CVE-2026-124194

Overview

Microsoft
Microsoft 365 Apps for Enterprise

10 Nov 2026

Published

11 Nov 2026

Updated

CVSS v3.1

MEDIUM (6.5)

EPSS

1.62%

MITRE

KEV

Description

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

Statistics

11 Posts
3 Interactions

Last activity: 8 hours ago

Fediverse

windowsCult @windowscult

Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities, including an Outlook Zero-Day (CVE-2026-124194) that can leak a user’s NTLMv2 authentication hash to an attacker.

According to Microsoft’s advisory, an unauthenticated attacker can send a specially crafted message file and trick the recipient into opening it in Outlook. Opening the file can make Outlook connect to an attacker-controlled network location without showing the usual external-content warning. This connection can expose authentication information that an attacker could use to impersonate the victim.

#PatchTuesday #security #Microsoft

0
2
0
8h ago

🛡️ #1 hacks.gr @hacksgr

Microsoft released patches for 1,259 vulnerabilities across its software portfolio on November 11, 2026, marking the second consecutive month exceeding 1,000 flaws.

The total covers 726 Windows issues, 174 Office flaws, and several other components, bringing 2026 patches past 5,100 CVEs.

Notably, a moderate Outlook flaw (CVE-2026-124194) is actively exploited, allowing an attacker to trigger an unauthorized network connection…

https://en.hacks.gr/nea-diorthosi-apo-ti-microsoft-gia-provlima-sto-outlook-poy-chrisimopoieitai-se-epitheseis/

#Microsoft #Outlook #Vulnerability #Patch

0
1
0
14h ago

Ryan Daws 🤓 @gadgetry

1,259 vulnerabilities patched in November 2026, second consecutive month above 1,000, across Windows, Office, and SharePoint Server. CVE-2026-124194 (CVSS 6.5, Moderate) is already exploited. The unauthenticated Outlook flaw lets a crafted message file trigger a connection to an attacker-controlled location without warning, disclosing an NTLMv2 hash.

#CyberSecurity #Technology

0
0
0
13h ago

Mike | Raymond Tec @mike

Outlook Zero-Day, Railway's $740,000 AI Bill, and More https://raymondtec.com/2026/11/outlook-zero-day-railway-ai-bill-fedex-privacy/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief

An exploited Outlook flaw can expose Windows sign-in material, stolen AI keys cost Railway about $740,000, and FedEx's privacy fine shows why cookie controls must change real website behavior.

#TechNews #APIkeys #CaliforniaConsumerPrivacyAct #CVE2026124194 #FedEx #GlobalPrivacyControl #microsoft

0
0
0
11h ago

Bluesky

Cybersecurity News Everyday @hendryadrian.bsky.social

Microsoft addressed 1,093 vulnerabilities, including 63 critical flaws and an actively exploited Outlook spoofing zero-day (CVE-2026-124194). The roundup highlights priority Exchange, SharePoint, Outlook, Windows Search and LDAP flaws and urges prompt patching.

0
0
0
21h ago

ohhara @shiojiri.com

「この内 CVE-2026-124194 の脆弱性について、Microsoft 社では悪用の事実を確認済みと公表しており、今後被害が拡大するおそれがあるため、至急、セキュリティ更新プログラムを適用してください。」

0
0
0
18h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

Microsoft patched 1,094 vulnerabilities in its November 2026 updates and says an Outlook spoofing flaw, CVE-2026-124194, was exploited. The flaw could expose authentication information when a user opens a malicious file.

0
0
0
17h ago

CyberVeille @cyberveille-ch.bsky.social

📢 [VULN] Patch Tuesday Novembre 2026 – 1093 CVE - CVE-2026-124194 (faille Outlook exploitée) Le 10 novembre 2026, Microsoft corrige 1 093 vulnérabilités, son deuxième volume mensuel après le record d’octobre, dont une seule est exploitée : la CVE-2026-124194, une … #Vulnérabilité #CVE #Cyberveille

0
0
0
10h ago

WindowsPost @windowspost.com

Microsoft November 2026 Patch Tuesday Fixes 1,093 Vulnerabilities, including an Outlook Zero-Day (CVE-2026-124194) that can leak a user’s NTLMv2 authentication hash to an attacker. Read more: www.windowscult.com/microsoft-pa... #PatchTuesday #security #UpdateNews #Microsoft

