24h | 7d | 30d

CVE-2026-66747

Overview

  • Zbtlink
  • CPE2801 Firmware
05 Aug 2026
Published
05 Aug 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
Pending
KEV

Description

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root.

Statistics

  • 2 Posts
  • 9 Interactions
Last activity: 5 hours ago

Fediverse

Profile picture fallback
Caitlin Condon @catc0n

Today, VulnCheck is disclosing , a phone-home implant CTO @albinolobster discovered in Zbtlink routers. ENDLESSDOORS starts automatically, runs with root privileges, and attempts to connect to command-and-control infrastructure roughly every 35 seconds. The backdoor ships by default across 20+ Zbtlink router models, which are white-labeled and sold on popular retail sites including Amazon, AliExpress, and Alibaba.

The implant and server implement no encryption or verification, meaning anyone along the network path can hijack the client-server communication and obtain a root shell on the device, regardless of the router's network position.

The VulnCheck CNA has assigned CVE-2026-66747 to track backdoored firmware versions; our blog also has guidance for defenders, including affected firmware images, hashes, network indicators, a YARA rule, and network signatures (Suricata / Snort).

vulncheck.com/blog/zbt-endless

  • 4
  • 3
  • 0
  • 13h ago
Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-66747 - Critical RCE via hidden ENDLESSDOORS implant in Zbtlink routers. Backdoor runs as root, phones home over cleartext. CVSS 9.8. Unpatched. Isolate devices now. #CVE #infosec #IoT

valtersit.com/cve/CVE-2026-667

  • 1
  • 1
  • 0
  • 5h ago

CVE-2026-18556

Overview

  • N-able
  • N-central
01 Aug 2026
Published
05 Aug 2026
Updated
CVSS v4.0
HIGH (8.2)
EPSS
0.49%
KEV

Description

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Statistics

  • 3 Posts
  • 1 Interaction
Last activity: 6 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

CISA added three bugs to its KEV list. An N-able N-central authentication bypass is exploited in the wild to deploy RMM tools. Patch by August 7.

securityonline.info/n-able-n-c

  • 1
  • 0
  • 0
  • 22h ago
Profile picture fallback
Michael I Ransier @thecybermind

🚨 CISA KEV ALERT: CVE-2026-18556 exposes N-able N-central installations to authentication bypass via alternate channel paths. Active exploitation confirmed. Get the forensic breakdown, Splunk/KQL/Chronicle detection logic, and hardening guidance now: thecybermind.co/radr

  • 0
  • 0
  • 0
  • 6h ago

Bluesky

Profile picture fallback
キタきつね @kitafox.bsky.social
CISAが既知の悪用された脆弱性3件をカタログに追加 CISA Adds Three Known Exploited Vulnerabilities to Catalog #CISA (Aug 4) CVE-2026-9198 IBM Langflow コードインジェクションの脆弱性 CVE-2026-18556 N-able N-central認証バイパス（代替パスまたはチャネルの使用）の脆弱性 CVE-2026-34486 Apache Tomcatにおける機密データの暗号化の欠落の脆弱性 www.cisa.gov/news-events/...
  • 0
  • 0
  • 0
  • 20h ago

CVE-2026-58048

Overview

  • WebPros
  • cPanel
31 Jul 2026
Published
01 Aug 2026
Updated
CVSS v4.0
CRITICAL (9.4)
EPSS
0.50%
KEV

Description

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 11 hours ago

Bluesky

Profile picture fallback
Modat @modat-io.bsky.social
CVE-2026-58048 (CVSS 9.4): cPanel & WHM DB privilege-escalation flaw lets an authenticated MySQL user run SQL as database root, risking OS-level compromise. Affects all versions + WP Squared. Patch now. Query: technology="cPanel" or web.title~"WP Squared Login" or web.headers~"whostmgrrelogin"
  • 0
  • 1
  • 0
  • 11h ago
Profile picture fallback
キタきつね @kitafox.bsky.social
CVE-2026-58048: cPanelのバグにより、データベース管理者へのフルアクセスが可能になる CVE-2026-58048: cPanel Bug Enables Full Database Administrator Access #SecurityAffairs (Aug 4) securityaffairs.com/196595/secur...
  • 0
  • 0
  • 0
  • 20h ago

CVE-2026-64531

Overview

  • Linux
  • Linux
27 Jul 2026
Published
05 Aug 2026
Updated
CVSS v3.1
HIGH (7.8)
EPSS
0.13%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.

