24h | 7d | 30d

CVE-2026-19478

Overview

  • GitLab
  • GitLab
17 Aug 2026
Published
17 Aug 2026
Updated
CVSS v3.1
CRITICAL (9.4)
EPSS
0.72%
KEV

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

Statistics

  • 9 Posts
  • 7 Interactions
Last activity: 5 hours ago

Fediverse

Profile picture fallback
Glen T, heated, not stirred @glent

If you're using on-prem Gitlab then you need to patch for CVE-2026-19478. One of those situations where patching first and testing second is justified.

docs.gitlab.com/releases/patch

  • 3
  • 2
  • 0
  • 23h ago
Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-19478 - Critical unauthenticated data tampering in GitLab CE/EE. Remote modify/delete of public projects via GraphQL. CVSS 9.4. No patch yet. Harden access & monitor. #CVE #GitLab #infosec

valtersit.com/cve/CVE-2026-194

  • 0
  • 1
  • 0
  • 22h ago
Profile picture fallback
DragonJAR @dragonjar

Las últimas 24 horas en seguridad informática revelan una grave falla en GitLab que permitía borrar proyectos públicos sin autenticación, vulnerabilidades críticas en sanitización web con DOMPurify, riesgos internos por accesos activos a exempleados, sofisticados ataques hardware en Windows 11 y soluciones SASE para proteger IA y redes. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:

🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 18/08/26 📆 |====

🔍 INVESTIGACIÓN DE VULNERABILIDADES EN IA

Únete a una comunidad activa en Discord dedicada a la investigación en seguridad aplicada a modelos de lenguaje (LLMs). Aquí se comparten técnicas avanzadas de bug bounty, red teaming y herramientas para escaneo automático, ideales para profesionales que buscan innovar en la protección contra amenazas basadas en inteligencia artificial. Descubre más sobre esta red especializada en seguridad IA 👉 djar.co/wxUdaF

⚠️ GRAVE FALLA EN GITLAB GRAPHQL PUEDE PERMITIR BORRADO DE PROYECTOS PÚBLICOS

GitLab ha parcheado la vulnerabilidad CVE-2026-19478, con una puntuación CVSS de 9.4, que exponía a proyectos públicos a modificaciones o eliminaciones sin necesidad de autenticación. Esta falla en su API GraphQL resalta la importancia crítica de mantener actualizadas las plataformas colaborativas para evitar interrupciones y pérdidas de información. Infórmate sobre esta alerta y cómo proteger tus proyectos 👉 djar.co/AbJK

🔐 PELIGRO DE CUENTAS ACTIVAS DE EXEMPLEADOS EN SEGURIDAD CORPORATIVA

El mantenimiento de accesos para exempleados representa un riesgo considerable: facilita fraudes, fugas de datos y ataques internos. Este problema común en empresas requiere procesos rigurosos de desactivación y auditoría constante para evitar brechas que comprometan información sensible. Aprende las mejores prácticas para mitigar esta amenaza interna 👉 djar.co/NqXQcu

☁️ CLOUD FLARE ONE: LA PLATAFORMA SASE PARA PROTEGER IA Y REDES

Cloudflare One ofrece una solución integral SASE (Secure Access Service Edge) que centraliza la seguridad y conectividad para equipos, agentes de inteligencia artificial e infraestructura. Su arquitectura de confianza cero facilita una adopción segura y eficiente en entornos híbridos y en la nube, clave para organizaciones que integran IA en sus operaciones. Conoce cómo esta plataforma puede fortalecer tu seguridad TI 👉 djar.co/0Wizt1

🛡️ VULNERABILIDAD EN DOMPURIFY PERMITE BYPASS EN SAFARI

Una falla en DOMPurify versión 3.2.6 y anteriores habilita un bypass de seguridad en navegadores Safari mediante el uso del elemento animateTransform de SMIL. DOMPurify es esencial para la sanitización de contenido en la web, por lo que esta vulnerabilidad puede abrir puertas a ataques XSS si no se parchea a tiempo. Descubre los detalles técnicos y recomendaciones para proteger tus aplicaciones 👉 djar.co/mLCdY