0
0
0
8h ago

SANS.edu Internet Storm Center @sansisc.bsky.social

SANS Stormcast Wednesday, November 11th, 2026: Microsoft Patch Tuesday Outlook Spoofing (CVE-2026-124194); Apple Bluetooth and iMessage Fixes; SAP NetWeaver CVSS 10s (CVE-2026-89103) https://isc.sans.edu/podcastdetail/10174

0
0
0
21h ago

boredchilada @cyfar.ca

@talosintelligence.com Microsoft's November 2026 Patch Tuesday fixes 1,095 vulnerabilities, including 64 critical; Outlook spoofing flaw CVE-2026-124194 is exploited in the wild... - IOCs: CVE-2026-124194, CVE-2026-113862 - #ExploitedVulnerability #PatchTuesday #ThreatIntel #Vulnerability

0
0
0
19h ago

CVE-2026-119618

Overview

Apache Software Foundation
Apache HTTP Server

11 Nov 2026

Published

11 Nov 2026

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Statistics

5 Posts
28 Interactions

Last activity: 1 hour ago

Fediverse

IFIN - The Independent Federated Intelligence Network @ifin

Apache released patches for a critical vulnerability in Apache mod_http2. Very early in the cycle, but we're watching for patch availability and potential exploitation.

https://ifin.network/t/cve-2026-119618-rce-and-denial-of-service-in-apache-mod-http2/980

#ThreatIntel #ThreatIntelligence

13
12
0
3h ago

Frehi @frehi

Guess I'll urgently disable http/2 on all my web servers. *sighs*

https://ifin.network/t/cve-2026-119618-rce-and-denial-of-service-in-apache-mod-http2/980

#apache

1
1
0
3h ago

Daily CyberSecurity @DailyCyberSecurity

Update Apache HTTP Server to 2.4.71 now to fix CVE-2026-119618, a critical mod_http2 remote code execution flaw, alongside CVE-2026-106023.

#Apache #ApacheHTTPServer #WebSecurity #Cybersecurity #InfoSec

https://securityonline.info/apache-http-server-cve-2026-119618-rce-fixed/?utm_source=mastodon&utm_medium=jetpack_social

1
0
0
8h ago

Bluesky

Hacker News 20 @betterhn20.e-work.xyz

CVE-2026-119618 (critical): mod_HTTP2: heap corruption and RCE in assign_headers https://httpd.apache.org/security/vulnerabilities_24.html (https://news.ycombinator.com/item?id=50453368)

0
0
0
1h ago

OMO @omo.bsky.social

Apache HTTP Serverの脆弱性(Critical: CVE-2026-119618, Important: CVE-2026-106023, Low: CVE-2026-109163)と2.4.71リリース #sios_tech #security #vulnerability #セキュリティ #脆弱性 #apache security.sios.jp/vulnerabilit...

0
0
0
1h ago

CVE-2026-125350

Overview

Google
Chrome

10 Nov 2026

Published

11 Nov 2026

Updated

CVSS

Pending

EPSS

0.96%

MITRE

KEV

Description

Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Statistics

4 Posts

Last activity: 3 hours ago

Fediverse

Trinacriatech @trinacriatech

Chrome, zero-day sfruttata in the wild: CVE-2026-125350, use-after-free nel componente XML. Google conferma che esiste un exploit, senza dettagli su attori o modalità. CISA l'ha aggiunta alla KEV il 10/11 (scadenza FCEB 24/11).

Fix: 157.0.8103.50/.51 su Windows e macOS, 157.0.8103.50 su Linux; serve il riavvio del browser. Edge, Brave, Opera e Vivaldi: aggiornare appena il fix è disponibile. Ottava zero-day di Chrome sfruttata nel 2026.

https://thehackernews.com/2026/11/google-issues-chrome-security-update.html

#Chrome #infosec #KEV

0
0
0
14h ago

Bluesky

NEWSTECNICAS | Tecnología @newstecnicas.com

🛡️ #Alerta Zero-Day CVE-2026-125350 en #GoogleChrome: Guía Técnica de Mitigación y Actualización a #Chrome157 www.newstecnicas.com/2026/11/aler...

0
0
0
12h ago

Best of r/cybersecurity @cybersecurity.page

Google shipped an emergency Chrome update for CVE-2026-125350, a high-severity use-after-free in the browser's XML component that has an exploit in the wild. Attackers and victims are unnamed. It is the eighth Chrome zero-day patched this year. Update via Help, About Google Chrome, then restart.

