CVE-2026-21693

Overview

InternationalColorConsortium
iccDEV

07 Jan 2026

Published

07 Jan 2026

Updated

CVSS v3.1

HIGH (8.8)

EPSS

Pending

MITRE

KEV

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccSegmentedCurveXml::ToXml()` at `IccXML/IccLibXML/IccMpeXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

Statistics

2 Posts

Last activity: 19 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-21693 - High (8.8)

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccSeg...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21693/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
1
19h ago

CVE-2025-64513

Overview

milvus-io
milvus

10 Nov 2025

Published

12 Nov 2025

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

0.12%

MITRE

KEV

Description

Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the Milvus cluster. This grants the attacker the ability to read, modify, or delete data, and to perform privileged administrative operations such as database or collection management. This issue has been fixed in Milvus 2.4.24, 2.5.21, and 2.6.5. If immediate upgrade is not possible, a temporary mitigation can be applied by removing the sourceID header from all incoming requests at the gateway, API gateway, or load balancer level before they reach the Milvus Proxy. This prevents attackers from exploiting the authentication bypass behavior.

Statistics

1 Post

Last activity: 21 hours ago

Bluesky

/r/netsec @r-netsec-bot.bsky.social

Milvus Proxy Authentication Bypass Vulnerability(CVE-2025-64513)

0
0
0
21h ago

CVE-2026-21683

Overview

InternationalColorConsortium
iccDEV

07 Jan 2026

Published

07 Jan 2026

Updated

CVSS v3.1

HIGH (8.8)

EPSS

Pending

MITRE

KEV

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `icStatusCMM::CIccEvalCompare::EvaluateProfile()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

Statistics

1 Post

Last activity: 19 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-21683 - High (8.8)

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `icStatu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21683/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
19h ago

CVE-2025-59470

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

1 Post

Last activity: 16 hours ago

Bluesky

CyberHub @cyberhub.blog

📌 Critical RCE Flaw in Veeam Backup & Replication: CVE-2025-59470 with CVSS 9.0 https://www.cyberhub.blog/article/17746-critical-rce-flaw-in-veeam-backup-replication-cve-2025-59470-with-cvss-90

0
0
0
16h ago

CVE-2025-61492

Overview

Pending

07 Jan 2026

Published

07 Jan 2026

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.

Statistics

1 Post

Last activity: 19 hours ago

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2025-61492 - Critical (10)

A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-61492/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
19h ago

CVE-2026-0669

Overview

Wikimedia Foundation
MediaWiki - CSS extension

07 Jan 2026

Published

07 Jan 2026

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39.

Statistics

1 Post

Last activity: 19 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-0669 - High (7.5)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0669/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
19h ago

CVE-2025-13493

Overview

webrndexperts
Latest Registered Users

07 Jan 2026

Published

07 Jan 2026

Updated

CVSS v3.1

HIGH (7.5)

EPSS

0.03%

MITRE

KEV

Description

The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4. This is due to missing authorization and nonce validation in the rnd_handle_form_submit function hooked to both admin_post_my_simple_form and admin_post_nopriv_my_simple_form actions. This makes it possible for unauthenticated attackers to export complete user details (excluding passwords and sensitive tokens) in CSV format via the 'action' parameter.

Statistics

1 Post

Last activity: 23 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2025-13493 - High (7.5)

The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4. This is due to missing authorization and nonce validation in the rnd_handle_form_submit function hooked to b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13493/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
23h ago

CVE-2026-21855

Overview

the-hideout
tarkov-data-manager

07 Jan 2026

Published

07 Jan 2026

Updated

CVSS v3.1

CRITICAL (9.3)

EPSS

Pending

MITRE

KEV

Description

The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, a reflected Cross Site Scripting (XSS) vulnerability in the toast notification system allows any attacker to execute arbitrary JavaScript in the context of a victim's browser session by crafting a malicious URL. A series of fix commits on 02 January 2025 fixed this and other vulnerabilities.

Statistics

1 Post

Last activity: 21 hours ago

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2026-21855 - Critical (9.3)

The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, a reflected Cross Site Scripting (XSS) vulnerability in the toast notification system allows any attacker to execute arbitrary JavaScript in the context of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21855/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
21h ago

CVE-2025-22224

Overview

VMware
ESXi

04 Mar 2025

Published

21 Oct 2025

Updated

CVSS v3.1

CRITICAL (9.3)

EPSS

51.47%

MITRE

KEV

Description

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Statistics

1 Post

Last activity: 11 hours ago

Bluesky

tamosan @tamosan.bsky.social

利用されている脆弱性はCVE-2025-22224～22226：Hackers Exploiting VMware ESXi Instances in the Wild Using zero-day Exploit Toolkit https://cybersecuritynews.com/vmware-esxi-exploited-toolkit/

0
0
0
11h ago

CVE-2026-22047

Overview

InternationalColorConsortium
iccDEV

07 Jan 2026

Published

07 Jan 2026

Updated

CVSS v3.1

HIGH (8.8)

EPSS

Pending

MITRE

KEV

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `SIccCalcOp::Describe()` at `IccProfLib/IccMpeCalc.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

Statistics

3 Posts

Last activity: 19 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-22047 - High (8.8)

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `S...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22047/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
2
19h ago