CVE-2026-40372

Overview

Microsoft
ASP.NET Core 10.0

21 Apr 2026

Published

22 Apr 2026

Updated

CVSS v3.1

CRITICAL (9.1)

EPSS

0.04%

MITRE

KEV

Description

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Statistics

6 Posts
10 Interactions

Last activity: 4 hours ago

Fediverse

.NET @dotnet

📰 .NET 10.0.7 Out-of-Band Security Update

We are releasing .NET 10.0.7 as an out-of-band security update to address CVE-2026-40372.

https://devblogs.microsoft.com/dotnet/dotnet-10-0-7-oob-security-update/ #dotnet

4
3
0
19h ago

Barret @barret

From the .NET blog...

Bluesky

Ninja Owl @ninjaowl.ai

Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...

0
0
0
4h ago

CVE-2026-32201

Overview

Microsoft
Microsoft SharePoint Enterprise Server 2016

14 Apr 2026

Published

21 Apr 2026

Updated

CVSS v3.1

MEDIUM (6.5)

EPSS

7.94%

MITRE

KEV

Description

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Statistics

5 Posts
12 Interactions

Last activity: 4 hours ago

Fediverse

ekiledjian @edwardk

Over 1,370 Microsoft SharePoint servers are exposed online to a spoofing vulnerability (CVE-2026-32201), which is actively exploited in the wild. This critical flaw, identified by The Shadowserver Foundation, allows unauthorized attackers to bypass security protocols and potentially compromise sensitive corporate data, highlighting a significant patch management problem for many organizations.
https://gbhackers.com/1370-microsoft-sharepoint-servers-at-risk-of-spoofing-attacks/

0
0
0
8h ago

Bluesky

The Shadowserver Foundation @shadowserver.bsky.social

We are also scanning & reporting Microsoft SharePoint CVE-2026-32201 (Improper input validation in SharePoint allows an unauthorized attacker to perform spoofing over a network). This vulnerability is known exploited in the wild & on US CISA KEV list. 1370 IPs seen unpatched. Top: US

5
7
0
20h ago

The Shadowserver Foundation @shadowserver.bsky.social

CVE-2026-32201 tracker: dashboard.shadowserver.org/statistics/c... This is a version based scan. Microsoft Advisory: msrc.microsoft.com/update-guide...

0
0
0
20h ago

CyberVeille @cyberveille-ch.bsky.social

📢 Plus de 1 300 serveurs SharePoint non patchés exposés à CVE-2026-32201, exploitée en zero-day 📝 📰 **Source** : BleepingComputer, article de … https://cyberveille.ch/posts/2026-04-22-plus-de-1-300-serveurs-sharepoint-non-patches-exposes-a-cve-2026-32201-exploitee-en-zero-day/ #CISA_KEV #Cyberveille

0
0
0
4h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

Over 1,300 Microsoft SharePoint servers remain unpatched against zero-day spoofing flaw CVE-2026-32201, affecting Server 2016, 2019, and Subscription Edition. Fewer than 200 patched despite active exploitation. #MicrosoftSharePoint #CISA #USA

0
0
0
4h ago

CVE-2026-20133

Overview

Cisco
Cisco Catalyst SD-WAN Manager

25 Feb 2026

Published

22 Apr 2026

Updated

CVSS v3.1

MEDIUM (6.5)

EPSS

1.39%

MITRE

KEV

Description

A vulnerability in Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system access restrictions. An attacker could exploit this vulnerability by accessing the API of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

Statistics

4 Posts
3 Interactions

Last activity: 8 hours ago

Bluesky

The IT Nerd @theitnerd.ca

The CISA adds eight Cisco SD-WAN flaws to KEV and gives organizations four days to fix them The CISA has added eight vulnerabilities to its KEV catalog, including CVE-2026-20133, another flaw affecting Cisco Catalyst SD-WAN Manager that Federal agencies have been given four days to secure their…

1
2
1
19h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

CISA orders federal agencies to patch CVE-2026-20133 in Cisco Catalyst SD-WAN Manager by April 24 after active exploitation found. Flaw allows unauthenticated access to sensitive OS data via API. #SDWANFlaw #CVE202620133 #USA

0
0
0
18h ago

キタきつね @kitafox.bsky.social

CISAは、Cisco Catalyst SD-WAN Managerの別の脆弱性（CVE-2026-20133）が悪用されたことを警告した CISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133) #HelpNetSecurity (Apr 21) www.helpnetsecurity.com/2026/04/21/c...

