24h | 7d | 30d

CVE-2026-27654

Overview

  • F5
  • NGINX Open Source
24 Mar 2026
Published
24 Mar 2026
Updated
CVSS v3.1
HIGH (8.2)
EPSS
0.02%
KEV

Description

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Statistics

  • 1 Post
Last activity: 23 hours ago

Bluesky

Profile picture fallback
セキュリティ対策Lab @securitylab-jp.bsky.social
nginxに深刻なバッファオーバーフロー 脆弱性(CVE-2026-27654)など rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #セキュリティ #Security #CybersecurityNews
  • 0
  • 0
  • 0
  • 23h ago

CVE-2026-20131

Overview

  • Cisco
  • Cisco Secure Firewall Management Center (FMC)
04 Mar 2026
Published
25 Mar 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
0.65%
KEV

Description

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

Statistics

  • 1 Post
Last activity: Last hour

Fediverse

Profile picture fallback
elhacker.NET @elhackernet

Ransomware Interlock explota Zero-Day crítico en Cisco FMC (CVE-2026-20131)

blog.elhacker.net/2026/03/rans

  • 0
  • 0
  • 0
  • Last hour

CVE-2025-59287

Overview

  • Microsoft
  • Windows Server 2012
14 Oct 2025
Published
26 Feb 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
68.44%
KEV

Description

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Statistics

  • 1 Post
Last activity: 11 hours ago

Bluesky

Profile picture fallback
r/purpleteamsec bot @r-purpleteamsec.bsky.social
Weekly Purple Team Episode: CVE-2025-59287 - Exploiting & Detecting the Critical WSUS RCE
  • 0
  • 0
  • 0
  • 11h ago

CVE-2026-27858

Overview

  • Open-Xchange GmbH
  • OX Dovecot Pro
27 Mar 2026
Published
27 Mar 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.05%
KEV

Description

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

Statistics

  • 1 Post
Last activity: 13 hours ago

Fediverse

Profile picture fallback
Offensive Sequence @offseq

⚠️ CVE-2026-27858 (HIGH, 7.5): OX Dovecot Pro’s managesieve is at risk of remote DoS via unauthenticated memory exhaustion. Restrict access, monitor logs, and patch ASAP. No public exploits yet, but stay alert. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 13h ago

CVE-2026-3608

Overview

  • ISC
  • Kea
25 Mar 2026
Published
25 Mar 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.02%
KEV

Description

Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error. This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2.

Statistics

  • 1 Post
Last activity: 14 hours ago

Bluesky

Profile picture fallback
Undercode Testing @undercode.bsky.social
Critical Kea DHCP Flaw CVE-2026-3608: Unauthenticated Remote DoS Threatens Enterprise Networks—Patch Now + Video Introduction: The Internet Systems Consortium (ISC) has issued an urgent security advisory for a high-severity vulnerability in the Kea DHCP server, a high-performance, open-source…
  • 0
  • 0
  • 0
  • 14h ago

CVE-2026-4368

Overview

  • NetScaler
  • ADC
23 Mar 2026
Published
24 Mar 2026
Updated
CVSS v4.0
HIGH (7.7)
EPSS
0.02%
KEV

Description

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 9 hours ago

Fediverse

Profile picture fallback
Andi @Andi

Zwei kritische Schwachstellen beherrschen die Lage für deutsche Unternehmen.
Das BSI warnt vor einer aktiv ausgenutzten Lücke in Microsoft SharePoint. Die CISA hatte die Schwachstelle am 18. März in ihren Katalog ausgenutzter Sicherheitslücken aufgenommen. CERT-EU veröffentlichte am 25. März ein Advisory und verwies auf Maßnahmen aus der ToolShell-Angriffskampagne des Vorjahres. Der CVSS-Score liegt bei 9.8 von 10 und wurde hochgestuft, nachdem sich herausstellte, dass eine Ausnutzung auch ohne Authentifizierung möglich ist.
Parallel dazu hat CERT-Bund am 24. März Alarm wegen zweier Schwachstellen in Citrix NetScaler ADC und NetScaler Gateway geschlagen. CVE-2026-3055 ermöglicht es nicht authentifizierten Angreifern, aktive Session-Token aus dem Speicher betroffener Geräte auszulesen. CVE-2026-4368 kann durch eine Race Condition zur Übernahme fremder Benutzersitzungen führen. Besonders gefährdet sind Systeme, die als SAML Identity Provider konfiguriert sind, also eine in Unternehmensumgebungen weit verbreitete Konfiguration für Single Sign-On. Sicherheitsforscher bewerten eine baldige aktive Ausnutzung als sehr wahrscheinlich.
Sofortmaßnahmen: SharePoint patchen, NetScaler aktualisieren und aktiven Sessions beenden.