💻 SECUESTRO DE TABLAS IDT EN WINDOWS 11 MEDIANTE DATA ONLY GADGETS

Se ha demostrado que la técnica DOG (Data Only Gadgets) puede atacar la tabla IDT del procesador en Windows 11, una estructura crítica que controla la ejecución de instrucciones del CPU. Este avance en el secuestro de tablas del núcleo, que afecta mecanismos de seguridad como VBS, HVCI y kCET, subraya la constante evolución de las amenazas a nivel hardware y la necesidad de medidas avanzadas en defensa de sistemas operativos modernos. Profundiza en esta investigación y sus implicaciones 👉 djar.co/gRJVL

  • 0
  • 0
  • 0
  • 23h ago
Profile picture fallback
ThreatNoir @threatnoir

⚠️ CRITICAL: GitLab Patches Critical Code Injection Vulnerability

GitLab released patches for a critical unauthenticated code injection vulnerability (CVE-2026-19478, CVSS 9.4) in GraphQL directives that allows attackers to modify or delete user data and public projects. A secondary CSRF flaw (CVE-2026-19650) affects the GraphQL multiplex query handler. Versions…

threatnoir.com/focus

🤖 AI generated summary

  • 0
  • 0
  • 0
  • 18h ago

Bluesky

Profile picture fallback
Checkmarx Zero @checkmarxzero.bsky.social
Emergency patch time if you're managing your own #GitLab instance! Out of band patch was released for CVE-2026-19478 (CVSS=9.4), a code-injection vulnerability in GraphQL directive handling that can be exploited without authentication. Full advisory: buff.ly/zO3C6Bj #GitLab #DevSecOps
  • 0
  • 1
  • 0
  • 18h ago
Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 GitLab : patch critique corrigeant une injection de code via GraphQL (CVE-2026-19478, CVSS 9.4) Le 17 août 2026, GitLab a publié des versions correctives pour ses éditions Community (CE) et Enterprise (EE) : 19.2.4, 19.1.6, 19.0.8… 🟡 vérification factuelle moyenne #GitLab #GraphQL #Cyberveille
  • 0
  • 0
  • 0
  • 22h ago
Profile picture fallback
Help Net Security @helpnetsecurity.com
Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478) 🔗 Read more: www.helpnetsecurity.com/2026/08/18/g... #CVE #vulnerability #cybersecurity
  • 0
  • 0
  • 0
  • 22h ago
Profile picture fallback
キタきつね @kitafox.bsky.social
GitLabの重大な脆弱性により、攻撃者が公開プロジェクトを変更または削除できる（CVE-2026-19478） Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478) #HelpNetSecurity (Aug 18) www.helpnetsecurity.com/2026/08/18/g...
  • 0
  • 0
  • 0
  • 8h ago
Profile picture fallback
OpsMatters @opsmatters.com
The latest update for #CyCognito includes "Emerging Threat: (CVE-2026-19478) GitLab Unauthenticated Project Deletion via #GraphQL Directive" and "Emerging Threat: GeoServer Zero-Day SQL Injection via jsonArrayContains". #cybersecurity #AttackSurfaceManagement #EASM https://opsmtrs.com/44Srq0X
  • 0
  • 0
  • 0
  • 5h ago

CVE-2026-65400

Overview

  • Apple
  • macOS
06 Aug 2026
Published
19 Aug 2026
Updated
CVSS
Pending
EPSS
0.50%
KEV