Statistics

  • 2 Posts
Last activity: 8 hours ago

Fediverse

Profile picture fallback
The CyberSec Guru @guru

OVSwrap (CVE-2026-64531): How a 13-Year-Old Open vSwitch Bug Became a Reliable Linux Root Exploit

OVSwrap (CVE-2026-64531) is a Linux kernel privilege escalation flaw affecting Open vSwitch. Explore the vulnerability, exploit chain and more

thecybersecguru.com/news/ovswr

  • 0
  • 0
  • 0
  • 8h ago

Bluesky

Profile picture fallback
AlexSa @netalexx.bsky.social
OVSwrap (CVE-2026-64531, CVSS 7.8) lets an ordinary local user reach root through the Linux Open vSwitch datapath on most default distros.
  • 0
  • 0
  • 0
  • 8h ago

CVE-2026-34486

Overview

  • Apache Software Foundation
  • Apache Tomcat
09 Apr 2026
Published
05 Aug 2026
Updated
CVSS
Pending
EPSS
81.16%
KEV

Description

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Statistics

  • 2 Posts
Last activity: 12 hours ago

Fediverse

Profile picture fallback
Michael I Ransier @thecybermind

🚨 CISA KEV ALERT: CVE-2026-34486 exposes Apache Tomcat installations to EncryptInterceptor bypasses and data interception. Active exploitation confirmed. Get the forensic breakdown, Splunk/KQL/Chronicle detection queries, and hardening steps: thecybermind.co/it1p

Top-of-the-Line LinkedIn Post

  • 0
  • 0
  • 0
  • 12h ago

Bluesky

Profile picture fallback
キタきつね @kitafox.bsky.social
CISAが既知の悪用された脆弱性3件をカタログに追加 CISA Adds Three Known Exploited Vulnerabilities to Catalog #CISA (Aug 4) CVE-2026-9198 IBM Langflow コードインジェクションの脆弱性 CVE-2026-18556 N-able N-central認証バイパス（代替パスまたはチャネルの使用）の脆弱性 CVE-2026-34486 Apache Tomcatにおける機密データの暗号化の欠落の脆弱性 www.cisa.gov/news-events/...
  • 0
  • 0
  • 0
  • 20h ago

CVE-2026-15307

Overview

  • djangoproject
  • Django
  • django
04 Aug 2026
Published
05 Aug 2026
Updated
CVSS
Pending
EPSS
0.54%
KEV

Description

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.

Statistics

  • 1 Post
  • 4 Interactions
Last activity: 21 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

A high-severity Django vulnerability, CVE-2026-15307, can enable remote code execution through spatial lookups. Update to Django 6.0.8 or 5.2.17 now.

