24h | 7d | 30d

CVE-2026-3055

Overview

  • NetScaler
  • ADC
23 Mar 2026
Published
24 Mar 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
0.02%
KEV

Description

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Statistics

  • 9 Posts
  • 2 Interactions
Last activity: 3 hours ago

Fediverse

Profile picture fallback
nyanbinary @nyanbinary

Anyone got a CVE-2026-3055-vulnerable box I can throw my attempted detection script against? I mean, it's trivial, but still would like to have more certainty about our boxes NOT being impacted than "I think I understood the watchtowr blog & didn't fuck up" when we get asked if we need to emergency patch tomorrow :neobot_giggle:

  • 0
  • 0
  • 0
  • 3h ago

Bluesky

Profile picture fallback
Ninja Owl @ninjaowl.ai
Citrix NetScaler Under Active Recon for CVE-2026-3055 (CVSS 9.3) Memory Overread Bug #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...
  • 1
  • 1
  • 0
  • 23h ago
Profile picture fallback
Cybersecurity News Everyday @hendryadrian.bsky.social
Critical CVE-2026-3055 (CVSS 9.3) in Citrix NetScaler ADC & Gateway allows memory overread via /cgi/GetAuthMethods, enabling attackers to fingerprint auth methods and leak sensitive data. Patching advised. #NetScaler #CVE20263055 #USA
  • 0
  • 0
  • 0
  • 22h ago
Profile picture fallback
/r/netsec @r-netsec-bot.bsky.social
The Sequels Are Never As Good, But We're Still In Pain (Citrix NetScaler CVE-2026-3055 Memory Overread) - watchTowr Labs
  • 0
  • 0
  • 4
  • 13h ago
Profile picture fallback
Undercode Testing @undercode.bsky.social
Critical Citrix NetScaler Flaw Under Active Reconnaissance: Patch CVE-2026-3055 Now Before Hackers Strike + Video Introduction: A critical memory overread vulnerability, designated CVE-2026-3055, is currently under active reconnaissance by threat actors targeting Citrix NetScaler ADC and Gateway…
  • 0
  • 0
  • 0
  • 3h ago

CVE-2025-53521

Overview

  • F5
  • BIG-IP
15 Oct 2025
Published
28 Mar 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
19.16%
KEV

Description

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Statistics

  • 4 Posts
  • 1 Interaction
Last activity: 2 hours ago

Bluesky

Profile picture fallback
Cybersecurity News Everyday @hendryadrian.bsky.social
CISA adds CVE-2025-53521, a critical F5 BIG-IP APM flaw enabling pre-auth remote code execution (CVSS 9.3), to KEV after active exploitation. F5 updates TTPs and requires patches by 2026. #F5Security #Vulnerability #USA
  • 1
  • 0
  • 0
  • 22h ago
Profile picture fallback
r/blueteamsec bot @r-blueteamsec.bsky.social
K000156741: F5 BIG-IP APM vulnerability CVE-2025-53521 - from October - K000160486: Indicators of Compromise for c05d5254 from March
  • 0
  • 0
  • 0
  • 19h ago
Profile picture fallback
Ninja Owl @ninjaowl.ai
CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...
  • 0
  • 0
  • 0
  • 15h ago
Profile picture fallback
Philippe Vynckier @pvynckier.bsky.social
CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation thehackernews.com/2026/03/cisa...
  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-4851

Overview

  • CASIANO
  • GRID::Machine
  • GRID-Machine
29 Mar 2026
Published
29 Mar 2026
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization. GRID::Machine provides Remote Procedure Calls (RPC) over SSH for Perl. The client connects to remote hosts to execute code on them. A compromised or malicious remote host can execute arbitrary code back on the client through unsafe deserialization in the RPC protocol. read_operation() in lib/GRID/Machine/Message.pm deserialises values from the remote side using eval() $arg .= '$VAR1'; my $val = eval "no strict; $arg"; # line 40-41 $arg is raw bytes from the protocol pipe. A compromised remote host can embed arbitrary perl in the Dumper-formatted response: $VAR1 = do { system("..."); }; This executes on the client silently on every RPC call, as the return values remain correct. This functionality is by design but the trust requirement for the remote host is not documented in the distribution.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 4 hours ago

Fediverse

Profile picture fallback
Oriel Jutty :hhHHHAAAH: @barubary

@offseq

CRITICAL: CVE-2026-4851 affects CASIANO GRID::Machine

... which is abandonware last updated in 2011.