0
0
0
6h ago

Packet Storm News @packetstorm.bsky.social

CVE-2026-125350: Google Fixes Exploited Chrome XML Zero-Day https://packetstorm.news/news/view/47781 #news

0
0
0
3h ago

CVE-2026-20320

Overview

Cisco
Cisco BroadWorks

19 Aug 2026

Published

11 Nov 2026

Updated

CVSS v3.1

HIGH (7.5)

EPSS

0.82%

MITRE

KEV

Description

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.

Statistics

5 Posts

Last activity: 10 hours ago

Fediverse

ekiledjian @edwardk

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

CISA has added two security flaws affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation despite patches being available. The flaws include CVE-2026-20320, an improper restriction of XML external entity references in Cisco BroadWorks. https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html

0
0
0
13h ago

@ssvc

An open directory exposed the live workspace of an autonomous AI intrusion harness: ~70 session transcripts of a jailbroken DeepSeek agent running two weeks of autonomous attacks, directed by a Chinese-speaking operator, against a European telecoms provider and thirteen organizations hosted on its infrastructure.

CISA likely added CVE-2026-20320 to the KEV Catalog due to the exploitation evidence here.

h/t: @serghei

https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign

#threatintel #china #cyberespionage #IOC

0
0
0
10h ago

🛡️ #1 hacks.gr @hacksgr

The U.S.

CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-20320 in Cisco BroadWorks and CVE-2026-111793 in Openwave Messaging.

The Cisco issue allows unauthorized reading of sensitive settings, while the Openwave flaw permits document processing manipulation.

FCEB agencies are required to apply patches by November 24, 2026.

While the patches for these issues were rele…

https://en.hacks.gr/i-cisa-proeidopoiei-gia-kena-asfaleias-se-systimata-cisco-kai-openwave/

#Cisco #Openwave #CVE_2026_20320 #CVE_2026_111793

0
0
0
16h ago

Bluesky

Calimeg @calimegai.bsky.social

CISA : failles #Cisco BroadWorks et #Openwave Webtop Transcoder, exploitées malgré des correctifs. CVE-2026-20320 (CVSS 7.5) — mauvaise restriction d'entité XML externe. 🔒 thehackernews.com/2026/11/cisc...

0
0
0
15h ago

boredchilada @cyfar.ca

~Cisa~ CISA added six actively exploited vulnerabilities to its KEV Catalog, including Cisco BroadWorks XXE, Barracuda ESG auth bypass, and a Chromium... - IOCs: CVE-2026-20320, CVE-2026-111560 - #ExploitedVulnerability #PatchManagement #ThreatIntel #VulnerabilityManagement

0
0
0
19h ago

CVE-2026-111560

Overview

Barracuda Networks
Barracuda Email Security Gateway (ESG)

02 Nov 2026

Published

11 Nov 2026

Updated

CVSS v4.0

HIGH (8.6)

EPSS

6.20%

MITRE

KEV

Description

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

Statistics

6 Posts
2 Interactions

Last activity: 6 hours ago

Fediverse

ekiledjian @edwardk

Hackers now exploit critical Barracuda ESG flaws to gain root access

Barracuda Networks has warned that attackers have begun exploiting two recently patched Email Security Gateway vulnerabilities that let them run commands with root privileges. One of the flaws, CVE-2026-111560, has also been added to CISA’s Known Exploited Vulnerabilities catalog. https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/

0
0
0
13h ago

Michael I Ransier @thecybermind

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-111560 – Barracuda Networks Multiple Products OS Command Injection Vulnerability

Actionable threat intelligence on CVE-2026-111560 targeting Barracuda products, featuring verified detection queries and endpoint hardening guidance....

https://thecybermind.co/psgq

0
0
0
11h ago

Michael I Ransier @thecybermind

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-111560 – Barracuda Networks Multiple Products OS Command Injection Vulnerability

Executive risk and governance perspective on CVE-2026-111560, providing leadership with actionable compliance strategies, asset integrity audits, and boardroom oversight metrics....

https://thecybermind.co/kqxi

0
0
0
11h ago

Christoph Schmees @PC_Fluesterer

Barracuda Email Security Gateway wird angegriffen

Wozu installiert man eine Appliance, die vor bösen E-Mails schützen soll? Sicher nicht, damit sie selber zum Einfallstor für Angriffe wird. Aber genau das passiert mit schöner Regelmäßigkeit; einige meiner Meldungen dazu habe ich unten aufgelistet. Diesmal ist das Email Security Gateway (ESG) der - amerikanischen - Firma Barracuda der Hauptdarsteller. Darin wurden zwei gefährliche Sicherheitslücken gefunden: CVE-2026-116606 (9,3 von 10) und CVE-2026-111560 (8,6 von 10). Wer die beiden kombiniert, kann damit die komplette Kontrolle über die Appliance erlangen. Das passiert bereits: Beide Lücken wurden und werden ... Weiterlesen:

https://www.pc-fluesterer.info/wordpress/2026/11/11/barracuda-email-security-gateway-wird-angegriffen/

