken (CVSS 3.x von 10.0 bei einer).

https://borncity.com/blog/2026/08/03/adobe-campaign-classic-schwachstelle-cve-2026-48449-cvss-3-x-10-0-gepatcht/

0
0
0
10h ago

Daily CyberSecurity @DailyCyberSecurity

Adobe fixes a CVSS 10 RCE in Campaign Classic (CVE-2026-48449) and eight critical flaws in Bridge. Update to build 9398 and Bridge 15.1.7 or 16.0.6 now.

#AdobeCampaign #CVE202648449 #AdobeBridge #CriticalPatch #RCE

https://securityexpress.info/adobe-campaign-classic-cvss-10-patch/?utm_source=mastodon&utm_medium=jetpack_social

0
0
0
4h ago

CVE-2026-20316

Overview

Cisco
Cisco Secure Firewall Management Center (FMC)

29 Jul 2026

Published

01 Aug 2026

Updated

CVSS v3.1

MEDIUM (5.3)

EPSS

0.79%

MITRE

KEV

Description

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.  Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.   Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.

Statistics

2 Posts

Last activity: 3 hours ago

Fediverse

CyberNetsecIO @netsecio

📰 CISA Warns of Actively Exploited Cisco Firewall Management Flaw

📢 CISA WARNING: A static credential flaw in Cisco Secure Firewall Management Center (CVE-2026-20316) is actively exploited. The flaw allows unauthorized access. CISA adds it to KEV catalog, mandating federal action. #CVE202620316 #Cisco #KEV

🔗 https://cyber.netsecops.io/articles/cisa-warns-of-actively-exploited-cisco-firewall-management-flaw/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

0
0
0
3h ago

Bluesky

boredchilada @cyfar.ca

~Checkpoint~ Critical vulnerabilities in VMware, Cisco, and JetBrains are actively exploited alongside state-sponsored phishing and supply chain attacks. - IOCs: CVE-2026-59309, CVE-2026-20316, CVE-2026-42897 - #Phishing #ThreatIntel #Vulnerabilities

0
0
0
3h ago

CVE-2026-67342

Overview

ArcadeData
arcadedb

01 Aug 2026

Published

03 Aug 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

0.32%

MITRE

KEV

Description

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

Statistics

1 Post
3 Interactions

Last activity: 7 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-67342 - Critical auth bypass in ArcadeDB HTTP endpoints. Attackers can access or modify unauthorized databases. CVSS 9.8. No patch yet, restrict exposure immediately. #CVE #ArcadeDB #infosec

https://www.valtersit.com/cve/CVE-2026-67342/

1
2
0
7h ago

CVE-2026-55111

Overview

Ubiquiti Inc
UniFi Protect Floodlight

02 Jul 2026

Published

02 Jul 2026

Updated

CVSS v3.1

HIGH (7.5)

EPSS

0.34%

MITRE

KEV

Description

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to access files on the UniFi Protect Floodlight.

Statistics

1 Post
2 Interactions

Last activity: 4 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-55111 - Path Traversal in UniFi Protect Floodlight exposes device files. CVSS 7.5. No patch yet, restrict network access now. #CVE #Ubiquiti #infosec

https://www.valtersit.com/cve/cve-2026-55111/

1
1
0
4h ago