24h | 7d | 30d

CVE-2026-33626

Overview

  • InternLM
  • lmdeploy
20 Apr 2026
Published
21 Apr 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.03%
KEV

Description

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.

Statistics

  • 7 Posts
  • 6 Interactions
Last activity: 7 hours ago

Fediverse

Profile picture fallback
tomcat @tomcat

⚠️ LMDeploy flaw exploited within 12.5 hours of disclosure.

The SSRF bug let attackers hit AWS metadata, Redis, and internal services via the image loader to scan networks and access data.

WordPress plugin bugs are also being used for full site takeovers.

🔗 Read → thehackernews.com/2026/04/lmde

  • 0
  • 1
  • 0
  • 19h ago

Bluesky

Profile picture fallback
Nidouille @nidouille.bsky.social
Une faille critique (CVE-2026-33626, CVSS 7.5) dans LMDeploy, un outil open-source pour le déploiement de LLMs, est activement exploitée dans la nature moins de 13h après sa divulgation ! Il s’agit d’une vulnérabilité SSRF permettant l’accès à des données sensibles thehackernews.com/2026/04/lmde...
  • 3
  • 2
  • 0
  • 16h ago
Profile picture fallback
ohhara @shiojiri.com
LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure https://thehackernews.com/2026/04/lmdeploy-cve-2026-33626-flaw-exploited.html
  • 0
  • 0
  • 1
  • 20h ago
Profile picture fallback
Bitnewsbot @bitnewsbot.bsky.social
Threat actors exploited the critical SSRF bug in LMDeploy toolkit just 12 hours after its public disclosure. The vulnerability, CVE-2026-33626, […]
  • 0
  • 0
  • 0
  • 19h ago
Profile picture fallback
/r/netsec @r-netsec-bot.bsky.social
Exploit su LMDeploy CVE-2026-33626: attacco SSRF immediato dopo disclosure
  • 0
  • 0
  • 0
  • 12h ago
Profile picture fallback
Ninja Owl @ninjaowl.ai
LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...
  • 0
  • 0
  • 0
  • 7h ago

CVE-2025-29635

Overview

  • Pending
25 Mar 2025
Published
25 Apr 2026
Updated
CVSS
Pending
EPSS
1.25%
KEV

Description

A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.

Statistics

  • 3 Posts
Last activity: 8 hours ago

Fediverse

Profile picture fallback
CyberNetsecIO @netsecio

📰 Mirai Botnet Exploits Critical Flaw in Discontinued D-Link Routers for DDoS Attacks

🚨 A new Mirai botnet campaign is exploiting a critical RCE flaw (CVE-2025-29635) in discontinued D-Link routers. The devices are EoL and will not be patched. Disconnect them now to prevent them from joining a DDoS botnet! #Mirai #Botnet #IoT #DLink

🔗 cyber.netsecops.io/articles/mi

  • 0
  • 0
  • 0
  • 10h ago

Bluesky

Profile picture fallback
ohhara @shiojiri.com
Mirai Botnet exploits CVE-2025-29635 to target legacy D-Link routers https://securityaffairs.com/191135/malware/mirai-botnet-exploits-cve-2025-29635-to-target-legacy-d-link-routers.html
  • 0
  • 0
  • 0
  • 20h ago
Profile picture fallback
piggo @pigondrugs.bsky.social
~Cisa~ CISA added 4 actively exploited CVEs affecting Samsung, SimpleHelp, and D-Link to the KEV catalog. - IOCs: CVE-2024-7399, CVE-2024-57726, CVE-2025-29635 - #CISA #KEV #ThreatIntel
  • 0
  • 0
  • 0
  • 8h ago

CVE-2025-48700

Overview

  • Pending
23 Jun 2025
Published
21 Apr 2026
Updated
CVSS
Pending
EPSS
20.00%
KEV

Description

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.

Statistics

  • 3 Posts
  • 5 Interactions
Last activity: 12 hours ago

Bluesky

Profile picture fallback
The Shadowserver Foundation @shadowserver.bsky.social
We are scanning/reporting daily Zimbra Collaboration Suite instances vulnerable to CVE-2025-48700, that can allow unauthorized access to sensitive information. This vulnerability is exploited in the wild and on US CISA KEV. We see over 10.5K IPs unpatched 2026-04-23.
  • 2
  • 3
  • 0
  • 18h ago
Profile picture fallback
The Shadowserver Foundation @shadowserver.bsky.social
CVE-2025-48700 Tracker: dashboard.shadowserver.org/statistics/c... #CyberCivilDefense
  • 0
  • 0
  • 0
  • 18h ago
Profile picture fallback
Cybersecurity News Everyday @hendryadrian.bsky.social
Over 10,500 Zimbra servers remain vulnerable to CVE-2025-48700, an XSS flaw exploited by APT28 and APT29 in targeted phishing and mass intrusions. CISA lists it in KEV for federal patching. #ZimbraServer #CrossSiteScripting #USA
  • 0
  • 0
  • 0
  • 12h ago