0
0
0
8h ago

CVE-2026-34197

Overview

Apache Software Foundation
Apache ActiveMQ Broker
org.apache.activemq:activemq-broker

07 Apr 2026

Published

17 Apr 2026

Updated

CVSS

Pending

EPSS

59.64%

MITRE

KEV

Description

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Statistics

3 Posts

Last activity: 9 hours ago

Fediverse

HackerWorkspace @hackerworkspace

CVE-2026-34197 ActiveMQ RCE via Jolokia API

https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/

Read on HackerWorkspace: https://hackerworkspace.com/article/cve-2026-34197-activemq-rce-via-jolokia-api

#cybersecurity #vulnerability #exploit

0
0
0
22h ago

ekiledjian @edwardk

Thousands of Apache ActiveMQ instances remain unpatched weeks after a critical remote code injection vulnerability (CVE-2026-34197) was discovered, highlighting a dangerous lag in security updates. Experts warn that with AI capable of rapidly weaponizing newly found bugs, slow patching cycles are a significant network security risk.
https://www.csoonline.com/article/4161532/thousands-of-apache-activemq-instances-still-unpatched-weeks-after-an-actively-exploited-hole-discovered.html

0
0
0
9h ago

Bluesky

Kees - Nijkerk @keesnk.bsky.social

6000+ Apache ActiveMQ Instances Vulnerable to CVE-2026-34197 exposed Online: cybersecuritynews.com/apache-activ...

0
0
0
9h ago

CVE-2023-33538

Overview

Pending

07 Jun 2023

Published

20 Dec 2025

Updated

CVSS

Pending

EPSS

89.90%

MITRE

KEV

Description

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

Statistics

3 Posts
5 Interactions

Last activity: 13 hours ago

Fediverse

Patrick C Miller :donor: @patrickcmiller

CVE-2023-33538 under attack for a year, but exploitation still unsuccessful https://securityaffairs.com/191040/hacking/cve-2023-33538-under-attack-for-a-year-but-exploitation-still-unsuccessful.html

2
3
1
13h ago

Chris Short @ChrisShort

TP-Link router owners beware | A Deep Dive Into Attempted Exploitation of CVE-2023-33538 #devopsish https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/

0
0
0
15h ago

CVE-2026-41285

Overview

OpenBSD
OpenBSD

20 Apr 2026

Published

21 Apr 2026

Updated

CVSS v3.1

MEDIUM (4.3)

EPSS

0.01%

MITRE

KEV

Description

In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "nd_opt_len * 8 - 2" expression with no preceding check for whether nd_opt_len is zero.

Statistics

2 Posts
3 Interactions

Last activity: 11 hours ago

Fediverse

Nad @Nadsec

Another1 - CVE-2026-41285 - OpenBSD

https://nvd.nist.gov/vuln/detail/CVE-2026-41285

(Project asswing was not involved)

0
0
0
11h ago

Bluesky

Nad @nadsec.online

Another1 - CVE-2026-41285 - OpenBSD nvd.nist.gov/vuln/detail/... (Project asswing was not involved)

2
1
0
11h ago

CVE-2026-5760

Overview

SGLang
SGLang

20 Apr 2026

Published

20 Apr 2026

Updated

CVSS

Pending

EPSS

0.29%

MITRE

KEV

Description

SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment().

Statistics

2 Posts
1 Interaction

Last activity: Last hour

Bluesky

Ninja Owl @ninjaowl.ai

SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...

