24h | 7d | 30d

CVE-2026-25636

Overview

  • kovidgoyal
  • calibre
06 Feb 2026
Published
11 Feb 2026
Updated
CVSS v3.1
HIGH (8.2)
EPSS
0.01%
KEV

Description

calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an absolute filesystem path and opens it in read-write mode, even when it points outside the conversion extraction directory. This vulnerability is fixed in 9.2.0.

Statistics

  • 1 Post
Last activity: 13 hours ago

Bluesky

Profile picture fallback
nixpkgs security changes @nixpkgssecuritychanges.gerbet.me
[Backport release-25.11] calibre: apply fix for CVE-2026-25636 https://github.com/NixOS/nixpkgs/pull/489038 #security
  • 0
  • 0
  • 0
  • 13h ago

CVE-2026-26235

Overview

  • ALBRECHT JUNG GMBH & CO. KG
  • JUNG Smart Visu Server
12 Feb 2026
Published
12 Feb 2026
Updated
CVSS v4.0
HIGH (8.7)
EPSS
Pending
KEV

Description

JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or reboot the server. Attackers can send a single POST request to trigger the server reboot without requiring any authentication.

Statistics

  • 1 Post
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Offensive Sequence @offseq

🚨 CVE-2026-26235 (HIGH): JUNG Smart Visu Server 1.1.1050 lets unauthenticated users remotely shut down or reboot the server via POST request. Restrict network access, monitor logs, and await vendor patch. Details: radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-20654

Overview

  • Apple
  • macOS
11 Feb 2026
Published
11 Feb 2026
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

The issue was addressed with improved memory handling. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An app may be able to cause unexpected system termination.

Statistics

  • 1 Post
Last activity: 8 hours ago

Fediverse

Profile picture fallback
Speedyfriend67 @speedyfriend67

Got my first Apple CVE!
CVE-2026-20654

At the age of 19, I have finally achieved my goal.

Weird thing is, the 2025 CVE isn't addressed yet haha

More exciting news coming soon!

Thank you everyone for the support 🥹🙏

  • 0
  • 0
  • 0
  • 8h ago

CVE-2025-58060

Overview

  • OpenPrinting
  • cups
11 Sep 2025
Published
04 Nov 2025
Updated
CVSS v3.1
HIGH (8.0)
EPSS
0.05%
KEV

Description

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization: Basic ...` header, the password is not checked. This results in authentication bypass. Any configuration that allows an `AuthType` that is not `Basic` is affected. Version 2.4.13 fixes the issue.

Statistics

  • 1 Post
Last activity: 21 hours ago

Bluesky

Profile picture fallback
ferramentaslinux.bsky.social @ferramentaslinux.bsky.social
The #SUSE CUPS vulnerability (CVE-2025-58060) is a textbook case of legacy complexity haunting modern infrastructure. Heap overflow, local to root pivot, and it affects the IPP stack. Read more: 👉 tinyurl.com/3fewkb33 #Security
  • 0
  • 0
  • 0
  • 21h ago

CVE-2025-43529

Overview

  • Apple
  • iOS and iPadOS
17 Dec 2025
Published
18 Dec 2025
Updated
CVSS
Pending
EPSS
0.03%
KEV

Description

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.2, Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, tvOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Statistics

  • 2 Posts
  • 12 Interactions
Last activity: 16 hours ago

Fediverse

Profile picture fallback
ApplSec @applsec

📣 EMERGENCY UPDATES 📣

Apple pushed updates for 1 new zero-day that may have been actively exploited and is linked to CVE-2025-14174 and CVE-2025-43529 which were fixed in iOS 26.2.

🐛 CVE-2026-20700 (dyld):
- iOS and iPadOS 26.3
- macOS Tahoe 26.3
- tvOS 26.3
- visionOS 26.3
- watchOS 26.3

  • 7
  • 4
  • 0
  • 16h ago

Bluesky

Profile picture fallback
ApplSec @applsec.bsky.social
🐛 CVE-2025-14174 (dyld) additional patches, 🐛 CVE-2025-43529 (dyld) additional patches, 🐛 CVE-2026-20700 (dyld): - iOS and iPadOS 26.3 - macOS Tahoe 26.3 - tvOS 26.3 - visionOS 26.3 - watchOS 26.3 #apple #infosec
  • 0
  • 1
  • 0
  • 16h ago

CVE-2025-14174

Overview

  • Google
  • Chrome
12 Dec 2025
Published
16 Dec 2025
Updated
CVSS
Pending
EPSS
0.65%
KEV

Description

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Statistics

  • 2 Posts
  • 12 Interactions
Last activity: 16 hours ago

Fediverse

Profile picture fallback
ApplSec @applsec

📣 EMERGENCY UPDATES 📣

Apple pushed updates for 1 new zero-day that may have been actively exploited and is linked to CVE-2025-14174 and CVE-2025-43529 which were fixed in iOS 26.2.

