CVE-2025-52691

Overview

SmarterTools
SmarterMail

29 Dec 2025

Published

09 Jan 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

10.87%

MITRE

KEV

Description

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Statistics

3 Posts
5 Interactions

Last activity: 15 hours ago

Fediverse

Catalin Cimpanu @campuscodi

watchTowr has published a technical analysis of a CVSS 10 pre-auth RCE vulnerability in SmartTool's SmarterMail business email platform.

The vulnerability (CVE-2025-52691) was silently patched in Oct and publicly disclosed only a few months later in Dec

https://labs.watchtowr.com/do-smart-people-ever-say-theyre-smart-smartertools-smartermail-pre-auth-rce-cve-2025-52691/

3
2
1
19h ago

Bluesky

CyberHub @cyberhub.blog

📌 Critical Pre-Auth RCE Vulnerability in SmarterMail (CVE-2025-52691) Disclosed by watchTowr Labs https://www.cyberhub.blog/article/17899-critical-pre-auth-rce-vulnerability-in-smartermail-cve-2025-52691-disclosed-by-watchtowr-labs

0
0
0
15h ago

CVE-2026-0628

Overview

Google
Chrome

06 Jan 2026

Published

08 Jan 2026

Updated

CVSS

Pending

EPSS

0.02%

MITRE

KEV

Description

Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)

Statistics

2 Posts
1 Interaction

Last activity: 1 hour ago

Bluesky

ferramentaslinux.bsky.social @ferramentaslinux.bsky.social

🚨 Attention #Fedora Users! A critical security update is available for your Chromium browser. Version 143.0.7499.192 patches a high-severity vulnerability (CVE-2026-0628) that could let malicious sites bypass security rules. Read more: 👉 tinyurl.com/3xk6ta5d #Security

0
1
0
20h ago

Information Security Briefly @infosecbriefly.bsky.social

Microsoft released Edge 143.0.3650.139 to fix a serious Chromium vulnerability CVE-2026-0628, improving browser security and stability.

0
0
0
1h ago

CVE-2026-0855

Overview

Merit LILIN
P2

12 Jan 2026

Published

12 Jan 2026

Updated

CVSS v4.0

HIGH (8.7)

EPSS

Pending

MITRE

KEV

Description

Certain IP Camera models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

Statistics

2 Posts

Last activity: 1 hour ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-0855 - High (8.8)

Certain IP Camera models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0855/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
2h ago

Bluesky

BaseFortify.eu @basefortify.bsky.social

🚨 CVE of the Day: CVE-2026-0855 High-severity OS command injection in Merit LILIN IP cameras allows authenticated attackers to execute arbitrary commands on the device, leading to full compromise. 🔍 Full report: basefortify.eu/cve_reports/... #CVE #IoTSecurity #IPCamera #RCE 🚨

0
0
0
1h ago

CVE-2025-20700

Overview

Airoha Technology Corp.
AB156x, AB157x, AB158x, AB159x series, AB1627

04 Aug 2025

Published

05 Aug 2025

Updated

CVSS

Pending

EPSS

0.04%

MITRE

KEV

Description

In the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE protocol through Bluetooth LE GATT service. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Statistics

1 Post
2 Interactions

Last activity: 22 hours ago

Bluesky

0xor0ne @0xor0ne.bsky.social

Airoha Bluetooth RACE vulnerabilities (CVE-2025-20700/20701/20702) Blog post: insinuator.net/2025/12/blue... White paper: static.ernw.de/whitepaper/E... Credits Dennis Heinze, Frieder Steinmetz #infosec #bluetooth

0
2
0
22h ago

CVE-2023-38408

Overview

Pending

20 Jul 2023

Published

15 Oct 2024

Updated

CVSS

Pending

EPSS

68.75%

MITRE

KEV

Description

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

Statistics

1 Post
1 Interaction

Last activity: 2 hours ago

Bluesky

Sami Laiho @samilaiho.com

CVE-2023-38408: OpenSSH Vulnerability in Ethernet Switches URL: www.moxa.com/en/support/p... Classification: Critical, Solution: Official Fix, Exploit Maturity: Functional, CVSSv3.1: 9.8