securityonline.info/django-vul

  • 3
  • 1
  • 0
  • 21h ago

CVE-2026-64560

Overview

  • Linux
  • Linux
29 Jul 2026
Published
05 Aug 2026
Updated
CVSS v3.1
HIGH (7.8)
EPSS
0.12%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release_task(old_leader) __exit_signal(old_leader) sighand = lock(old_leader, sighand); posix_cpu_timers*_exit(); sighand = lock_task_sighand(p) unhash_task(old_leader); sh = lock(p, sighand) old_leader->sighand = NULL; unlock(sighand); (p->sighand == NULL) unlock(sh) return NULL; // Returns without action if(!sighand) return 0; free_posix_timer(); This is "harmless" unless the deleted timer was armed and enqueued in p->signal because on exec() a TGID targeted timer is inherited. As sys_timer_delete() freed the underlying posix timer object run_posix_cpu_timers() or any timerqueue related add/delete operations on other timers will access the freed object's timerqueue node, which results in an UAF. There is a similar problem vs. posix_cpu_timer_set(). For regular posix timers it just transiently returns -ESRCH to user space, but for the use case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is allocated on the stack. Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops to expire. While debating solutions Frederic pointed out another problem: posix_cpu_timer_del(tmr) __exit_signal(p) posix_cpu_timers*_exit(p); unhash_task(p); p->sighand = NULL; sh = lock_task_sighand(p) sighand = p->sighand; if (!sighand) return NULL; lock(sighand); if (!sh) WARN_ON_ONCE(timer_queued(tmr)); On weakly ordered architectures it is not guaranteed that posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit() when p->sighand is observed as NULL, which means the WARN() can be a false positive. Solve these issues by: 1) Changing the store in __exit_signal() to smp_store_release(). 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path of lock_task_sighand(). 3) Creating a helper function for looking up the task and locking sighand which does not return when sighand == NULL. Instead it retries the task lookup and only if that fails it gives up. 4) Using that helper in the three affected functions. #1/#2 ensures that the reader side which observes sighand == NULL also observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit() and the ones in unhash_task(). #3 ensures that the above described non-leader exec() situation is handled gracefully. When the task lookup returns the old leader, but sighand == NULL then it retries. In the non-leader exec() case the subsequent task lookup will observe the new leader due to #1/#2. In normal exit() scenarios the subsequent lookup fails. When the task lookup fails, the function also checks whether the timer is still enqueued and issues a warning if that's the case. Unfortunately there is nothing which can be done about it, but as the task is already not longer visible the timer should not be accessed anymore. This check also requires memory ordering, which is not provided when the first lookup fails. To achieve that the check is preceeded by a smp_rmb() which pairs with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that the stores in posix_cpu_timers*_exit() are visible. The history of the non-leader exec() issue goes back to the early days of posix CPU timers, which stored a pointer to the group leader task in the timer. That obviously fails when a non-leader exec() switches the leader. commit e0a70217107e ("posix-cpu-timers: workaround to suppress the problems with mt exec") added a temporary workaround for that in 2010 which surv ---truncated---

Statistics

  • 1 Post
  • 3 Interactions
Last activity: 13 hours ago

Fediverse

Profile picture fallback
linuxwebzine @linuxwebzine

🚨 Tails 7.10.1: Actualizare de urgență pentru rezolvarea unor vulnerabilități critice în kernel-ul Linux și biblioteca Expat! Proiectul Tails (The Amnesic Incognito Live System) a lansat versiunea 7.10.1, o actualizare de securitate critică destinată protejării sistemului împotriva atacurilor ce ar putea duce la de-anonimizarea utilizatorilor. ✨ Principalele remedieri și noutăți din versiunea 7.10.1:🔒 Patch de securitate pentru Kernel-ul Linux (v6.12.100):• Rezolvă vulnerabilitatea CVE-2026-64560. O pagină web răuvoitoare ar fi putut exploata această breșă prin intermediul Tor Browser pentru a obține privilegii de administrator (root), preluând controlul asupra sesiunii și deconspirând identitatea utilizatorului. 🛡️ Actualizare pentru biblioteca Expat (v2.8.2):• Adresează vulnerabilitățile din librăria de analiză XML (Expat) conform avizului Debian DSA-6404-1. Acestea puteau fi exploatate la deschiderea unor fișiere malițios concepute în aplicații precum LibreOffice, Audacity sau Git. ⚡ Actualizări mai rapide cu Zstandard (zstd):• Procesul de actualizare automată folosește acum compresia Zstandard, ceea ce îmbunătățește considerabil viteza de pornire în timpul aplicării update-urilor. 📉 Imagine mai mică și consum redus de date:• Prin eliminarea unor pachete de firmware neutilizate, dimensiunea imaginii ISO/USB și a pachetelor de actualizare automată a fost redusă cu aproximativ 70 MB. ⚠️ Recomandare: Echipa Tails le recomandă tuturor utilizatorilor să efectueze imediate upgrade-uri (automate sau manuale) la versiunea 7.10.1 pentru a rămâne protejați. #Tails #TailsOS #Linux #TorNetwork #CyberSecurity #Privacy #Debian #OpenSource #TechNews #FOSS

