CVE-2025-40536

Overview

SolarWinds
Web Help Desk

28 Jan 2026

Published

12 Feb 2026

Updated

CVSS v3.1

HIGH (8.1)

EPSS

27.82%

MITRE

KEV

Description

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.

Statistics

2 Posts
2 Interactions

Last activity: Last hour

Fediverse

Dark Web Informer :verified_paw: @DarkWebInformer

‼️ CISA added one more vulnerability to the KEV Catalog today...

CVE-2025-40536: SolarWinds Web Help Desk Security Control Bypass Vulnerability: SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.

0
2
0
6h ago

Bluesky

ohhara @shiojiri.com

CVE-2024-43468 Microsoft Configuration Manager SQL Injection Vulnerability CVE-2025-15556 Notepad++ Download of Code Without Integrity Check Vulnerability CVE-2025-40536 SolarWinds Web Help Desk Security Control Bypass Vulnerability CVE-2026-20700 Apple Multiple Buffer Overflow Vulnerability

0
0
0
Last hour

CVE-2026-26234

Overview

ALBRECHT JUNG GMBH & CO. KG
JUNG Smart Visu Server

12 Feb 2026

Published

12 Feb 2026

Updated

CVSS v4.0

HIGH (8.7)

EPSS

0.07%

MITRE

KEV

Description

JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host header. Attackers can manipulate proxied requests to generate tainted responses, enabling cache poisoning, potential phishing, and redirecting users to malicious domains.

Statistics

1 Post
1 Interaction

Last activity: 15 hours ago

Fediverse

Offensive Sequence @offseq

🔎 CVE-2026-26234 (HIGH): JUNG Smart Visu Server (v1.0.830 – 1.1.1050) allows unauthenticated X-Forwarded-Host header injection — leads to cache poisoning, phishing, and redirects. Patch when available, restrict access, monitor logs. https://radar.offseq.com/threat/cve-2026-26234-improper-neutralization-of-http-hea-13dc0f5b #OffSeq #Vuln #IoT

1
0
0
15h ago

CVE-2026-25949

Overview

traefik
traefik

12 Feb 2026

Published

12 Feb 2026

Updated

CVSS v3.1

HIGH (7.5)

EPSS

Pending

MITRE

KEV

Description

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.

Statistics

1 Post
1 Interaction

Last activity: 1 hour ago

Fediverse

DB Tech @dbtechyt

Traefik v3.6.8 just dropped! Crucial security update fixing CVE-2026-25949 is LIVE. Plus, enjoy smoother ACME certs, stronger healthchecks, & better TLS stability. Upgrade now!

More info: https://github.com/traefik/traefik/releases/tag/v3.6.8

#selfhosted #homelab

1
0
0
1h ago

CVE-2026-20617

Overview

Apple
macOS

11 Feb 2026

Published

11 Feb 2026

Updated

CVSS

Pending

EPSS

0.02%

MITRE

KEV

Description

A race condition was addressed with improved state handling. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An app may be able to gain root privileges.

Statistics

1 Post
1 Interaction

Last activity: 22 hours ago

Fediverse

Offensive Sequence @offseq

🚨 CVE-2026-20617 (CRITICAL): Race condition lets malicious apps escalate to root on macOS & Apple OS. No exploits in the wild yet — patch to Sonoma 14.8.4, Tahoe 26.3 ASAP! https://radar.offseq.com/threat/cve-2026-20617-an-app-may-be-able-to-gain-root-pri-42394d40 #OffSeq #macOS #Apple #Infosec #CVE202620617

1
0
0
22h ago

CVE-2026-24061

Overview

GNU
Inetutils

21 Jan 2026

Published

10 Feb 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

37.88%

MITRE

KEV

Description

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Statistics

1 Post
1 Interaction

Last activity: 5 hours ago

Fediverse

tobru 🇨🇭 🧑‍🚒 @tobru

2026-01-14: The Day the telnet Died

"On January 14, 2026, global telnet traffic observed by GreyNoise sensors fell off a cliff. A 59% sustained reduction, eighteen ASNs going completely silent, five countries vanishing from our data entirely. Six days later, CVE-2026-24061 dropped. Coincidence is one explanation."

Link: https://www.labs.greynoise.io/grimoire/2026-02-10-telnet-falls-silent/

#linkdump #blogpost #filtering #internet #iso #security #telnet

1
0
0
5h ago

CVE-2026-26215

Overview

zyddnys
manga-image-translator
manga-image-translator

11 Feb 2026

Published

12 Feb 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

0.13%

MITRE

KEV

Description

manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simple_execute/{method} and /execute/{method} deserialize attacker-controlled request bodies using pickle.loads() without validation. Although a nonce-based authorization check is intended to restrict access, the nonce defaults to an empty string and the check is skipped, allowing remote attackers to execute arbitrary code in the server context by sending a crafted pickle payload.

