24h | 7d | 30d

CVE-2026-40050

Overview

  • CrowdStrike
  • LogScale Self-Hosted
21 Apr 2026
Published
21 Apr 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.26%
KEV

Description

CrowdStrike has released security updates to address a critical unauthenticated path traversal vulnerability (CVE-2026-40050) in LogScale. This vulnerability only requires mitigation by customers that host specific versions of LogScale and does not affect Next-Gen SIEM customers. The vulnerability exists in a specific cluster API endpoint that, if exposed, allows a remote attacker to read arbitrary files from the server filesystem without authentication. Next-Gen SIEM customers are not affected and do not need to take any action. CrowdStrike mitigated the vulnerability for LogScale SaaS customers by deploying network-layer blocks to all clusters on April 7, 2026. We have proactively reviewed all log data and there is no evidence of exploitation. LogScale Self-hosted customers should upgrade to a patched version immediately to remediate the vulnerability. CrowdStrike identified this vulnerability during continuous and ongoing product testing.

Statistics

  • 1 Post
  • 6 Interactions
Last activity: 1 hour ago

Fediverse

Profile picture fallback
cR0w :gayint: :ifin: :brdKnife: @cR0w

@reverseics I went to the Crowdstrike site to see if there was a new advisory and found this instead. Obviously better than any advisory. Even a ../ in CVE-2026-40050.

  • 2
  • 4
  • 0
  • 1h ago

CVE-2023-33538

Overview

  • Pending
07 Jun 2023
Published
20 Dec 2025
Updated
CVSS
Pending
EPSS
89.90%
KEV

Description

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

Statistics

  • 2 Posts
  • 5 Interactions
Last activity: 22 hours ago

Fediverse

Profile picture fallback
Patrick C Miller :donor: @patrickcmiller

CVE-2023-33538 under attack for a year, but exploitation still unsuccessful securityaffairs.com/191040/hac

  • 2
  • 3
  • 1
  • 22h ago

CVE-2026-5752

Overview

  • Cohere
  • cohere-terrarium
14 Apr 2026
Published
21 Apr 2026
Updated
CVSS
Pending
EPSS
0.02%
KEV

Description

Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 12 hours ago

Fediverse

Profile picture fallback
DragonJAR @dragonjar

En las últimas 24 horas se reportaron accesos no autorizados al modelo de IA Mythos de Anthropic, una vulnerabilidad crítica en su plataforma que permite ejecución remota de código, ataques simultáneos del ransomware Kyber en Windows y ESXi, brechas en gestión de tokens OAuth en Vercel y un fallo en Cohere AI que da acceso root, todo mientras Mythos ayuda a detectar más de 270 vulnerabilidades en Firefox 150, destacando el doble filo de la inteligencia artificial en ciberseguridad. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:

🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 22/04/26 📆 |====

🔐 ACCESO NO AUTORIZADO AL MODELO DE IA MYTHOS DE ANTHROPIC

Un grupo reducido de usuarios ha logrado ingresar sin permiso al avanzado modelo de inteligencia artificial Mythos desarrollado por Anthropic PBC. Esta tecnología, considerada altamente potente, podría ser utilizada para facilitar ataques cibernéticos de gran impacto, aumentando el riesgo de explotación masiva si no se controlan correctamente sus accesos. Conocer este incidente es clave para entender las amenazas emergentes en IA. Descubre todos los detalles sobre esta brecha en el acceso a Mythos aquí 👉 djar.co/uEVw

⚠️ VULNERABILIDAD CRÍTICA EN MCP DE ANTHROPIC QUE PERMITE EJECUCIÓN REMOTA DE CÓDIGO

Una falla grave en el MCP (Microcontroller Platform) de Anthropic ha sido descubierta, permitiendo a atacantes ejecutar código de forma remota. Este tipo de vulnerabilidad abre la puerta a comprometer sistemas completos desde ubicaciones externas, subrayando la importancia de parches inmediatos y auditorías constantes en infraestructuras críticas. Infórmate sobre cómo proteger tus sistemas frente a esta amenaza aquí 👉 djar.co/ASyow