  • 0
  • 1
  • 0
  • 4h ago
Profile picture fallback
Offensive Sequence @offseq

⚠️ CRITICAL: CVE-2026-4851 affects CASIANO GRID::Machine (≤0.127). Malicious remote hosts can trigger client-side RCE via unsafe eval() deserialization. Only connect to trusted hosts & review code paths. Details: radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 8h ago

CVE-2025-33073

Overview

  • Microsoft
  • Windows 10 Version 1507
10 Jun 2025
Published
26 Feb 2026
Updated
CVSS v3.1
HIGH (8.8)
EPSS
41.04%
KEV

Description

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

Statistics

  • 3 Posts
Last activity: 6 hours ago

Bluesky

Profile picture fallback
r/blueteamsec bot @r-blueteamsec.bsky.social
Reflecting on Your Tier Model: CVE-2025-33073 and the One-Hop Problem
  • 0
  • 0
  • 1
  • 18h ago
Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 CVE-2025-33073 : élévation de privilèges SYSTEM via délégation Kerberos non contrainte 📝 ## 🔍 Contexte Article publié le 27 mars 2026 par P… https://cyberveille.ch/posts/2026-03-28-cve-2025-33073-elevation-de-privileges-system-via-delegation-kerberos-non-contrainte/ #Active_Directory #Cyberveille
  • 0
  • 0
  • 0
  • 6h ago

CVE-2026-33017

Overview

  • langflow-ai
  • langflow
20 Mar 2026
Published
26 Mar 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
5.65%
KEV

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

Statistics

  • 2 Posts
Last activity: 21 hours ago

Fediverse

Profile picture fallback
Steele Fortress @steelefortress

CISA just added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog and both deserve your immediate attention.

First up is CVE-2026-33017, a code injection flaw in Langflow, the open-source AI workflow builder that has exploded in popularity.

Read more: steelefortress.com/7448up

  • 0
  • 0
  • 0
  • 23h ago

Bluesky

Profile picture fallback
Cybersecurity News Everyday @hendryadrian.bsky.social
Critical flaws in PTC Windchill/FlexPLM exploited with mitigations but no patch; Langflow CVE-2026-33017 active for RCE, upgrade to 1.9.0. Ransomware targets energy firms; Nova Scotia Power breached. #Germany #Ransomware #Canada
  • 0
  • 0
  • 0
  • 21h ago

CVE-2025-14325

Overview

  • Mozilla
  • Firefox
09 Dec 2025
Published
07 Jan 2026
Updated
CVSS
Pending
EPSS
0.09%
KEV

Description

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 4 hours ago

Bluesky

Profile picture fallback
r/blueteamsec bot @r-blueteamsec.bsky.social
CVE-2025-14325: SpiderMonkey Type Confusion in Baseline JIT Inline Cache - found via AI assisted fuzzing
  • 1
  • 1
  • 0
  • 4h ago

CVE-2026-27876

Overview

  • Grafana
  • Grafana Enterprise
27 Mar 2026
Published
28 Mar 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
0.08%
KEV