Description

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

Statistics

  • 4 Posts
  • 11 Interactions
Last activity: 7 hours ago

Fediverse

Profile picture fallback
Christoph Schmees @PC_Fluesterer

Apple aktualisiert allerhand 2026-08

Wer jetzt denkt "ja klar, Apples Flickentag (gestern, 17.8.) bringt die Updates", irrt. Zumindest ist das nur die halbe Wahrheit. Apple hat nämlich bereits am 6.8. Updates für die drei noch gepflegten Versionen von macOS veröffentlicht (Sonoma 14.8.9; Sequoia 15.7.9; Tahoe 26.6.1). Diese schließen die Sicherheitslücke CVE-2026-65400 in der Funktion Screen Sharing (Bildschirmfreigabe für Fernzugriff) von macOS. Die ursprünglich mit dem Risiko 7,1 (von 10) bewertete Lücke wurde gerade auf 9,8 hoch gestuft, da inzwischen ein Exploit öffentlich verfügbar ist und die Lücke aktiv für Angriffe ausgenutzt wird. ... Weiterlesen:

pc-fluesterer.info/wordpress/2

#apple #browser #exploits #ios #macos #sicherheit #UnplugApple #UnplugTrump #webkit

  • 1
  • 0
  • 0
  • 21h ago
Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Attackers are exploiting CVE-2026-65400, a critical macOS Screen Sharing auth bypass, to gain root access and deploy Monero miners on Macs with exposed port 5900.

meterpreter.org/macos-screen-s

  • 0
  • 0
  • 0
  • 7h ago
Profile picture fallback
ThreatNoir @threatnoir

⚠️ CRITICAL: ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

Three critical vulnerabilities are under active exploitation: VMware vCenter (CVE-2026-59310) by China-nexus APT for potential ransomware deployment, Windows 0-day (CVE-2026-68820) by Lazarus Group targeting defense contractors with backdoors, and macOS flaw (CVE-2026-65400) distributing crypto min…

threatnoir.com/focus

🤖 AI generated summary

  • 0
  • 0
  • 0
  • 19h ago

Bluesky

Profile picture fallback
Microsoft Threat Intelligence @threatintel.microsoft.com
Microsoft Defender is monitoring the active exploitation of the CVE-2026-65400 improper authentication vulnerability on a limited number of macOS devices, with telemetry showing successful root account network sign-ins through Screen Sharing.
  • 3
  • 7
  • 0
  • 9h ago

CVE-2026-59310

Overview

  • VMware
  • Cloud Foundation
30 Jul 2026
Published
19 Aug 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
1.14%
KEV

Description

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

Statistics

  • 5 Posts
Last activity: 14 hours ago

Fediverse

Profile picture fallback
ThreatNoir @threatnoir

⚠️ CRITICAL: ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

Three critical vulnerabilities are under active exploitation: VMware vCenter (CVE-2026-59310) by China-nexus APT for potential ransomware deployment, Windows 0-day (CVE-2026-68820) by Lazarus Group targeting defense contractors with backdoors, and macOS flaw (CVE-2026-65400) distributing crypto min…