CVE-2026-41651

Overview

  • PackageKit
  • PackageKit
22 Apr 2026
Published
22 Apr 2026
Updated
CVSS v3.1
HIGH (8.8)
EPSS
0.02%
KEV

Description

PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: 1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction has already been authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING. 2. Silent state-transition rejection (lines 873–882): `pk_transaction_set_state()` silently discards backward state transitions (e.g. `RUNNING` → `WAITING_FOR_AUTH`) but the flag overwrite at step 1 already happened. The transaction continues running with corrupted flags. 3. Late flag read at execution time (lines 2273–2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at authorization time. If flags were overwritten between authorization and execution, the backend sees the attacker's flags.

Statistics

  • 3 Posts
  • 4 Interactions
Last activity: 10 hours ago

Fediverse

Profile picture fallback
HackerWorkspace @hackerworkspace

Pack2TheRoot (CVE-2026-41651): Cross-Distro Local Privilege Escalation Vulnerability

github.security.telekom.com/20

Read on HackerWorkspace: hackerworkspace.com/article/pa

  • 0
  • 0
  • 0
  • 10h ago

Bluesky

Profile picture fallback
L'algorisme @lalgorisme.bsky.social
🧵Pack2TheRoot (CVE-2026-41651): nova vulnerabilitat crítica que afecta la majoria de distribucions Linux. Qualsevol usuari local sense privilegis pot obtenir accés root en cas d'explotar exitosament aquesta vulnerabilitat. Com? 👇🏾
  • 2
  • 2
  • 0
  • 22h ago
Profile picture fallback
L'algorisme @lalgorisme.bsky.social
Com solucionar-ho Actualitza PackageKit a la versió 1.3.5 o al backport específic de la teva distro: Versions de pedaç per distro: • Fedora 42–44: PackageKit-1.3.4-3 • Debian: tracker CVE-2026-41651 • Ubuntu: Launchpad CVE-2026-41651
  • 0
  • 0
  • 0
  • 22h ago

CVE-2025-20333

Overview

  • Cisco
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
25 Sep 2025
Published
26 Feb 2026
Updated
CVSS v3.1
CRITICAL (9.9)
EPSS
41.43%
KEV

Description

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

Statistics

  • 3 Posts
  • 5 Interactions
Last activity: 5 hours ago

Fediverse

Profile picture fallback
CERT.at @CERT_at

Neu Warnung:
Update #1: Schwerwiegende Sicherheitslücken in Cisco Adaptive Security Appliance - aktiv ausgenutzt - Updates verfügbar cert.at/de/warnungen/2026/4/up

  • 1
  • 2
  • 0
  • 13h ago

Bluesky

Profile picture fallback
二本松哲也 @nihonmatsu.bsky.social
FIRESTARTER BackdoorはFirewallそのものを永続的な侵入基盤に変える攻撃です。 ・ファームウェア更新では除去されない ・ログに残らない ・ハード電源断でしか除去不可 CVE-2025-20333（認可不備） CVE-2025-20362（バッファオーバーフロー） 対象機器の特定（最優先） ・Cisco ASA / Firepower / FTD ・インターネット公開機器 パッチだけでは不十分 ・侵害前提で評価 ・過去に露出していたかが重要 フォレンジック前提 ・core dump取得 ・メモリ解析 ・YARA適用
  • 1
  • 1
  • 0
  • 18h ago
Profile picture fallback
Cybersecurity News Everyday @hendryadrian.bsky.social
Firestarter malware persists on Cisco Firepower and Secure Firewall devices running ASA/FTD, bypassing patches and reboots. Linked to UAT-4356, it exploits CVE-2025-20333 & CVE-2025-20362 via WebVPN. #CiscoFirepower #UK #Backdoor
  • 0
  • 0
  • 0
  • 5h ago

CVE-2026-33824

Overview

  • Microsoft
  • Windows 10 Version 1607
14 Apr 2026
Published
24 Apr 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.10%
KEV