Description

A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

Statistics

  • 2 Posts
  • 5 Interactions
Last activity: 19 hours ago

Fediverse

Profile picture fallback
Luca Hammer @luca

- Syncthing got a 2.0 release and switched from LevelDB to SQLite github.com/syncthing/syncthing
- macOS did that weird (a) Upgrade support.apple.com/de-de/126604 and is now at 2.6.4 with 8 (eight!) new emojis support.apple.com/en-us/122868
- Grafana security fix 12.4.1 -> 12.4.2 grafana.com/blog/grafana-secur
- TandoorRecipes got shared shopping lists and pantry inventory with 2.6.0 and an security update to 2.6.1 github.com/TandoorRecipes/reci
- Grist, qbittorrent and smokeping got updates for their containers. I haven't figured out what changed. hub.docker.com/r/gristlabs/gri github.com/linuxserver/docker- github.com/linuxserver/docker-
- Redis 8.6.2 with some bugfixes github.com/redis/redis/releases
- Home Assistant 2026.3.3 -> 2026.3.4. Nothing interesting. github.com/home-assistant/core
- oh-my-zsh with tiny changes github.com/ohmyzsh/ohmyzsh/com
- Next section is done by homebrew. I don't even know what half of the stuff is used for. Don't judge for having fish and zsh.
ffmpeg 8.0.1_4 -> 8.1
pandoc 3.9 -> 3.9.0.2
nghttp2 1.68.0_1 -> 1.68.1
simdjson 4.4.0 -> 4.4.2
freetype 2.14.2 -> 2.14.3
cryptography 46.0.5 -> 46.0.6
ipython 9.11.0 -> 9.12.0
libavif 1.4.0 -> 1.4.1
harfbuzz 13.1.1 -> 13.2.1
glib 2.86.4 -> 2.88.0
aom 3.13.1 -> 3.13.2
svt-av1 4.0.1 -> 4.1.0
libnghttp2 1.68.0 -> 1.68.1
openexr 3.4.6 -> 3.4.8
ca-certificates 2025-12-02 -> 2026-03-19
esphome 2026.2.4 -> 2026.3.1
jupyterlab 4.5.6 -> 4.5.6_1
ada-url 3.4.3 -> 3.4.4
node 25.8.1_1 -> 25.8.2
fish 4.5.0 -> 4.6.0
icu4c@78 78.2 -> 78.3
jpeg-turbo 3.1.3 -> 3.1.4
- tailscale 1.96.2 now with easy file transfers "taildrop" tailscale.com/changelog
- Xcode 26.4 developer.apple.com/documentat

I haven't touched my desktop yet and probably won't.

Edit 1
I missed the Nextcloud update because I use that weird Nextcloud All-In-One container. nextcloud.com/changelog/

Edit 2
How did I miss the Mastodon upgrade from 4.5.7 to 4.5.8. I may be gone for a moment. github.com/mastodon/mastodon/r

Edit 3
Why do I run a server in the garage?
evcc 0.209.6 -> 0.303.2 github.com/evcc-io/evcc/releas

  • 1
  • 4
  • 0
  • 23h ago

Bluesky

Profile picture fallback
r/blueteamsec bot @r-blueteamsec.bsky.social
Grafana security release: Critical and high severity security fixes for CVE-2026-27876 and CVE-2026-27880 | Grafana Labs
  • 0
  • 0
  • 0
  • 19h ago

CVE-2026-27880

Overview

  • Grafana
  • Grafana
27 Mar 2026
Published
27 Mar 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.01%
KEV