💀 DOBLE AMENAZA DEL RANSOMWARE KYBER EN WINDOWS Y ESXI

El ransomware Kyber está desplegando ataques simultáneos en sistemas Windows y ESXi, utilizando técnicas avanzadas que complican la recuperación y aumentan el impacto económico. Esta doble vectorialidad hace indispensable revisar las defensas en servidores virtualizados y estaciones de trabajo para minimizar riesgos. Aprende a identificar y mitigar estos ataques con este análisis completo 👉 djar.co/zJlX

🔓 ANÁLISIS DEL INCUMPLIMIENTO DE VERCEL: EL CAMINO DEL ATAQUE A TRAVÉS DE UN TOKEN OAUTH

Un estudio detallado revela cómo una brecha en la gestión de tokens OAuth permitió a atacantes en Vercel iniciar ataques de identidad, comprometiendo credenciales y acceso a recursos críticos. Este caso ejemplifica la necesidad de reforzar la seguridad en flujos de autenticación y gestión de tokens para evitar ataques sofisticados en entornos de desarrollo y nube. Profundiza en esta investigación y fortalece tus medidas aquí 👉 djar.co/4poWFN

🐞 FALLA EN COHERE AI TERRARIUM QUE PERMITE EJECUCIÓN ROOT Y ESCAPE DE CONTENEDOR

Se ha identificado la vulnerabilidad CVE-2026-5752 en la sandbox Terrarium de Cohere AI, que facilita la ejecución de código con privilegios root y la evasión del entorno aislado mediante manipulación del prototipo Pyodide. Este tipo de fallo compromete la integridad del entorno de ejecución y puede derivar en acceso completo al sistema host. Conoce los detalles técnicos y recomendaciones para mitigarla aquí 👉 djar.co/qThy

🕵️ MOZILLA Y EL MODELO DE IA MYTHOS: DETECTAN 271 VULNERABILIDADES DE DÍA CERO EN FIREFOX 150

El CTO de Mozilla ha reportado que el modelo Mythos de Anthropic fue capaz de identificar 271 vulnerabilidades desconocidas en la versión 150 de Firefox, demostrando el poder de la inteligencia artificial aplicada a la seguridad informática. Este avance promete acelerar la detección y resolución de vulnerabilidades críticas de forma automatizada, fortaleciendo la protección de millones de usuarios. Entérate cómo la IA está revolucionando la ciberseguridad aquí 👉 djar.co/GQzTtv

  • 1
  • 1
  • 0
  • 12h ago

CVE-2026-40933

Overview

  • FlowiseAI
  • Flowise
21 Apr 2026
Published
22 Apr 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
0.07%
KEV

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. The vulnerability lies in a bug in the input sanitization from the “Custom MCP” configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example "npx" can be combined with code execution arguments ("-c touch /tmp/pwn") that enable direct code execution on the underlying OS. This vulnerability is fixed in 3.1.0.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 20 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

🚨 CRITICAL: CVE-2026-40933 in FlowiseAI Flowise (< 3.1.0) allows authenticated OS command injection via unsafe MCP adapter serialization. Upgrade to 3.1.0+ to fully mitigate. CVSS 10 — patch now! radar.offseq.com/threat/cve-20

  • 1
  • 0
  • 0
  • 20h ago

CVE-2026-28950

Overview

  • Apple
  • iOS and iPadOS
22 Apr 2026
Published
22 Apr 2026
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2. Notifications marked for deletion could be unexpectedly retained on the device.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Stefan Schmidt @zaphodb

support.apple.com/en-us/127002
Impact: Notifications marked for deletion could be unexpectedly retained on the device

Description: A logging issue was addressed with improved data redaction.

