24h | 7d | 30d

CVE-2026-13639

Overview

  • Synology
  • DiskStation Manager (DSM)
18 Sep 2026
Published
18 Sep 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.69%
KEV

Description

An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Statistics

  • 2 Posts
  • 6 Interactions
Last activity: Last hour

Fediverse

Profile picture fallback
Marco Hoffmann @marcohoffmann

⚠️ Synology-NAS: Die Ransomware C3RB3R verschlüsselt seit Oktober Daten (.L0CK3D, Lösegeldnote read-me3.txt). Synology warnt heute offiziell.

Ausgenutzt werden kritische Lücken ohne Login: laut 360 CVE-2026-13639/-13684 (gepatcht 18.9.), laut Synology CVE-2024-10441.

Mindestens nötig: DSM 7.4-90075 / 7.3.2-86009-4 / 7.2.2-72806-9 / 7.2.1-69057-12.

DSM nicht offen ins Netz, nur per VPN. Offline-Backup prüfen!

synology.com/security/advisory

#Synology #NAS #Ransomware #InfoSec #ITSicherheit #Homelab

  • 4
  • 1
  • 0
  • 17h ago

Bluesky

Profile picture fallback
Blockchain Report @blockchainreport.bsky.social
Synology NAS users in South Korea hit by C3RB3R ransomware! Attackers exploit old DSM vulnerabilities (CVE-2026-13639, CVE-2026-13684). Ransom: ~ $2,952 in Bitcoin. Synology urges IMMEDIATE updates to patched DSM versions! Don't delay! #crypto #blockchain #news
  • 0
  • 1
  • 0
  • Last hour

CVE-2025-8088

Overview

  • win.rar GmbH
  • WinRAR
08 Aug 2025
Published
11 Aug 2026
Updated
CVSS v4.0
HIGH (8.4)
EPSS
94.01%
KEV

Description

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

Statistics

  • 1 Post
  • 3 Interactions
Last activity: 1 hour ago

Bluesky

Profile picture fallback
ESET Research @esetresearch.bsky.social
We also investigated a 🇷🇺-aligned campaign exploiting MDaemon mail servers via CVE-2025-8088 in ClamAV (originally a WinRAR flaw we uncovered last year), delivering two backdoors: #HELLAGE and #HELLTAG, with no user interaction required. 3/4
  • 1
  • 2
  • 0
  • 1h ago

CVE-2026-61991

Overview

  • Ajax Load More
  • AjaxLoadMore Cache
29 Oct 2026
Published
29 Oct 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
Pending
KEV

Description

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 17 hours ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-61991 | CVSS 10.0 Critical AjaxLoadMore Cache RCE CVE-2026-61991 describes an unauthenticated remote code execution vulnerability in the WordPress AjaxLoadMore Cache plugin through version 3.1.1, according to the NVD… Full analysis: https://t.me/aiutocomputerhelp_lab/1341
  • 1
  • 1
  • 0
  • 17h ago

CVE-2026-93971

Overview

  • aiyiyi121
  • SxDevOps
20 Sep 2026
Published
21 Sep 2026
Updated
CVSS v4.0
MEDIUM (6.9)
EPSS
0.54%
KEV

Description

A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevops/settings.py. This manipulation causes information disclosure. It is possible to initiate the attack remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 7 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-93971 info disclosure in aiyiyi121 SxDevOps 1.0/1.1, remotely exploitable, CVSS 5.3. Patch exists - update now. #CVE #infosec valtersit.com/cve/CVE-2026-939

  • 0
  • 1
  • 0
  • 7h ago

CVE-2026-94055

Overview

  • Exim
  • Exim
19 Sep 2026
Published
21 Sep 2026
Updated
CVSS v3.1
LOW (3.7)
EPSS
0.29%
KEV

Description

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.

Statistics

  • 1 Post
Last activity: 22 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-94055: use-after-free in Exim before 4.100.1 with non-default GnuTLS TLS settings. CVSS 3.7. Low severity, patch still under review, so track it and upgrade when 4.100.1 lands. #CVE #infosec #Exim valtersit.com/cve/CVE-2026-940

  • 0
  • 0
  • 0
  • 22h ago

CVE-2026-115995

Overview

  • Unitree Robotics
  • Unitree Go2
24 Oct 2026
Published
29 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.4)
EPSS
1.38%
KEV

Description

A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."

Statistics

  • 1 Post
Last activity: 17 hours ago

Bluesky

Profile picture fallback
/r/netsec @r-netsec-bot.bsky.social
Stopping Remote Code Execution with Sandboxes, CVE-2026-115995: Rust Zip
  • 0
  • 0
  • 0
  • 17h ago

CVE-2026-116684

Overview

  • modelcontextprotocol
  • python-sdk
27 Oct 2026
Published
27 Oct 2026
Updated
CVSS v3.1
MEDIUM (6.8)
EPSS
0.36%
KEV

Description

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. This issue is fixed in versions 1.30.0 and 2.2.0.

Statistics

  • 2 Posts
Last activity: 21 hours ago

Fediverse

Profile picture fallback
The IT Nerd @The_IT_Nerd

New MCP Python SDK Vulnerability: Shakey Authentication Enables Unintended Access

A newly discovered vulnerability in the official Model Context Protocol (MCP) Python SDK, CVE-2026-116684, could allow an MCP server to accept valid authentication tokens intended for other services through faulty validation of a token's intended audience....

itnerd.blog/2026/10/29/new-mcp

  • 0
  • 0
  • 1
  • 21h ago

CVE-2026-117572

Overview

  • Unknown
  • WP Visitor Statistics (Real Time Traffic)
30 Oct 2026
Published
30 Oct 2026
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

WP Visitor Statistics (Real Time Traffic) < 8.8 exposes a HIGH severity SQL injection (CVE-2026-117572). Admins can execute unauthorized DB actions. Patch to 8.8+ to secure your site. radar.offseq.com/threat/the-wp

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-81654

Overview

  • Unknown
  • Photo Gallery, Sliders, Proofing and Themes
20 Sep 2026
Published
20 Sep 2026
Updated
CVSS
Pending
EPSS
0.21%
KEV

Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.

Statistics

  • 1 Post
Last activity: 14 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-81654: WordPress Photo Gallery plugin before 4.5.0 lets low-privilege gallery users change site-wide image settings (CVSS 3.1). Patch status unpatched. Update to 4.5.0 now. #CVE #WordPress #infosec valtersit.com/cve/CVE-2026-816

  • 0
  • 0
  • 0
  • 14h ago

CVE-2026-93965

Overview

  • aiyiyi121
  • SxDevOps
20 Sep 2026
Published
21 Sep 2026
Updated
CVSS v4.0
MEDIUM (5.1)
EPSS
1.93%
KEV

Description

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpoint_or_command causes command injection. The attack may be initiated remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. To fix this issue, it is recommended to deploy a patch. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Statistics

  • 1 Post
Last activity: 4 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-93965: command injection in SxDevOps 1.0/1.1 (CVSS 6.6), exploitable remotely via the MCP STDIO Server Management endpoint_or_command argument. Patch is under review. Apply it as soon as it is available. #CVE #infosec #cybersecurity valtersit.com/cve/CVE-2026-939

  • 0
  • 0
  • 0
  • 4h ago
Showing 21 to 30 of 80 CVEs