#zeroday #closedsource #cybercrime #email #exploits #firewall #UnplugTrump #wissen

1
1
0
6h ago

Bluesky

boredchilada @cyfar.ca

~Cisa~ CISA added six actively exploited vulnerabilities to its KEV Catalog, including Cisco BroadWorks XXE, Barracuda ESG auth bypass, and a Chromium... - IOCs: CVE-2026-20320, CVE-2026-111560 - #ExploitedVulnerability #PatchManagement #ThreatIntel #VulnerabilityManagement

0
0
0
19h ago

Undercode Testing @undercode.bsky.social

Chaining CVE-2026-116606 and CVE-2026-111560: Threat Actors Target Barracuda Appliances for Unauthenticated Root RCE + Video Introduction: Threat actors are actively weaponizing a zero-day exploit chain targeting exposed Barracuda enterprise appliances. By chaining an authentication bypass flaw in…

0
0
0
13h ago

CVE-2026-105437

Overview

Git
Git

10 Nov 2026

Published

10 Nov 2026

Updated

CVSS v3.1

HIGH (7.5)

EPSS

0.40%

MITRE

KEV

Description

Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. That total was kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed .gitattributes file, accepts any positive integer, and the markers are written several times for every conflict. A small file with a huge marker size and many separate conflicts can therefore push the total past 4 GiB, so the integer wraps to a small value and Git writes attacker-controlled merge output past the end of a buffer that is too small. At minimum this crashes Git, and because the overflow is large and its contents are largely attacker-controlled, worse heap corruption is possible. Any command that does a textual three-way merge can trigger it, such as git-merge(1), git-rebase(1), git-cherry-pick(1), and git-merge-tree(1). The latter is most likely a target for Git forges, which might use git-merge-tree(1) on the server-side to check mergeability. When the server reads attributes from trees in the repository (for example through attr.tree or --attr-source), any user who can push branches and request that they be merged (for example by opening a pull or merge request) can trigger the overflow without anyone else doing anything, and the data they push is small because the oversized output only appears during the merge. The problem has been patched by computing the size as size_t and checking every addition for overflow, so Git stops with an error instead of overflowing. Servers that cannot upgrade right away can add * conflict-marker-size=7 to each repository's info/attributes as a workaround, which overrides any in-tree .gitattributes, or turn off server-side mergeability checks for untrusted repositories.

Statistics

3 Posts
3 Interactions

Last activity: 11 hours ago

Fediverse

wakest ⁂ @liaizon

new `git` CVE just dropped: might be good for @forgejo and @Codeberg to publish a statement

https://nvd.nist.gov/vuln/detail/cve-2026-105437

1
1
0
11h ago

jaKa Močnik @jkmcnk

black background, red text, scroll to reveal merge2shell website in 3, 2, 1 ... https://nvd.nist.gov/vuln/detail/cve-2026-105437

0
1
0
13h ago

Bluesky

セキュリティ対策Lab @securitylab-jp.bsky.social

GitLabに重大脆弱性CVE-2026-105437、Gitalyで任意コマンド実行の恐れ　19.5.4・19.4.6・19.3.8で修正 rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース

0
0
0
19h ago

CVE-2026-123158

Overview

OpenBSD
OpenSSH

05 Nov 2026

Published

10 Nov 2026

Updated

CVSS v3.1

HIGH (8.1)

EPSS

18.90%

MITRE

KEV

Description

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

Statistics

3 Posts
1 Interaction

Last activity: 9 hours ago

Fediverse

Patch or Pass @PatchOrPass

Alpine box with SSH open? SSHole (CVE-2026-123158, CISA KEV) lets an attacker in with one long password on sshd built without PAM. Run apk upgrade -U -a and restart sshd, or set PasswordAuthentication no.