threatnoir.com/focus

🤖 AI generated summary

  • 0
  • 0
  • 0
  • 19h ago

Bluesky

Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 Exploitation active de CVE-2026-59310 : 361 victimes dans 47 pays via VMware vCenter Cet article documente une campagne d'exploitation active découverte lors d'un engagement de réponse à incident. La source est le… 🟢 vérification factuelle haute #VMwareVCenter #ExploitationActive #Cyberveille
  • 0
  • 0
  • 0
  • 22h ago
Profile picture fallback
曖昧ナ犬 @aimainainnu.bsky.social
ペット用品 通販 大手のチャーム 本店、不正アクセスによるサイバー攻撃で約23万件の個人情報漏洩の恐れ 合同会社ロケットボーイズ VMware vCenter Serverの重大な脆弱性CVE-2026-59310が、実際のサイバー攻撃で悪用されていることが確認されました。 Broadco… 記事を検索. 公式YouTube. ▷ ... rocket-boys.co.jp/security-mea...
  • 0
  • 0
  • 0
  • 22h ago
Profile picture fallback
二本松哲也 @nihonmatsu.bsky.social
【対策】BroadcomはVMSA-2026-0006.1で修正版を公開しています。 CVE-2026-59310：vCenter Syslog ServerのDirectory Traversal → 任意コード実行 CVE-2026-59309：VMware Directory Serviceの認証回避 いずれもCritical / CVSS 9.8で、Broadcomは「回避策なし」としています。 主な修正版： ・vCenter 9.1.x → 9.1.0.0300 ・vCenter 9.0.x → 9.0.2.0100 ・vCenter 8.0 → 8.0 U3k / 8.0 U2f
  • 0
  • 0
  • 0
  • 23h ago
Profile picture fallback
boredchilada @cyfar.ca
~Cisa~ CISA added four actively exploited vulnerabilities to its KEV Catalog, including flaws in Microsoft and VMware products. - IOCs: CVE-2026-33824, CVE-2026-55040, CVE-2026-59310 - #CISA #KEV #ThreatIntel
  • 0
  • 0
  • 0
  • 14h ago

CVE-2025-62593

Overview

  • ray-project
  • ray
26 Nov 2025
Published
18 Aug 2026
Updated
CVSS v4.0
CRITICAL (9.4)
EPSS
1.02%
KEV

Description

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.

Statistics

  • 3 Posts
Last activity: 12 hours ago

Fediverse

Profile picture fallback
Michael I Ransier @thecybermind

🚨 C-SUITE ALERT: CISA has flagged CVE-2025-62593 (Ray-Project) for active exploitation. This critical RCE flaw requires immediate executive oversight. Read our board-ready risk assessment and compliance framework to secure your enterprise. Command the wire. 👇 Link below
thecybermind.co/k3rh

  • 0
  • 0
  • 0
  • 18h ago
Profile picture fallback
𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 :verified: @youranonnewsirc

Recent alerts include CISA adding a critical RCE flaw in Ray-Project Ray (CVE-2025-62593) to its KEV catalog (Aug 18). Heights Finance also reported a data breach impacting over 1.2 million customers. Globally, ransomware incidents remain high, with AI increasingly used in attacks. Geopolitically, US-Iran talks have stalled, intensifying Middle East tensions and affecting global shipping.

#Cybersecurity #AnonNews_irc #TechNews

  • 0
  • 0
  • 0
  • 12h ago

Bluesky

Profile picture fallback
Information Security Briefly @infosecbriefly.bsky.social
CISA added CVE-2025-62593 in Ray to KEV, requiring rapid patching because the flaw enables remote code execution via web access and is actively exploited.
  • 0
  • 0
  • 0
  • 23h ago

CVE-2026-33824

Overview

  • Microsoft
  • Windows 10 Version 1607
14 Apr 2026
Published
19 Aug 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
55.85%
KEV

Description

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Statistics

  • 3 Posts
  • 6 Interactions
Last activity: 13 hours ago

Fediverse

Profile picture fallback
:rainbowCrow: @cR0w

Looks like CVE-2026-33824 was added to KEV. Keep in mind that this service isn't just for IPSec VPNs. It's also used with some Windows Firewall policies so check your internal systems for listeners, not just public-facing systems.

An unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled, which could enable remote code execution.

msrc.microsoft.com/update-guid

nvd.nist.gov/vuln/detail/CVE-2

  • 2
  • 4
  • 0
  • 16h ago
Profile picture fallback
Michael I Ransier @thecybermind

🚨 NEW CISA KEV: CVE-2026-33824. Active RCE weaponization targeting Microsoft Internet Key Exchange (IKE) via double-free memory corruption. Unauthenticated access possible. Get the full T-Suite brief & custom CrowdStrike detection queries to secure your Precinct Hybrid architecture.
Link below 👇
thecybermind.co/jily