CVE-2026-28950

<3

  • 1
  • 0
  • 0
  • 1h ago

CVE-2026-4747

Overview

  • FreeBSD
  • FreeBSD
26 Mar 2026
Published
02 Apr 2026
Updated
CVSS
Pending
EPSS
0.08%
KEV

Description

Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer, but fails to ensure that the buffer is sufficiently large, and a malicious client can trigger a stack overflow. Notably, this does not require the client to authenticate itself first. As kgssapi.ko's RPCSEC_GSS implementation is vulnerable, remote code execution in the kernel is possible by an authenticated user that is able to send packets to the kernel's NFS server while kgssapi.ko is loaded into the kernel. In userspace, applications which have librpcgss_sec loaded and run an RPC server are vulnerable to remote code execution from any client able to send it packets. We are not aware of any such applications in the FreeBSD base system.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 7 hours ago

Fediverse

Profile picture fallback
iam-py-test :transgender_flag: @iampytest1

@pgl Related article from the same person: flyingpenguin.com/freebsd-cve-

  • 0
  • 1
  • 0
  • 7h ago

CVE-2026-40906

Overview

  • electric-sql
  • electric
21 Apr 2026
Published
22 Apr 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
0.03%
KEV

Description

Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 17 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

⚠️ CRITICAL: ElectricSQL (v1.1.12 - <1.5.0) has a CVE-2026-40906 SQL injection in /v1/shape API. Authenticated users can fully compromise PostgreSQL DB. Upgrade to 1.5.0+ now! radar.offseq.com/threat/cve-20

  • 0
  • 1
  • 0
  • 17h ago

CVE-2026-20133

Overview

  • Cisco
  • Cisco Catalyst SD-WAN Manager
25 Feb 2026
Published
22 Apr 2026
Updated
CVSS v3.1
MEDIUM (6.5)
EPSS
1.39%
KEV

Description

A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

Statistics

  • 1 Post
Last activity: 17 hours ago

Bluesky

Profile picture fallback
キタきつね @kitafox.bsky.social
CISAは、Cisco Catalyst SD-WAN Managerの別の脆弱性（CVE-2026-20133）が悪用されたことを警告した CISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133) #HelpNetSecurity (Apr 21) www.helpnetsecurity.com/2026/04/21/c...
  • 0
  • 0
  • 0
  • 17h ago

CVE-2026-35328

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 2 Posts
Last activity: 6 hours ago

Bluesky

Profile picture fallback
ferramentaslinux.bsky.social @ferramentaslinux.bsky.social
You patched the StrongSwan infinite loop (CVE-2026-35328). Good. But do you know why your config was vulnerable? tinyurl.com/38zeyuwe
  • 0
  • 0
  • 0
  • 6h ago
Profile picture fallback
ferramentaslinux.bsky.social @ferramentaslinux.bsky.social
StrongSwan crashed again? CVE-2026-35328 isn't the last one. Stop playing whack-a-mole with patches. This book teaches crash-resistant VPN configs → amzn.to/4cEV8ea I earn a commission if you make a purchase. #ad #LinuxSecurity
  • 0
  • 0
  • 0
  • 6h ago

CVE-2026-4119

Overview

  • jppreus
  • Create DB Tables
22 Apr 2026
Published
22 Apr 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
0.02%
KEV

Description

The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.1. The plugin registers admin_post action hooks for creating tables (admin_post_add_table) and deleting tables (admin_post_delete_db_table) without implementing any capability checks via current_user_can() or nonce verification via wp_verify_nonce()/check_admin_referer(). The admin_post hook only requires the user to be logged in, meaning any authenticated user including Subscribers can access these endpoints. The cdbt_delete_db_table() function takes a user-supplied table name from $_POST['db_table'] and executes a DROP TABLE SQL query, allowing any authenticated attacker to delete any database table including critical WordPress core tables such as wp_users or wp_options. The cdbt_create_new_table() function similarly allows creating arbitrary tables. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary database tables and delete any existing database table, potentially destroying the entire WordPress installation.

Statistics

  • 1 Post
Last activity: 14 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

🚨 CVE-2026-4119: CRITICAL vuln in WordPress Create DB Tables plugin (≤1.2.1). Any authenticated user can create/delete DB tables, risking total site loss. Disable or restrict roles until patched. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 14h ago
Showing 11 to 20 of 52 CVEs