🐛 CVE-2026-20700 (dyld):
- iOS and iPadOS 26.3
- macOS Tahoe 26.3
- tvOS 26.3
- visionOS 26.3
- watchOS 26.3

  • 7
  • 4
  • 0
  • 16h ago

Bluesky

Profile picture fallback
ApplSec @applsec.bsky.social
🐛 CVE-2025-14174 (dyld) additional patches, 🐛 CVE-2025-43529 (dyld) additional patches, 🐛 CVE-2026-20700 (dyld): - iOS and iPadOS 26.3 - macOS Tahoe 26.3 - tvOS 26.3 - visionOS 26.3 - watchOS 26.3 #apple #infosec
  • 0
  • 1
  • 0
  • 16h ago

CVE-2026-24515

Overview

  • libexpat project
  • libexpat
23 Jan 2026
Published
23 Jan 2026
Updated
CVSS v3.1
LOW (2.9)
EPSS
0.00%
KEV

Description

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

Statistics

  • 1 Post
Last activity: 17 hours ago

Bluesky

Profile picture fallback
ferramentaslinux.bsky.social @ferramentaslinux.bsky.social
USN-8023-1: libxmltok flaws (CVE-2026-24515 & CVE-2026-25210) are now public. Key takeaway: CVE-2026-25210 = Integer Overflow → Heap Overflow → Potential RCE. ⚠️ Patches ONLY in #Ubuntu Pro/ESM repos. Read more: 👉 tinyurl.com/fd6dsmfu #Security
  • 0
  • 0
  • 0
  • 17h ago

CVE-2026-1603

Overview

  • Ivanti
  • Endpoint Manager
10 Feb 2026
Published
10 Feb 2026
Updated
CVSS v3.1
HIGH (8.6)
EPSS
0.16%
KEV

Description

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

Statistics

  • 1 Post
Last activity: 22 hours ago

Bluesky

Profile picture fallback
Information Security Briefly @infosecbriefly.bsky.social
Ivanti released patches for EPM fixing a high-severity authentication bypass (CVE-2026-1603) and a medium SQL injection (CVE-2026-1602).
  • 0
  • 0
  • 0
  • 22h ago

CVE-2026-0652

Overview

  • TP-Link Systems Inc.
  • Tapo C260 v1
10 Feb 2026
Published
11 Feb 2026
Updated
CVSS v4.0
HIGH (8.7)
EPSS
0.50%
KEV

Description

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.

Statistics

  • 1 Post
Last activity: 4 hours ago

Bluesky

Profile picture fallback
Undercode Testing @undercode.bsky.social
TP-Link Tapo CVE-2026-0651 & CVE-2026-0652: Unauthenticated RCE and File Disclosure in Millions of Smart Cameras — Full Technical Breakdown + Video Introduction: Recent responsible disclosures by researcher Eugene Lim have revealed two critical vulnerabilities—CVE-2026-0651 (unauthenticated…
  • 0
  • 0
  • 0
  • 4h ago

CVE-2026-0651

Overview

  • TP-Link Systems Inc.
  • Tapo C260 v1
10 Feb 2026
Published
11 Feb 2026
Updated
CVSS v4.0
MEDIUM (5.3)
EPSS
0.06%
KEV

Description

On TP-Link Tapo C260 v1, path traversal is possible due to improper handling of specific GET request paths via https, allowing local unauthenticated probing of filesystem paths. An attacker on the local network can determine whether certain files exists on the device, with no read, write or code execution possibilities.

Statistics

  • 1 Post
Last activity: 4 hours ago

Bluesky

Profile picture fallback
Undercode Testing @undercode.bsky.social
TP-Link Tapo CVE-2026-0651 & CVE-2026-0652: Unauthenticated RCE and File Disclosure in Millions of Smart Cameras — Full Technical Breakdown + Video Introduction: Recent responsible disclosures by researcher Eugene Lim have revealed two critical vulnerabilities—CVE-2026-0651 (unauthenticated…
  • 0
  • 0
  • 0
  • 4h ago
Showing 31 to 40 of 44 CVEs