0
1
0
14h ago

NEWSTECNICAS | Tecnología , IA y Gaming @newstecnicas.info.ve

⚠️ Manual Técnico: #Reparación del CVE-2026-5760 en el #Framework de IA #SGLang www.newstecnicas.info.ve/2026/04/manu...

0
0
0
Last hour

CVE-2026-41651

Overview

PackageKit
PackageKit

22 Apr 2026

Published

22 Apr 2026

Updated

CVSS v3.1

HIGH (8.8)

EPSS

Pending

MITRE

KEV

Description

PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: 1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction has already been authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING. 2. Silent state-transition rejection (lines 873–882): `pk_transaction_set_state()` silently discards backward state transitions (e.g. `RUNNING` → `WAITING_FOR_AUTH`) but the flag overwrite at step 1 already happened. The transaction continues running with corrupted flags. 3. Late flag read at execution time (lines 2273–2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at authorization time. If flags were overwritten between authorization and execution, the backend sees the attacker's flags.

Statistics

2 Posts

Last activity: Last hour

Fediverse

intuentis0x0 @intuentis0x0

There is a great report out there by @dtcert

Telekom Red Team (great work guys) found a high severity LPE vulnerability in PackageKit daemon. In the report the distros of Ubuntu, Debian and Fedora and some more are mentioned as effected. Some left traces to hunt for the exploitation comes with the report, which is helpful.

edit: now known as CVE-2026-41651

https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html

0
0
0
2h ago

Billchenchina 🏳️‍⚧️ @billchenchina

PackageKit GHSA-f55j-vvr9-69xv / "Pack2TheRoot" / CVE-2026-41651
请尽快更新
All PackageKit versions between >= 1.0.2 and <= 1.3.4 are vulnerable.
Debian 12 1.2.6-5+deb12u1
Debian 13 1.3.1-1+deb13u1
上游修复版本 1.3.5

This release fixes a critical security vulnerability that allows unprivileged local users to obtain root privileges on any distribution that uses PackageKit.

0
0
0
Last hour

CVE-2026-33825

Overview

Microsoft
Microsoft Defender Antimalware Platform

14 Apr 2026

Published

21 Apr 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

0.06%

MITRE

KEV

Description

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Statistics

2 Posts

Last activity: 9 hours ago

Fediverse

ekiledjian @edwardk

Three publicly available exploits, BlueHammer, RedSun, and UnDefend, are being used to turn Microsoft Defender into an attacker tool, with two enabling SYSTEM-level access and one disrupting Defender's update mechanism. While a patch exists for BlueHammer (CVE-2026-33825), RedSun and UnDefend exploit separate flaws, allowing attackers to escalate privileges or weaken defenses with minimal modifications.
https://www.darkreading.com/cyberattacks-data-breaches/exploits-turn-windows-defender-attacker-tool

0
0
0
9h ago

Bluesky

piggo @pigondrugs.bsky.social

~Huntress~ Nightmare-Eclipse LPE tools (BlueHammer/RedSun) are being actively exploited in the wild following FortiGate VPN compromise. - IOCs: staybud. dpdns. org, 78. 29. 48. 29, 179. 43. 140. 214 - #CVE202633825 #NightmareEclipse #threatintel

0
0
0
22h ago

CVE-2026-35616

Overview

Fortinet
FortiClientEMS

04 Apr 2026

Published

21 Apr 2026

Updated

CVSS v3.1

CRITICAL (9.1)

EPSS

35.12%

MITRE

KEV

Description

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Statistics

1 Post
4 Interactions

Last activity: 4 hours ago

Fediverse

N_{Dario Fadda} @nuke

Critical Fortinet FortiClient EMS Zero-Day CVE-2026-35616 Exploited Before Official Patch Was Released
#CyberSecurity
https://securebulletin.com/critical-fortinet-forticlient-ems-zero-day-cve-2026-35616-exploited-before-official-patch-was-released/

4
0
0
4h ago