Description

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Statistics

  • 2 Posts
  • 2 Interactions
Last activity: 17 hours ago

Fediverse

Profile picture fallback
DragonJAR @dragonjar

En las últimas 24 horas, se reveló Fast16, un malware sigiloso con impacto nuclear histórico, mientras una grave falla en Windows IKEv2 fue parcheada urgentemente; además, una cadena de suministro comprometida afectó a Bitwarden CLI, un masivo robo de datos sacudió Francia, y avanzan ataques sofisticados con suplantación en Microsoft Teams y uso malicioso de software legítimo por Tropic Trooper. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:

🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 24/04/26 📆 |====

🔓 MALWARE FAST16 DESCIFRADO: AMENAZA SILENCIOSA AL PROGRAMA NUCLEAR DE IRÁN

Investigadores revelan Fast16, un código malicioso de 2005 capaz de manipular software de simulación crítica. Se sospecha que pudo haber sido empleado por EE. UU. o aliados para sabotajes encubiertos, precediendo a Stuxnet. Entender su funcionamiento permite fortalecer defensas contra malware avanzado y ataques dirigidos. Descubre todos los detalles sobre esta amenaza histórica y su impacto en la ciberseguridad nuclear. Conoce más sobre Fast16 y su análisis completo aquí 👉 djar.co/f2tf5

🛡️ CADENA DE SUMINISTRO COMPROMETIDA AFECTA A BITWARDEN CLI

Una campaña maliciosa aprovechó la plataforma Checkmarx para infiltrar malware en la versión 2026.4.0 de Bitwarden CLI, exponiendo secretos y distribuyendo código malicioso a usuarios confiables. Este incidente resalta la importancia crítica de auditar y proteger las cadenas de suministro de software, clave para la seguridad integral. Aprende cómo detectar y mitigar riesgos derivados de ataques en la cadena de suministro y protege tus credenciales. Más información relevante en 👉 djar.co/nYZn

⚠️ VULNERABILIDAD CRÍTICA EN WINDOWS IKEV2 (CVE-2026-33824) PERMITÍA EJECUCIÓN REMOTA DE CÓDIGO

Se identificó una falla grave en el servicio IKEv2 de Windows que posibilitaba la ejecución de código remoto, poniendo en riesgo la integridad de miles de sistemas. Microsoft lanzó un parche urgente que debe aplicarse de inmediato para evitar explotación activa. Descubre cómo funciona esta vulnerabilidad y las mejores prácticas para mantener tu entorno seguro frente a amenazas similares. Revisa el aviso de seguridad oficial aquí 👉 djar.co/qhEL

🇫🇷 INCIDENTE EN FRANCIA EXPONE DATOS PERSONALES DE 18 MILLONES DE CIUDADANOS

La Agencia Nacional de Seguridad Documental de Francia confirmó un acceso no autorizado que comprometió documentos de identidad y datos sensibles de millones de personas. Este incidente enfatiza la necesidad de reforzar controles y medidas de protección sobre bases de datos críticas a nivel estatal. Descubre el alcance del evento, las medidas adoptadas y consejos para proteger tus datos personales en escenarios de brechas masivas. Detalles completos en 👉 djar.co/VXYXb

👥 SUSTRACCIÓN DE DATOS CON SUPLANTACIÓN EN MICROSOFT TEAMS: MALWARE SNOW DE UNC6692

El grupo UNC6692 utilizó técnicas de impersonación en Microsoft Teams para engañar a empleados, desplegar el malware SNOW y exfiltrar información confidencial. Esta táctica demuestra la sofisticación en la ingeniería social y la explotación de plataformas de colaboración. Aprende a identificar señales de ataques de suplantación y cómo fortalecer la seguridad en entornos colaborativos para evitar filtraciones. Amplía la información y recomendaciones aquí 👉 djar.co/kQat

🐉 TROPIC TROOPER EMPLEA VERSIONES TROYANIZADAS DE SUMATRAPDF Y GITHUB PARA DESPLEGAR ADAPTIXC2

En 2024, el grupo Tropic Trooper desplegó el malware AdaptixC2 utilizando versiones manipuladas del lector SumatraPDF junto con canales de comando en GitHub, permitiendo acceso encubierto y persistente en redes comprometidas. Este caso resalta la amenaza que representan herramientas legítimas convertidas en vectores de ataque avanzados. Descubre cómo identificar y defenderte de estas campañas sofisticadas que combinan ingeniería de software y abuso de plataformas confiables. Conoce todos los detalles aquí 👉 djar.co/SnJilf