  • 0
  • 0
  • 0
  • 13h ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Cisa~ CISA added four actively exploited vulnerabilities to its KEV Catalog, including flaws in Microsoft and VMware products. - IOCs: CVE-2026-33824, CVE-2026-55040, CVE-2026-59310 - #CISA #KEV #ThreatIntel
  • 0
  • 0
  • 0
  • 14h ago

CVE-2026-15748

Overview

  • wpmudev
  • Forminator Forms – Contact Form, Payment Form & Custom Form Builder
18 Aug 2026
Published
18 Aug 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
1.18%
KEV

Description

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Statistics

  • 3 Posts
Last activity: 3 hours ago

Fediverse

Profile picture fallback
The CyberSec Guru @guru

Critical WordPress Alert: Dissecting CVE-2026-15748 (Forminator RCE) & CVE-2026-15826 (UPB Auth Bypass)

CVE-2026-15748 enables critical Forminator RCE, while CVE-2026-15826 allows User Profile Builder authentication bypass. Learn how to detect and patch both

thecybersecguru.com/news/cve-2

  • 0
  • 0
  • 0
  • 5h ago

Bluesky

Profile picture fallback
Cybersecurity News Everyday @hendryadrian.bsky.social
Critical Forminator Forms flaw can let unauthenticated attackers upload PHP files and potentially execute code, risking full WordPress site compromise on 600,000+ installs. #ForminatorForms #CVE202615748 #WordPress
  • 0
  • 0
  • 0
  • 3h ago
Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 [VULN] 600 000 sites WordPress menacés par une faille critique dans Forminator Forms CVE-2026-15748 Une faille critique touche Forminator Forms, une extension WordPress utilisée sur plus de 600 000 sites. #Vulnérabilité #CVE #Cyberveille
  • 0
  • 0
  • 0
  • 3h ago

CVE-2026-55040

Overview

  • Microsoft
  • Microsoft SharePoint Enterprise Server 2016
14 Jul 2026
Published
19 Aug 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
3.97%
KEV

Description

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

Statistics

  • 3 Posts
Last activity: 8 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

CISA added four exploited vulnerabilities to its KEV Catalog, hitting SharePoint, VMware vCenter, macOS, and Windows IKE. Patch by August 21.

securityonline.info/cisa-kev-f

  • 0
  • 0
  • 0
  • 8h ago

Bluesky

Profile picture fallback
Lorenzo Ordóñez @lordman1982.bsky.social
Microsoft SharePoint JWT Token Authentication Bypass Technical Analysis (CVE-2026-55040) www.rapid7.com/blog/post/ra...
  • 0
  • 0
  • 0
  • 20h ago
Profile picture fallback
boredchilada @cyfar.ca
~Cisa~ CISA added four actively exploited vulnerabilities to its KEV Catalog, including flaws in Microsoft and VMware products. - IOCs: CVE-2026-33824, CVE-2026-55040, CVE-2026-59310 - #CISA #KEV #ThreatIntel
  • 0
  • 0
  • 0
  • 14h ago

CVE-2026-24301

Overview

  • Microsoft
  • Copilot Web
18 Aug 2026
Published
18 Aug 2026
Updated
CVSS v3.1
HIGH (8.8)
EPSS
Pending
KEV

Description

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

Statistics

  • 2 Posts
  • 2 Interactions
Last activity: 3 hours ago

Fediverse

Profile picture fallback
☮ ♥ ♬ 🧑‍💻 @peterrenshaw

“Varonis Threat Labs uncovered another one-click vulnerability in #Microsoft #Copilot Personal dubbed #CoSnitch (critical, CVE-2026-24301), which quietly executes an attack chain that exfiltrates data from enterprises without obvious red flags.

What makes CoSnitch unique is how Copilot surfaced its own vulnerabilities, a method we are calling #MetaHacking. Our researchers didn't have to reverse-engineer the flaw. The #AI exposed the weakness during normal use, highlighting a meaningful shift in how #SecurityFlaws are found, and a preview of what's ahead as AI gets woven deeper into enterprise systems.”