  • 1
  • 2
  • 0
  • 13h ago

CVE-2026-17566

Overview

  • pgadmin.org
  • pgAdmin 4
31 Jul 2026
Published
01 Aug 2026
Updated
CVSS v3.1
CRITICAL (9.9)
EPSS
0.43%
KEV

Description

pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, gated only by the ordinary, commonly-granted tools_import_export_data permission) validated the query with a hand-written parenthesis-balance checker, _is_query_parens_balanced(). That checker always treated a backslash before a single quote (\') as escaping the quote, i.e. as if standard_conforming_strings were off. PostgreSQL has defaulted standard_conforming_strings to on since 9.1 (2010), the default on every PostgreSQL version pgAdmin 4 currently supports (13-18); under that default psql's own \copy tokenizer treats \ as an ordinary character, so a single quote immediately after it closes the string literal. A query such as SELECT 'a\') TO PROGRAM 'echo pwned' x' was therefore accepted as "balanced" by pgAdmin's checker (which believed the ) was still inside the string), while psql, run through the actual rendered command line, closes the string at that point and treats the following ) as the end of the wrapping \copy (...) subquery, exposing an attacker-chosen TO PROGRAM '<command>' clause that psql executes via popen() -- independent of a subsequent syntax error later on the same line. This is the same class of bug as CVE-2025-12762/CVE-2025-13780 (RCE via psql meta-command/COPY injection during PLAIN-format dump restore), reached through an independently written defense in a different module (Import/Export Data rather than Restore) that had its own, different logic bug (inverted backslash-escape semantics rather than a BOM-defeated regex anchor). The fix rejects any backslash inside a single-quoted string in the query outright, rather than picking one of the two possible psql interpretations. This is intentionally conservative: because the correct interpretation of \ depends on the target server's standard_conforming_strings setting, which the checker cannot reliably know at validation time, refusing the query is safer than guessing. This issue affects pgAdmin 4: from the introduction of _is_query_parens_balanced() before 9.18.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 22 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

pgAdmin 4 RCE Flaw Leads Three Critical Fixes in Version 9.17

securityonline.info/pgadmin-4-

  • 0
  • 1
  • 0
  • 22h ago

CVE-2026-71206

Overview

  • go-shiori
  • shiori
05 Aug 2026
Published
05 Aug 2026
Updated
CVSS
Pending
EPSS
0.22%
KEV

Description

Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or demoting it from owner to a regular role has no effect on tokens already issued to that account — a deleted or demoted owner's token continues authenticating with its original owner-level privileges until natural expiry, which can be up to 30 days with 'remember me' enabled.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 12 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-71206 - Auth flaw in Shiori. Deleted/demoted users keep owner-level access via unrevoked JWT tokens. CVSS 8.3. No patch yet. Audit and rotate tokens immediately. #CVE #infosec #Shiori

valtersit.com/cve/CVE-2026-712

  • 0
  • 1
  • 0
  • 12h ago

CVE-2026-71269

Overview

  • node-red
  • node-red
05 Aug 2026
Published
05 Aug 2026
Updated
CVSS v3.1
HIGH (7.2)
EPSS
Pending
KEV

Description

Node-RED's local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the user-supplied path parameter directly into the filesystem path via fspath.join(libDir, type, path) with no traversal sanitization, containment check, or path normalization/prefix verification. An authenticated user (including read-only-scoped tokens for the read path) can supply a path containing `../` sequences to read arbitrary files outside the library directory; a user with write access can write arbitrary files, enabling remote code execution via SSH authorized_keys or cron injection. This is a distinct, separately unpatched traversal from the previously fixed CVE-2021-21298 (Projects API).

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 8 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-71269 - Path traversal in Node-RED local-filesystem library storage. Authenticated users can read/write arbitrary files via GET/POST /library endpoints. CVSS 7.2. Unpatched - restrict access and monitor. #CVE #NodeRED #infosec

valtersit.com/cve/CVE-2026-712

  • 0
  • 1
  • 0
  • 8h ago
Showing 1 to 10 of 53 CVEs