Also: SonicWall's SAML/MFA bypass, Plex2Shell on QNAP, and an Outlook zero-day now in KEV. GPUStack and FreeSWITCH have fixes; CISA confirmed both exploited this week.

https://patchorpass.beehiiv.com/?utm_source=mastodon&utm_medium=social&utm_campaign=issue-4

#infosec #homelab #linux

1
0
0
9h ago

Bluesky

ohhara @shiojiri.com

OpenSSH認証バイパス脆弱性「sshole (CVE-2026-123158)」徹底解説、10年間見落とされた盲点と即時攻撃の防衛策について – TechHarmony https://blog.usize-tech.com/zeronetworks-openssh-sshole-cve-2026-123158/

0
0
0
15h ago

r/blueteamsec bot @r-blueteamsec.bsky.social

CVE-2026-123158_sshole_lab: Secure-coding laboratory: Docker reproduction of CVE-2026-123158 (sshole)

0
0
0
9h ago

CVE-2026-126187

Overview

react
react

10 Nov 2026

Published

10 Nov 2026

Updated

CVSS v4.0

CRITICAL (9.5)

EPSS

1.76%

MITRE

KEV

Description

React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.

Statistics

3 Posts
1 Interaction

Last activity: 3 hours ago

Fediverse

Daily CyberSecurity @DailyCyberSecurity

Update React Server Components to version 19.3.1 now to fix CVE-2026-126187, a critical 9.5 CVSS unauthenticated remote code execution vulnerability.

#React #ReactServerComponents #WebSecurity #Cybersecurity #InfoSec

https://meterpreter.org/react-server-components-cve-2026-126187-rce-fixed/?utm_source=mastodon&utm_medium=jetpack_social

1
0
0
16h ago

The CyberSec Guru @guru

React Server Components Just Got an Unauthenticated RCE: Breaking Down CVE-2026-126187

CVE-2026-126187 is a 9.5 CVSS unauthenticated RCE in React Server Components. See how a detached buffer and forged thenable break Next.js Cache Components

https://thecybersecguru.com/exploits/cve-2026-126187-react-flight-rce/

0
0
0
6h ago

Bluesky

andregironda.bsky.social @andregironda.bsky.social

React Server ComponentsにCVSS 9.5の認証不要RCE脆弱性CVE-2026-126187。修正版4系統を公開 joho-todai.com/react-server...

0
0
0
3h ago

CVE-2025-62861

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

3 Posts
2 Interactions

Last activity: 3 hours ago

Bluesky

Poster | Crypto News @cryptonews-poster.bsky.social

Bitcoin Core vulnerability (CVE-2025-62861) patched! Affects versions 28.0-28.2 & 29.0-29.1. Flaw in TRUC logic could block node block creation. Fix released in v30.0 & backported. Discovered by Niklas Goegge. Security maintained! #Bitcoin #Security

0
1
0
20h ago

Blockchain Report @blockchainreport.bsky.social

Bitcoin Core critical vulnerability (CVE-2025-62861) affecting miners patched. Affected versions (28.x, 29.x) had mempool issues during chain reorgs, causing block template validation failures. Miners had to restart nodes. Resolved in v30.0+ (Oct 2025). Affected versions are EOL.

0
1
0
20h ago

Cosmic Meta AI @cosmicmeta.ai

Bitcoin Core Mining Bug Could Stall Mining; Patch Available Bitcoin Core mining bug: a look at CVE-2025-62861 and its implications for operators... @thecosmicmeta.com https://thecosmicmeta.com/bitcoin-core-mining-bug-could-stall-mining-patch-available?utm_source=cosmicmeta&utm_medium=bluesky

0
0
0
3h ago

CVE-2026-111760

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

4 Posts
14 Interactions

Last activity: 13 hours ago

Fediverse

ekiledjian @edwardk

Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

A flaw in Git can let a malicious repository run an attacker’s code on a computer that clones it recursively, together with its submodules. The Git project fixed the flaw, tracked as CVE-2026-111760 and caused by an integer truncation in how Git handles its index, in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series. https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html

0
0
0
13h ago

Veit Schiele @veit

Update Git! Version 2.56.1 patches several security vulnerabilities, including CVE-2026-111760: Code execution during recursive clones and CVE-2026-113408: Path traversal through a server’s advertised HEAD
https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/
#Git #ITSec #DevOps

9
4
1
16h ago

Bluesky

Tech-News @technology-news.bsky.social

Git fixes six flaws, including CVE-2026-111760, which lets malicious repositories execute code during recursive clones via submodule hooks.

0
1
0
23h ago

Quick check

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky

Overview

Description

Statistics

Fediverse

React Server Components Just Got an Unauthenticated RCE: Breaking Down CVE-2026-126187

Bluesky

Overview

Description

Statistics

Bluesky

Overview

Description

Statistics

Fediverse

Bluesky