0
1
0
2h ago

CVE-2026-0716

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

1 Post
1 Interaction

Last activity: 16 hours ago

Fediverse

Mike Gorse @MikeGorse

I'm not exactly sure why I'm doing this on a Sunday, and the hard work was done by others, but there you go; proposed fix for CVE-2026-0716. https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/494

0
1
0
16h ago

CVE-2022-26320

Overview

Pending

14 Mar 2022

Published

07 Oct 2024

Updated

CVSS

Pending

EPSS

0.52%

MITRE

KEV

Description

The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon imagePROGRAF and imageRUNNER devices through 2022-03-14, and potentially many other devices, generates RSA keys that can be broken with Fermat's factorization method. This allows efficient calculation of private RSA keys from the public key of a TLS certificate.

Statistics

1 Post

Last activity: 18 hours ago

Fediverse

어둠사자 @gnh1201

요즘 스레드에 RSA-2048을 해독했다는 양반이 있어서 글을 처음부터 끝까지 정독했다.

그리고 코드 없이 개념적으로 가능한지 따져봄. 이 사람의 주장은 너무 중구난방이라 깔끔하게 한줄로 요약하면 이렇다.

"d = | q - p | 의 d(거리)가 0에 수렴할수록 RSA가 깨질 가능성이 높아진다."

그리고 이건 얼추 사실은 맞음.

거리가 가까워질수록 Fermat's Factorization를 이용한 공격이 가능해지고, 이와 관련된 공식 취약점 CVE (예: CVE-2022-26320)도 존재한다.

참고로 어려운게 아니라 고등과정 곱셈 공식 중 하나다.

RSA-2048에서는 사실상 불가능하고, RSA-256 수준에선 가능할 수 있다. (RSA-2048은 특정 조건 만족시 가능)

RSA-2048을 풀었다고 주장하시는 분이 올린 코드를 봤을 때, 그냥 q를 저장해놓고 n mod q 먹여서 0이 되는지 확인하고 p를 유도하는 것임.

그냥 답지가지고 장난치는거라 생각하면 된다.

0
0
0
18h ago

CVE-2026-0854

Overview

Merit LILIN
DH032

12 Jan 2026

Published

12 Jan 2026

Updated

CVSS v4.0

HIGH (8.7)

EPSS

Pending

MITRE

KEV

Description

Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

Statistics

1 Post

Last activity: 3 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-0854 - High (8.8)

Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0854/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
3h ago

CVE-2026-0841

Overview

UTT
进取 520W

11 Jan 2026

Published

11 Jan 2026

Updated

CVSS v4.0

HIGH (8.7)

EPSS

0.04%

MITRE

KEV

Description

A vulnerability was detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formPictureUrl. The manipulation of the argument importpictureurl results in buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Statistics

1 Post

Last activity: 6 hours ago

Bluesky

malwarEvangelist @malwarevangelist.com

In our cybersecurity chronicles, CVE-2026-0841 mirrors the intensity of the Heartbleed bug but with a more localized impact on home devices. Its buffer overflow potential could spread like wildfire if not contained. How do you see us addressing such vulnerabilities moving forward?

0
0
0
6h ago

CVE-2025-69277

Overview

libsodium
libsodium

31 Dec 2025

Published

07 Jan 2026

Updated

CVSS v3.1

MEDIUM (4.5)

EPSS

0.02%

MITRE

KEV

Description

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

Statistics

1 Post

Last activity: 21 hours ago

Bluesky

ferramentaslinux.bsky.social @ferramentaslinux.bsky.social

🚨 CVE-2025-69277: Critical libsodium validation flaw impacts #Fedora42. Affects Ed25519 sig verification. Data integrity & disclosure risk. Read more: 👉 tinyurl.com/3nypjx8s #Security

0
0
0
21h ago