CVE-2026-20045

Overview

Cisco
Cisco Unified Communications Manager

21 Jan 2026

Published

22 Jan 2026

Updated

CVSS v3.1

HIGH (8.2)

EPSS

0.89%

MITRE

KEV

Description

A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.

Statistics

1 Post

Last activity: 15 hours ago

Bluesky

Lorenzo Ordóñez @lordman1982.bsky.social

Cisco Fixes Actively Exploited Zero-Day CVE-2026-20045 in Unified CM and Webex thehackernews.com/2026/01/cisc...

0
0
0
15h ago

CVE-2025-9086

Overview

curl
curl

12 Sep 2025

Published

08 Jan 2026

Updated

CVSS

Pending

EPSS

0.04%

MITRE

KEV

Description

1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path=\"/\",`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

Statistics

1 Post

Last activity: 21 hours ago

Bluesky

Lambda Watchdog @lambdawatchdog.bsky.social

🔍 Lambda Watchdog detected that CVE-2025-9086 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/372 #AWS #Lambda #Security #CVE #DevOps #SecOps

0
0
0
21h ago

CVE-2025-55292

Overview

meshtastic
firmware

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

HIGH (8.2)

EPSS

Pending

MITRE

KEV

Description

Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by their NodeID, generated from the MAC address, rather than their public key. This aspect downgrades the security, specifically by abusing the HAM mode which doesn't use encryption. An attacker can, as such, forge a NodeInfo on behalf of a victim node advertising that the HAM mode is enabled. This, in turn, will allow the other nodes on the mesh to accept the new information and overwriting the NodeDB. The other nodes will then only be able to send direct messages to the victim by using the shared channel key instead of the PKC. Additionally, because HAM mode by design doesn't provide any confidentiality or authentication of information, the attacker could potentially also be able to change the Node details, like the full name, short code, etc. To keep the attack persistent, it is enough to regularly resend the forged NodeInfo, in particular right after the victim sends their own. A patch is available in version 2.7.6.834c3c5.

Statistics

1 Post

Last activity: 8 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2025-55292 - High (8.2)

Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by their NodeID, generated from the MAC address, rather than their public key. This aspect downgrades the security, specifically by...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-55292/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
8h ago

CVE-2025-61727

Overview

Go standard library
crypto/x509
crypto/x509

03 Dec 2025

Published

03 Dec 2025

Updated

CVSS

Pending

EPSS

0.01%

MITRE

KEV

Description

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

Statistics

1 Post

Last activity: 21 hours ago

Bluesky

Lambda Watchdog @lambdawatchdog.bsky.social

🔍 Lambda Watchdog detected that CVE-2025-61727 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/357 #AWS #Lambda #Security #CVE #DevOps #SecOps

0
0
0
21h ago

CVE-2026-24841

Overview

Dokploy
dokploy

28 Jan 2026

Published

28 Jan 2026

Updated

CVSS v3.1

CRITICAL (9.9)

EPSS

Pending

MITRE

KEV

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameters are directly interpolated into shell commands without sanitization, allowing authenticated attackers to execute arbitrary commands on the host server. Version 0.26.6 fixes the issue.

Statistics

1 Post

Last activity: 7 hours ago

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2026-24841 - Critical (9.9)

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameter...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24841/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
7h ago

CVE-2026-24827

Overview

gerstrong
Commander-Genius

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

HIGH (7.5)

EPSS

0.04%

MITRE

KEV

Description

Out-of-bounds Write vulnerability in gerstrong Commander-Genius.This issue affects Commander-Genius: before Release refs/pull/358/merge.

Statistics

1 Post

Last activity: 22 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-24827 - High (7.5)

Out-of-bounds Write vulnerability in gerstrong Commander-Genius.This issue affects Commander-Genius: before Release refs/pull/358/merge.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24827/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
22h ago

CVE-2024-11053

Overview

curl
curl

11 Dec 2024

Published

03 Nov 2025

Updated

CVSS

Pending

EPSS

1.03%

MITRE

KEV

Description

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

Statistics

1 Post

Last activity: 21 hours ago

Bluesky

Lambda Watchdog @lambdawatchdog.bsky.social

🔍 Lambda Watchdog detected that CVE-2024-11053 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/368 #AWS #Lambda #Security #CVE #DevOps #SecOps

0
0
0
21h ago

CVE-2026-24770

Overview

infiniflow
ragflow

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

Pending

MITRE

KEV

Description

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a "Zip Slip" vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading to Remote Code Execution) via a malicious ZIP archive. The MinerUParser class retrieves and extracts ZIP files from an external source (mineru_server_url). The extraction logic in `_extract_zip_no_root` fails to sanitize filenames within the ZIP archive. Commit 64c75d558e4a17a4a48953b4c201526431d8338f contains a patch for the issue.

Statistics

1 Post

Last activity: 10 hours ago

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2026-24770 - Critical (9.8)

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser contains a "Zip Slip" vulnerability, allowing an attacker to overwrite arbitrary files on the server (leading...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24770/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
10h ago

CVE-2026-24875

Overview

yoyofr
modizer

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

Pending

MITRE

KEV

Description

Integer Overflow or Wraparound vulnerability in yoyofr modizer.This issue affects modizer: before 4.1.1.

Statistics

1 Post

Last activity: 16 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-24875 - High (7.8)

Integer Overflow or Wraparound vulnerability in yoyofr modizer.This issue affects modizer: before 4.1.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24875/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
16h ago

CVE-2026-24838

Overview

dnnsoftware
Dnn.Platform

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

CRITICAL (9.1)

EPSS

Pending

MITRE

KEV

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

Statistics

2 Posts

Last activity: 7 hours ago

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2026-24838 - Critical (9.1)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24838/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
1
7h ago