24h | 7d | 30d

CVE-2025-59287

Overview

  • Microsoft
  • Windows Server 2012
14 Oct 2025
Published
26 Feb 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
68.44%
KEV

Description

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Statistics

  • 1 Post
Last activity: 18 hours ago

Bluesky

Profile picture fallback
r/purpleteamsec bot @r-purpleteamsec.bsky.social
Weekly Purple Team Episode: CVE-2025-59287 - Exploiting & Detecting the Critical WSUS RCE
  • 0
  • 0
  • 0
  • 18h ago

CVE-2026-27858

Overview

  • Open-Xchange GmbH
  • OX Dovecot Pro
27 Mar 2026
Published
27 Mar 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.05%
KEV

Description

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to managesieve protocol, or install fixed version. No publicly available exploits are known.

Statistics

  • 1 Post
Last activity: 20 hours ago

Fediverse

Profile picture fallback
Offensive Sequence @offseq

⚠️ CVE-2026-27858 (HIGH, 7.5): OX Dovecot Pro’s managesieve is at risk of remote DoS via unauthenticated memory exhaustion. Restrict access, monitor logs, and patch ASAP. No public exploits yet, but stay alert. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 20h ago

CVE-2026-3608

Overview

  • ISC
  • Kea
25 Mar 2026
Published
25 Mar 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.02%
KEV

Description

Sending a maliciously crafted message to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons over any configured API socket or HA listener can cause the receiving daemon to exit with a stack overflow error. This issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2.

Statistics

  • 1 Post
Last activity: 22 hours ago

Bluesky

Profile picture fallback
Undercode Testing @undercode.bsky.social
Critical Kea DHCP Flaw CVE-2026-3608: Unauthenticated Remote DoS Threatens Enterprise Networks—Patch Now + Video Introduction: The Internet Systems Consortium (ISC) has issued an urgent security advisory for a high-severity vulnerability in the Kea DHCP server, a high-performance, open-source…
  • 0
  • 0
  • 0
  • 22h ago

CVE-2023-2868

Overview

  • Barracuda
  • Barracuda Email Security Gateway
24 May 2023
Published
21 Oct 2025
Updated
CVSS v3.1
CRITICAL (9.4)
EPSS
90.02%
KEV

Description

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

Statistics

  • 1 Post
Last activity: 8 hours ago

Fediverse

Profile picture fallback
Metasploit @metasploit

The latest Wrapup is here! 🎉 This week brings enhanced SMB NTLM relaying for better client compatibility (including smbclient), plus new modules for RCE in Eclipse Che (CVE-2025-12548), Barracuda ESG command injection (CVE-2023-2868), and an ESC/POS printer injector.

Check it out at rapid7.com/blog/post/pt-metasp

  • 0
  • 0
  • 0
  • 8h ago

CVE-2025-12548

Overview

  • Red Hat
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.22
  • devspaces/code-rhel9
13 Jan 2026
Published
21 Jan 2026
Updated
CVSS
Pending
EPSS
50.73%
KEV

Description

A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333.

Statistics

  • 1 Post
Last activity: 8 hours ago

Fediverse

Profile picture fallback
Metasploit @metasploit

The latest Wrapup is here! 🎉 This week brings enhanced SMB NTLM relaying for better client compatibility (including smbclient), plus new modules for RCE in Eclipse Che (CVE-2025-12548), Barracuda ESG command injection (CVE-2023-2868), and an ESC/POS printer injector.

Check it out at rapid7.com/blog/post/pt-metasp

  • 0
  • 0
  • 0
  • 8h ago

CVE-2026-34070

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 18 hours ago

Bluesky

Profile picture fallback
Bitnewsbot @bitnewsbot.bsky.social
Three security vulnerabilities (CVE-2026-34070, CVE-2025-68664, CVE-2025-67644) were disclosed in LangChain and LangGraph frameworks, impacting over 84 million weekly downloads. The […]
  • 1
  • 1
  • 0
  • 18h ago

CVE-2025-68664

Overview

  • langchain-ai
  • langchain
23 Dec 2025
Published
24 Dec 2025
Updated
CVSS v3.1
CRITICAL (9.3)
EPSS
0.04%
KEV