Cybersicherheitswarnung 2026-238220-1032 (25.03.2026) | CERT-Bund WID-SEC-2026-0836 (24.03.2026)
CVE-2026-20963 | CVE-2026-3055 | CVE-2026-4368
#Informationssicherheit #CISO #BSI #SharePoint #Citrix #NetScaler #Patchmanagement #NIS2 #CyberSecurity #ITSicherheit

  • 0
  • 0
  • 0
  • 9h ago

Bluesky

Profile picture fallback
OpsMatters @opsmatters.com
The latest update for #CyCognito includes "Citrix NetScaler ADC and Gateway Vulnerabilities (CVE-2026-3055 & CVE-2026-4368)" and "Emerging Threat: Ubiquiti UniFi Network Application Path Traversal (CVE-2026-22557)". #cybersecurity #AttackSurfaceManagement #EASM https://opsmtrs.com/44Srq0X
  • 0
  • 1
  • 0
  • 22h ago

CVE-2026-3055

Overview

  • NetScaler
  • ADC
23 Mar 2026
Published
24 Mar 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
0.02%
KEV

Description

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 9 hours ago

Fediverse

Profile picture fallback
Andi @Andi

Zwei kritische Schwachstellen beherrschen die Lage für deutsche Unternehmen.
Das BSI warnt vor einer aktiv ausgenutzten Lücke in Microsoft SharePoint. Die CISA hatte die Schwachstelle am 18. März in ihren Katalog ausgenutzter Sicherheitslücken aufgenommen. CERT-EU veröffentlichte am 25. März ein Advisory und verwies auf Maßnahmen aus der ToolShell-Angriffskampagne des Vorjahres. Der CVSS-Score liegt bei 9.8 von 10 und wurde hochgestuft, nachdem sich herausstellte, dass eine Ausnutzung auch ohne Authentifizierung möglich ist.
Parallel dazu hat CERT-Bund am 24. März Alarm wegen zweier Schwachstellen in Citrix NetScaler ADC und NetScaler Gateway geschlagen. CVE-2026-3055 ermöglicht es nicht authentifizierten Angreifern, aktive Session-Token aus dem Speicher betroffener Geräte auszulesen. CVE-2026-4368 kann durch eine Race Condition zur Übernahme fremder Benutzersitzungen führen. Besonders gefährdet sind Systeme, die als SAML Identity Provider konfiguriert sind, also eine in Unternehmensumgebungen weit verbreitete Konfiguration für Single Sign-On. Sicherheitsforscher bewerten eine baldige aktive Ausnutzung als sehr wahrscheinlich.
Sofortmaßnahmen: SharePoint patchen, NetScaler aktualisieren und aktiven Sessions beenden.

Cybersicherheitswarnung 2026-238220-1032 (25.03.2026) | CERT-Bund WID-SEC-2026-0836 (24.03.2026)
CVE-2026-20963 | CVE-2026-3055 | CVE-2026-4368
#Informationssicherheit #CISO #BSI #SharePoint #Citrix #NetScaler #Patchmanagement #NIS2 #CyberSecurity #ITSicherheit

  • 0
  • 0
  • 0
  • 9h ago

Bluesky

Profile picture fallback
OpsMatters @opsmatters.com
The latest update for #CyCognito includes "Citrix NetScaler ADC and Gateway Vulnerabilities (CVE-2026-3055 & CVE-2026-4368)" and "Emerging Threat: Ubiquiti UniFi Network Application Path Traversal (CVE-2026-22557)". #cybersecurity #AttackSurfaceManagement #EASM https://opsmtrs.com/44Srq0X
  • 0
  • 1
  • 0
  • 22h ago

CVE-2023-2868

Overview

  • Barracuda
  • Barracuda Email Security Gateway
24 May 2023
Published
21 Oct 2025
Updated
CVSS v3.1
CRITICAL (9.4)
EPSS
90.02%
KEV

Description

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

Statistics

  • 1 Post
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Metasploit @metasploit

The latest Wrapup is here! 🎉 This week brings enhanced SMB NTLM relaying for better client compatibility (including smbclient), plus new modules for RCE in Eclipse Che (CVE-2025-12548), Barracuda ESG command injection (CVE-2023-2868), and an ESC/POS printer injector.

Check it out at rapid7.com/blog/post/pt-metasp

  • 0
  • 0
  • 0
  • 1h ago

CVE-2025-12548

Overview

  • Red Hat
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.22
  • devspaces/code-rhel9
13 Jan 2026
Published
21 Jan 2026
Updated
CVSS
Pending
EPSS
50.73%
KEV

Description

A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333.

Statistics

  • 1 Post
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Metasploit @metasploit

The latest Wrapup is here! 🎉 This week brings enhanced SMB NTLM relaying for better client compatibility (including smbclient), plus new modules for RCE in Eclipse Che (CVE-2025-12548), Barracuda ESG command injection (CVE-2023-2868), and an ESC/POS printer injector.

Check it out at rapid7.com/blog/post/pt-metasp

  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-32810

Overview

  • squidowl
  • halloy
20 Mar 2026
Published
23 Mar 2026
Updated
CVSS v4.0
MEDIUM (4.8)
EPSS
0.01%
KEV

Description

Halloy is an IRC application written in Rust. In versions on \*nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy creates its config directory and files using default umask permissions, which typically results in `0644` on files and `0755` on directories. This allows any local user on the system to read plaintext credentials stored in `config.toml` or referenced `password_file` paths. Commit f180e41061db393acf65bc99f5c5e7397586d9cb patches the issue.

Statistics

  • 1 Post
Last activity: 18 hours ago

Bluesky

Profile picture fallback
nixpkgs security changes @nixpkgssecuritychanges.gerbet.me
[release-25.11] halloy: patch CVE-2026-32810 and CVE-2026-32733 https://github.com/NixOS/nixpkgs/pull/503267 #security
  • 0
  • 0
  • 0
  • 18h ago
Showing 31 to 40 of 49 CVEs