24h | 7d | 30d

CVE-2026-102608

Overview

  • ZoneMinder
  • zoneminder
16 Oct 2026
Published
16 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.0)
EPSS
Pending
KEV

Description

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.

Statistics

  • 1 Post
Last activity: 11 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

ZoneMinder <1.38.3 has a CRITICAL command injection (CVE-2026-102608). Attackers with monitor-create/edit perms can exploit export events to run commands as web server user. Upgrade to 1.38.3 ASAP. radar.offseq.com/threat/prior-

  • 0
  • 0
  • 0
  • 11h ago

CVE-2026-93399

Overview

  • ladela
  • Online Scheduling and Appointment Booking System – Bookly
25 Sep 2026
Published
26 Sep 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
0.37%
KEV

Description

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information via 'bookly_add_to_calendar' and permanently delete arbitrary non-completed bookings via 'bookly_rollback_order', which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.

Statistics

  • 1 Post
Last activity: 8 hours ago

Bluesky

Profile picture fallback
OpsMatters @opsmatters.com
The latest update for #Sentrium includes "How long does a penetration test take?" and "Critical Bookly IDOR Leads to Booking Disclosure and Deletion (CVE-2026-93399)". #Cybersecurity #PenTesting #infosec https://opsmtrs.com/3aPKkxS
  • 0
  • 0
  • 0
  • 8h ago

CVE-2026-105192

Overview

  • LMCache
  • LMCache
  • lmcache
07 Oct 2026
Published
07 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.48%
KEV

Description

LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect.

Statistics

  • 1 Post
Last activity: 9 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

LMCache CRITICAL RCE (CVE-2026-105192): Versions 0.3.9 – 0.5.5 allow unauthenticated remote code execution via unsafe pickle deserialization on ZeroMQ (port 5555). Upgrade to 0.5.6, restrict network exposure. radar.offseq.com/threat/lmcach

  • 0
  • 0
  • 0
  • 9h ago

CVE-2026-77166

Overview

  • Nextcloud
  • Collectives
21 Sep 2026
Published
21 Sep 2026
Updated
CVSS v3.0
LOW (2.4)
EPSS
0.28%
KEV

Description

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

Statistics

  • 1 Post
Last activity: 23 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-77166: unvalidated emoji field allows layout injection that can hide sidebar items. CVSS 2.4, low severity. Patch status unknown. Details: valtersit.com/cve/CVE-2026-771 #CVE #infosec

  • 0
  • 0
  • 0
  • 23h ago

CVE-2026-109786

Overview

  • fail2ban
  • fail2ban
13 Oct 2026
Published
15 Oct 2026
Updated
CVSS v3.1
MEDIUM (5.3)
EPSS
0.31%
KEV

Description

In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as "x VICTIM-SOURCE-IP-ADDRESS on" to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected.

Statistics

  • 1 Post
Last activity: 10 hours ago

Bluesky

Profile picture fallback
nixpkgs security changes @nixpkgssecuritychanges.gerbet.me
fail2ban: include fix for CVE-2026-109786 https://github.com/NixOS/nixpkgs/pull/574773 https://tracker.security.nixos.org/issues/NIXPKGS-2026-3023 #security
  • 0
  • 0
  • 0
  • 10h ago

CVE-2026-55105

Overview

  • laurent22
  • joplin
21 Sep 2026
Published
24 Sep 2026
Updated
CVSS v3.1
HIGH (7.7)
EPSS
0.50%
KEV

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the vendored fountain.js renderer into note output without sanitizing it. A malicious Fountain code block can therefore execute script when Fountain rendering is enabled in desktop or mobile clients, or when a note is published through Joplin Server where Fountain rendering is enabled by default. The script can read content subsequently loaded in the reused note viewer or, when published notes are served from the same domain as server content, access data available to an authenticated browser in the server origin. This issue is fixed in versions 3.6.15 and 3.7.2.

Statistics

  • 1 Post
Last activity: 8 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-55105 Joplin: malicious Fountain blocks run script via unsanitized renderer (XSS to RCE). CVSS 7.7. Patch under review - update to 3.6.15/3.7.2 when available. valtersit.com/cve/CVE-2026-551 #CVE #infosec #Joplin

  • 0
  • 0
  • 0
  • 8h ago

CVE-2026-111704

Overview

  • LangChat
  • langchat
16 Oct 2026
Published
16 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
Pending
KEV

Description

LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.

Statistics

  • 1 Post
Last activity: 5 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-111704: LangChat (≤commit 2a6285a) is affected by a CRITICAL missing authentication flaw (CVSS 9.8). Unauthenticated attackers can access REST APIs, read user credentials, and escalate privileges. Patch status unconfirmed. radar.offseq.com/threat/langch

  • 0
  • 0
  • 0
  • 5h ago

CVE-2026-111641

Overview

  • fastapiadmin
  • FastapiAdmin
16 Oct 2026
Published
16 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
Pending
KEV

Description

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-111641: FastapiAdmin <=3.0 has a CRITICAL auth bypass flaw — unauthenticated attackers can seize admin sessions via exposed endpoints. Restrict access & watch for abuse until a patch lands. Details: radar.offseq.com/threat/fastap

  • 0
  • 0
  • 0
  • 2h ago

CVE-2024-3400

Overview

  • Palo Alto Networks
  • PAN-OS
12 Apr 2024
Published
21 Oct 2025
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
100.00%
KEV

Description

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.

Statistics

  • 1 Post
Last activity: 9 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

GET /cve/CVE-2024-3400 returns one full record, no wrapper. Fields include cvss, epss, cisa_kev, poc_status and a ready-to-read report. One credit per record. valtersit.com/cve/pricing/

  • 0
  • 0
  • 0
  • 9h ago

CVE-2026-111862

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
Last activity: 8 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Update Rank Math SEO PRO to 3.0.124 now. CVE-2026-111862 is a critical supply-chain compromise actively exploited in the wild via embedded malware.

securityonline.info/rank-math-

  • 0
  • 0
  • 0
  • 8h ago
Showing 21 to 30 of 63 CVEs