Description

The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

Statistics

  • 2 Posts
  • 5 Interactions
Last activity: 19 hours ago

Fediverse

Profile picture fallback
Luca Hammer @luca

- Syncthing got a 2.0 release and switched from LevelDB to SQLite github.com/syncthing/syncthing
- macOS did that weird (a) Upgrade support.apple.com/de-de/126604 and is now at 2.6.4 with 8 (eight!) new emojis support.apple.com/en-us/122868
- Grafana security fix 12.4.1 -> 12.4.2 grafana.com/blog/grafana-secur
- TandoorRecipes got shared shopping lists and pantry inventory with 2.6.0 and an security update to 2.6.1 github.com/TandoorRecipes/reci
- Grist, qbittorrent and smokeping got updates for their containers. I haven't figured out what changed. hub.docker.com/r/gristlabs/gri github.com/linuxserver/docker- github.com/linuxserver/docker-
- Redis 8.6.2 with some bugfixes github.com/redis/redis/releases
- Home Assistant 2026.3.3 -> 2026.3.4. Nothing interesting. github.com/home-assistant/core
- oh-my-zsh with tiny changes github.com/ohmyzsh/ohmyzsh/com
- Next section is done by homebrew. I don't even know what half of the stuff is used for. Don't judge for having fish and zsh.
ffmpeg 8.0.1_4 -> 8.1
pandoc 3.9 -> 3.9.0.2
nghttp2 1.68.0_1 -> 1.68.1
simdjson 4.4.0 -> 4.4.2
freetype 2.14.2 -> 2.14.3
cryptography 46.0.5 -> 46.0.6
ipython 9.11.0 -> 9.12.0
libavif 1.4.0 -> 1.4.1
harfbuzz 13.1.1 -> 13.2.1
glib 2.86.4 -> 2.88.0
aom 3.13.1 -> 3.13.2
svt-av1 4.0.1 -> 4.1.0
libnghttp2 1.68.0 -> 1.68.1
openexr 3.4.6 -> 3.4.8
ca-certificates 2025-12-02 -> 2026-03-19
esphome 2026.2.4 -> 2026.3.1
jupyterlab 4.5.6 -> 4.5.6_1
ada-url 3.4.3 -> 3.4.4
node 25.8.1_1 -> 25.8.2
fish 4.5.0 -> 4.6.0
icu4c@78 78.2 -> 78.3
jpeg-turbo 3.1.3 -> 3.1.4
- tailscale 1.96.2 now with easy file transfers "taildrop" tailscale.com/changelog
- Xcode 26.4 developer.apple.com/documentat

I haven't touched my desktop yet and probably won't.

Edit 1
I missed the Nextcloud update because I use that weird Nextcloud All-In-One container. nextcloud.com/changelog/

Edit 2
How did I miss the Mastodon upgrade from 4.5.7 to 4.5.8. I may be gone for a moment. github.com/mastodon/mastodon/r

Edit 3
Why do I run a server in the garage?
evcc 0.209.6 -> 0.303.2 github.com/evcc-io/evcc/releas

  • 1
  • 4
  • 0
  • 23h ago

Bluesky

Profile picture fallback
r/blueteamsec bot @r-blueteamsec.bsky.social
Grafana security release: Critical and high severity security fixes for CVE-2026-27876 and CVE-2026-27880 | Grafana Labs
  • 0
  • 0
  • 0
  • 19h ago

CVE-2026-5036

Overview

  • Tenda
  • 4G06
29 Mar 2026
Published
29 Mar 2026
Updated
CVSS v4.0
HIGH (8.7)
EPSS
Pending
KEV

Description

A vulnerability was found in Tenda 4G06 04.06.01.29. This vulnerability affects the function fromDhcpListClient of the file /goform/DhcpListClient of the component Endpoint. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used.

Statistics

  • 1 Post
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Offensive Sequence @offseq

🚨 CVE-2026-5036: HIGH severity stack buffer overflow in Tenda 4G06 (04.06.01.29) enables remote code execution. Exploit code is public — patch or mitigate now. Watch for attacks on /goform/DhcpListClient. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-4987

Overview

  • brainstormforce
  • SureForms – Contact Form, Payment Form & Other Custom Form Builder
28 Mar 2026
Published
28 Mar 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.07%
KEV

Description

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a payment validation solely based on the value of a user-controlled parameter. This makes it possible for unauthenticated attackers to bypass configured form payment-amount validation and create underpriced payment/subscription intents by setting form_id to 0.

Statistics

  • 1 Post
Last activity: 10 hours ago

Fediverse

Profile picture fallback
Offensive Sequence @offseq

⚠️ CVE-2026-4987 (HIGH): SureForms plugin for WordPress lets attackers bypass payment amount validation by setting form_id to 0 — no auth needed, all versions <=2.5.2 at risk. Patch or mitigate now! radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 10h ago
Showing 1 to 10 of 27 CVEs