Statistics

1 Post
1 Interaction

Last activity: 20 hours ago

Fediverse

Offensive Sequence @offseq

CVE-2026-26215: CRITICAL RCE in zyddnys manga-image-translator (beta-0.3 & earlier). Unauthenticated attackers can exploit unsafe pickle.loads() in FastAPI endpoints to execute code. Disable endpoints & monitor for threats! https://radar.offseq.com/threat/cve-2026-26215-cwe-502-deserialization-of-untruste-e3572f04 #OffSeq #CVE202626215 #infosec

0
1
0
20h ago

CVE-2026-25676

Overview

M-Audio
M-Track Duo HD

12 Feb 2026

Published

12 Feb 2026

Updated

CVSS v3.0

HIGH (7.8)

EPSS

0.01%

MITRE

KEV

Description

The installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrator privileges.

Statistics

1 Post

Last activity: 18 hours ago

Fediverse

Offensive Sequence @offseq

⚠️ CVE-2026-25676: HIGH-severity DLL search path vuln in M-Audio M-Track Duo HD v1.0.0 installer. Local attackers can hijack DLLs to run code as admin. Restrict installer use, monitor for patches! https://radar.offseq.com/threat/cve-2026-25676-uncontrolled-search-path-element-in-108bd32e #OffSeq #Vulnerability #Infosec #CVE2026_25676

0
0
0
18h ago

CVE-2021-44228

Overview

Apache Software Foundation
Apache Log4j2

10 Dec 2021

Published

21 Oct 2025

Updated

CVSS

Pending

EPSS

94.36%

MITRE

KEV

Description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Statistics

1 Post

Last activity: 7 hours ago

Bluesky

Undercode Testing @undercode.bsky.social

Zero-Day to Zero Trust: Inside the Log4Shell Apocalypse and How AI-Powered Hardening Can Save Your Stack + Video Introduction: In December 2021, the cybersecurity world shuddered as the Log4Shell vulnerability (CVE-2021-44228) tore through enterprise environments, earning a perfect 10.0 CVSS score…

0
0
0
7h ago

CVE-2026-26216

Overview

unclecode
Crawl4AI
crawl4ai

12 Feb 2026

Published

12 Feb 2026

Updated

CVSS v4.0

CRITICAL (10.0)

EPSS

Pending

MITRE

KEV

Description

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.

Statistics

1 Post

Last activity: 9 hours ago

Fediverse

Offensive Sequence @offseq

⚠️ CRITICAL RCE (CVE-2026-26216) in Crawl4AI <0.8.0: /crawl endpoint allows unauthenticated Python code injection via exec(), enabling server takeover & lateral movement. Restrict access, monitor activity, upgrade ASAP. https://radar.offseq.com/threat/cve-2026-26216-cwe-94-improper-control-of-generati-09f71e54 #OffSeq #CVE202626216 #infosec #RCE

0
0
0
9h ago

CVE-2020-37178

Overview

Keepass
KeePass Password Safe

11 Feb 2026

Published

11 Feb 2026

Updated

CVSS v4.0

MEDIUM (4.6)

EPSS

0.02%

MITRE

KEV

Description

KeePass Password Safe versions before 2.44 contain a denial of service vulnerability in the help system's HTML handling. Attackers can trigger the vulnerability by dragging and dropping malicious HTML files into the help area, potentially causing application instability or crash.

Statistics

2 Posts

Last activity: 16 hours ago

Fediverse

hbrpgm @hbrks

✨ #Cve-2020-37178: Denial-of-Service-Schwachstelle in #Keepass
Eine Code-Injection-Schwachstelle im Hilfesystem der Passwort-Manager-Software kann zu Anwendungsabstürzen führen, stellt jedoch ein moderates Risiko dar.

🔗 https://p4u.xyz/ID_N29YJ_DS/1 (🇩🇪🇺🇸🇫🇷)

#Cybersecurity #Security #Threatintel #Osint #Alert #Bot

0
0
0
16h ago

hbrpgm @hbrks

✨ #Cve-2020-37178: A Denial-of-Service Threat to #Keepass
A high-severity code injection flaw in #Keepass's help system, while not actively exploited, presents a tangible risk of application crashes and workflow disruption through crafted HTML content.

🔗 https://p4u.xyz/ID_N29YJ_DS/1 (🇩🇪🇺🇸🇫🇷)

#Cybersecurity #Security #Threatintel #Osint #Alert #Bot

0
0
0
16h ago