  • 1
  • 1
  • 0
  • 17h ago

Bluesky

Profile picture fallback
ohhara @shiojiri.com
Zero Day Initiative — CVE-2026-33824: Remote Code Execution in Windows IKEv2 https://www.zerodayinitiative.com/blog/2026/4/22/cve-2026-33824-remote-code-execution-in-windows-ikev2
  • 0
  • 0
  • 0
  • 21h ago

CVE-2026-32202

Overview

  • Microsoft
  • Windows 10 Version 1607
14 Apr 2026
Published
24 Apr 2026
Updated
CVSS v3.1
MEDIUM (4.3)
EPSS
0.07%
KEV

Description

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 8 hours ago

Bluesky

Profile picture fallback
780th Military Intelligence Brigade (Cyber) @780thmibdecyber.bsky.social
A Shortcut to Coercion: Incomplete Patch of APT28's Zero-Day Leads to CVE-2026-32202 Akamai www.akamai.com/blog/securit...
  • 1
  • 0
  • 0
  • 15h ago
Profile picture fallback
piggo @pigondrugs.bsky.social
~Akamai~ An incomplete patch for APT28's CVE-2026-21510 leaves a zero-click NTLM authentication coercion flaw (CVE-2026-32202) via malicious LNK files. - IOCs: CVE-2026-32202, CVE-2026-21510, APT28 - #APT28 #CVE2026_32202 #ThreatIntel #ZeroDay
  • 0
  • 0
  • 0
  • 8h ago

CVE-2025-53521

Overview

  • F5
  • BIG-IP
15 Oct 2025
Published
31 Mar 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
7.45%
KEV

Description

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Statistics

  • 1 Post
  • 7 Interactions
Last activity: 12 hours ago

Bluesky

Profile picture fallback
ESET Research @esetresearch.bsky.social
Approximately a month ago, F5 published advisory on malware deployed to BIG-IP systems vulnerable to CVE-2025-53521. #ESETresearch discovered two related malware components on VirusTotal and named the threat #PoisonedRefresh. 1/6 my.f5.com/manage/s/art...
  • 4
  • 3
  • 0
  • 12h ago

CVE-2026-28950

Overview

  • Apple
  • iOS and iPadOS
22 Apr 2026
Published
23 Apr 2026
Updated
CVSS
Pending
EPSS
0.01%
KEV

Description

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2. Notifications marked for deletion could be unexpectedly retained on the device.

Statistics

  • 1 Post
  • 3 Interactions
Last activity: 10 hours ago

Fediverse

Profile picture fallback
CyberNetsecIO @netsecio

📰 Apple Rushes Fix for iOS Flaw That Let FBI Recover Deleted Signal Messages

🚨 Apple issues emergency patch for iOS flaw (CVE-2026-28950) that let the FBI recover deleted Signal message notifications. The bug improperly stored notification data, undermining user privacy. Update your iPhone & iPad now! 📱🔒 #iOS #Privacy #In...

🔗 cyber.netsecops.io/articles/ap

  • 2
  • 1
  • 0
  • 10h ago

CVE-2025-20362

Overview

  • Cisco
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
25 Sep 2025
Published
26 Feb 2026
Updated
CVSS v3.1
MEDIUM (6.5)
EPSS
50.69%
KEV

Description

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory. A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.

Statistics

  • 2 Posts
  • 2 Interactions
Last activity: 5 hours ago

Bluesky

Profile picture fallback
二本松哲也 @nihonmatsu.bsky.social
FIRESTARTER BackdoorはFirewallそのものを永続的な侵入基盤に変える攻撃です。 ・ファームウェア更新では除去されない ・ログに残らない ・ハード電源断でしか除去不可 CVE-2025-20333（認可不備） CVE-2025-20362（バッファオーバーフロー） 対象機器の特定（最優先） ・Cisco ASA / Firepower / FTD ・インターネット公開機器 パッチだけでは不十分 ・侵害前提で評価 ・過去に露出していたかが重要 フォレンジック前提 ・core dump取得 ・メモリ解析 ・YARA適用
  • 1
  • 1
  • 0
  • 18h ago
Profile picture fallback
Cybersecurity News Everyday @hendryadrian.bsky.social
Firestarter malware persists on Cisco Firepower and Secure Firewall devices running ASA/FTD, bypassing patches and reboots. Linked to UAT-4356, it exploits CVE-2025-20333 & CVE-2025-20362 via WebVPN. #CiscoFirepower #UK #Backdoor
  • 0
  • 0
  • 0
  • 5h ago
Showing 1 to 10 of 41 CVEs