Description

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 18 hours ago

Bluesky

Profile picture fallback
Bitnewsbot @bitnewsbot.bsky.social
Three security vulnerabilities (CVE-2026-34070, CVE-2025-68664, CVE-2025-67644) were disclosed in LangChain and LangGraph frameworks, impacting over 84 million weekly downloads. The […]
  • 1
  • 1
  • 0
  • 18h ago

CVE-2025-67644

Overview

  • langchain-ai
  • langgraph
10 Dec 2025
Published
11 Dec 2025
Updated
CVSS v3.1
HIGH (7.3)
EPSS
0.02%
KEV

Description

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Versions 3.0.0 and below are vulnerable to SQL injection through the checkpoint implementation. Checkpoint allows attackers to manipulate SQL queries through metadata filter keys, affecting applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations. The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation. This issue is fixed in version 3.0.1.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 18 hours ago

Bluesky

Profile picture fallback
Bitnewsbot @bitnewsbot.bsky.social
Three security vulnerabilities (CVE-2026-34070, CVE-2025-68664, CVE-2025-67644) were disclosed in LangChain and LangGraph frameworks, impacting over 84 million weekly downloads. The […]
  • 1
  • 1
  • 0
  • 18h ago

CVE-2026-4368

Overview

  • NetScaler
  • ADC
23 Mar 2026
Published
24 Mar 2026
Updated
CVSS v4.0
HIGH (7.7)
EPSS
0.02%
KEV

Description

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

Statistics

  • 1 Post
Last activity: 16 hours ago

Fediverse

Profile picture fallback
Andi @Andi

Zwei kritische Schwachstellen beherrschen die Lage für deutsche Unternehmen.
Das BSI warnt vor einer aktiv ausgenutzten Lücke in Microsoft SharePoint. Die CISA hatte die Schwachstelle am 18. März in ihren Katalog ausgenutzter Sicherheitslücken aufgenommen. CERT-EU veröffentlichte am 25. März ein Advisory und verwies auf Maßnahmen aus der ToolShell-Angriffskampagne des Vorjahres. Der CVSS-Score liegt bei 9.8 von 10 und wurde hochgestuft, nachdem sich herausstellte, dass eine Ausnutzung auch ohne Authentifizierung möglich ist.
Parallel dazu hat CERT-Bund am 24. März Alarm wegen zweier Schwachstellen in Citrix NetScaler ADC und NetScaler Gateway geschlagen. CVE-2026-3055 ermöglicht es nicht authentifizierten Angreifern, aktive Session-Token aus dem Speicher betroffener Geräte auszulesen. CVE-2026-4368 kann durch eine Race Condition zur Übernahme fremder Benutzersitzungen führen. Besonders gefährdet sind Systeme, die als SAML Identity Provider konfiguriert sind, also eine in Unternehmensumgebungen weit verbreitete Konfiguration für Single Sign-On. Sicherheitsforscher bewerten eine baldige aktive Ausnutzung als sehr wahrscheinlich.
Sofortmaßnahmen: SharePoint patchen, NetScaler aktualisieren und aktiven Sessions beenden.

Cybersicherheitswarnung 2026-238220-1032 (25.03.2026) | CERT-Bund WID-SEC-2026-0836 (24.03.2026)
CVE-2026-20963 | CVE-2026-3055 | CVE-2026-4368
#Informationssicherheit #CISO #BSI #SharePoint #Citrix #NetScaler #Patchmanagement #NIS2 #CyberSecurity #ITSicherheit

  • 0
  • 0
  • 0
  • 16h ago

CVE-2026-4266

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
Last activity: 13 hours ago

Bluesky

Profile picture fallback
piggo @pigondrugs.bsky.social
~Cybergcca~ Security updates released for WatchGuard, Siemens, FreeBSD (RCE), and Ericsson. - IOCs: CVE-2026-4747, CVE-2026-4266, CVE-2026-4652 - #Patch #ThreatIntel #Vulnerability
  • 0
  • 0
  • 0
  • 13h ago
Showing 31 to 40 of 43 CVEs