24h | 7d | 30d

CVE-2026-93909

Overview

  • IBM
  • WebSphere Application Server - Liberty
13 Oct 2026
Published
13 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
Pending
KEV

Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Patch four IBM WebSphere Liberty vulnerabilities, including critical 9.1-rated CVE-2026-93895 and CVE-2026-93909 authentication and access bypass flaws.

securityonline.info/critical-i

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-108398

Overview

  • Microsoft
  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
13 Oct 2026
Published
13 Oct 2026
Updated
CVSS v3.1
HIGH (8.8)
EPSS
Pending
KEV

Description

Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.

Statistics

  • 1 Post
Last activity: 3 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

The October 2026 Patch Tuesday fixes 1,414 flaws and three zero-day vulnerabilities, including an exploited Windows Shell bypass. Patch now.

securityonline.info/october-20

  • 0
  • 0
  • 0
  • 3h ago

CVE-2026-85948

Overview

  • Progress Software Corporation
  • MarkLogic Server
12 Oct 2026
Published
14 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.9)
EPSS
0.35%
KEV

Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.

Statistics

  • 1 Post
Last activity: 19 hours ago

Fediverse

Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

Progress Software disclosed 31 security flaws in MarkLogic Server, with five rated as high severity.

Affected releases include MarkLogic 11.x before 11.3.7 and 12.x before 12.1.0.

Fixes have been available since September 10 in versions 11.3.7 and 12.1.0.

Previous August patches do not provide protection against these newly detailed issues.

Notable flaws include CVE-2026-85947 and CVE-2026-85948, which carry CVSS scores of…

en.hacks.gr/krisima-kena-asfal

#MarkLogic #Database #Vulnerability #Patch

  • 0
  • 0
  • 0
  • 19h ago

CVE-2026-107204

Overview

  • LMCache
  • LMCache
07 Oct 2026
Published
07 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
0.77%
KEV

Description

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__, to import os and run operating system commands as the LMCache process.

Statistics

  • 1 Post
Last activity: 14 hours ago

Bluesky

Profile picture fallback
Checkmarx Zero @checkmarxzero.bsky.social
‼️ 5 LMCache CVEs disclosed. Two critical RCEs (CVSS 9.8): CVE-2026-105192 & CVE-2026-107204. Running LMCache? Check your exposure. Restrict ZeroMQ to trusted networks, firewall its port, and secure HTTP endpoints. AI infrastructure is production infrastructure. Secure it. #AppSec #CheckmarxZero
  • 0
  • 0
  • 0
  • 14h ago

CVE-2026-105192

Overview

  • LMCache
  • LMCache
  • lmcache
07 Oct 2026
Published
07 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.48%
KEV

Description

LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect.

Statistics

  • 1 Post
Last activity: 14 hours ago

Bluesky

Profile picture fallback
Checkmarx Zero @checkmarxzero.bsky.social
‼️ 5 LMCache CVEs disclosed. Two critical RCEs (CVSS 9.8): CVE-2026-105192 & CVE-2026-107204. Running LMCache? Check your exposure. Restrict ZeroMQ to trusted networks, firewall its port, and secure HTTP endpoints. AI infrastructure is production infrastructure. Secure it. #AppSec #CheckmarxZero
  • 0
  • 0
  • 0
  • 14h ago

CVE-2026-93895

Overview

  • IBM
  • WebSphere Application Server - Liberty
13 Oct 2026
Published
13 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
Pending
KEV

Description

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Patch four IBM WebSphere Liberty vulnerabilities, including critical 9.1-rated CVE-2026-93895 and CVE-2026-93909 authentication and access bypass flaws.

securityonline.info/critical-i

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-74034

Overview

  • Wazuh
  • wazuh-manager
13 Oct 2026
Published
13 Oct 2026
Updated
CVSS v4.0
HIGH (8.7)
EPSS
Pending
KEV

Description

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 10 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Fifteen Wazuh vulnerabilities, including two CVSS 9.4 flaws that allow remote code execution as root, are fixed in 4.14.8. Upgrade managers and agents now.

securityonline.info/wazuh-vuln

  • 1
  • 0
  • 0
  • 10h ago

CVE-2026-74040

Overview

  • Wazuh
  • wazuh-manager
13 Oct 2026
Published
13 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.4)
EPSS
Pending
KEV

Description

Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 10 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Fifteen Wazuh vulnerabilities, including two CVSS 9.4 flaws that allow remote code execution as root, are fixed in 4.14.8. Upgrade managers and agents now.

securityonline.info/wazuh-vuln

  • 1
  • 0
  • 0
  • 10h ago

CVE-2026-74041

Overview

  • Wazuh
  • wazuh-manager
13 Oct 2026
Published
13 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.4)
EPSS
Pending
KEV

Description

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 10 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Fifteen Wazuh vulnerabilities, including two CVSS 9.4 flaws that allow remote code execution as root, are fixed in 4.14.8. Upgrade managers and agents now.

securityonline.info/wazuh-vuln

  • 1
  • 0
  • 0
  • 10h ago

CVE-2026-107606

Overview

  • Swann Communications
  • SWIFI-SE2KIC
13 Oct 2026
Published
13 Oct 2026
Updated
CVSS v4.0
MEDIUM (6.9)
EPSS
Pending
KEV

Description

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 12 hours ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Cisa~ Unauthenticated local attackers can view live video or snapshots on firmware 2.0.22. - IOCs: CVE-2026-107605, CVE-2026-107606, CVE-2026-107607 - #CVE2026 #IoT #ThreatIntel
  • 0
  • 1
  • 0
  • 12h ago
Showing 91 to 100 of 115 CVEs