#security / #CVE / #Varonis <varonis.com/blog/cosnitch> via ElReg <theregister.com/research/2026/>

  • 2
  • 0
  • 0
  • 12h ago

Bluesky

Profile picture fallback
ohhara @shiojiri.com
Microsoft Copilot Personalに脆弱性、連携アプリからワンクリックでデータを流出させる恐れ（CVE-2026-24301） | Codebook｜Security News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47254/
  • 0
  • 0
  • 0
  • 3h ago

CVE-2026-68138

Overview

  • Linux
  • Linux
10 Aug 2026
Published
17 Aug 2026
Updated
CVSS v3.1
HIGH (7.8)
EPSS
0.13%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list against concurrent get/put qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no lock. This was only safe because every caller historically held the RTNL mutex, which serialized all rate-table lookups, inserts and frees. That invariant no longer holds. cls_flower sets TCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false for it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through tcf_exts_validate_ex() -> tcf_action_init() -> tcf_action_init_1() -> tcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the RTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each adding a flower filter with a police action carrying the same rate, then race on qdisc_rtab_list and on the non-atomic refcnt, leading to a use-after-free / double-free of the kmalloc-2k struct qdisc_rate_table. qdisc_rtab_list is a single global (not per-netns), so the corrupted object is shared system-wide. BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160 qdisc_put_rtab+0x12f/0x160 tcf_police_init+0xda9/0x1590 tcf_action_init_1+0x460/0x6b0 tcf_action_init+0x439/0xa40 tcf_exts_validate_ex+0x42d/0x550 fl_change+0xddd/0x7da0 tc_new_tfilter+0xaa7/0x2420 rtnetlink_rcv_msg+0x95e/0xe90 which belongs to the cache kmalloc-2k of size 2048 Protect qdisc_rtab_list and the refcount with a dedicated spinlock. The (sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before taking the lock; if a concurrent inserter added an identical table in the meantime the freshly allocated one is freed under the lock, so no duplicate is leaked. qdisc_put_rtab() now decrements the refcount and unlinks under the same lock.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 8 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

A public PoC for CVE-2026-68138 escalates a normal Linux user to root through a qdisc rate-table race condition.

securityonline.info/cve-2026-6

  • 1
  • 0
  • 0
  • 20h ago

Bluesky

Profile picture fallback
キタきつね @kitafox.bsky.social
CVE-2026-68138: 概念実証（PoC）エクスプロイトによりLinuxカーネルの権限昇格が可能になる CVE-2026-68138: PoC Exploit Enables Linux Kernel Privilege Escalation #DailyCyberSecurity (Aug 18) securityonline.info/cve-2026-681...
  • 0
  • 0
  • 0
  • 8h ago

CVE-2026-71290

Overview

  • Apache Software Foundation
  • Apache HttpComponents Client
  • org.apache.httpcomponents.client5:httpclient5
11 Aug 2026
Published
13 Aug 2026
Updated
CVSS
Pending
EPSS
0.19%
KEV

Description

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.  Please note the classic version of HttpClient is not affected by this vulnerability.  Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.

Statistics

  • 2 Posts
Last activity: 8 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

CVE-2026-71290: Apache HttpClient Flaw Lets Attackers Intercept and Modify Traffic (CVSS 9.1)

securityonline.info/apache-htt

  • 0
  • 0
  • 0
  • 21h ago

Bluesky

Profile picture fallback
キタきつね @kitafox.bsky.social
CVE-2026-71290：Apache HttpClientの脆弱性により、攻撃者がトラフィックを傍受および改ざんできる（CVSS 9.1） CVE-2026-71290: Apache HttpClient Flaw Lets Attackers Intercept and Modify Traffic (CVSS 9.1) #DailyCyberSecurity (Aug 18) securityonline.info/apache-httpc...
  • 0
  • 0
  • 0
  • 8h ago
Showing 1 to 10 of 67 CVEs