24h | 7d | 30d

CVE-2026-107360

Overview

  • Red Hat
  • Red Hat Satellite 6.16 for RHEL 8
  • rubygem-safemode
12 Nov 2026
Published
13 Nov 2026
Updated
CVSS
Pending
EPSS
0.47%
KEV

Description

A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.

Statistics

  • 1 Post
Last activity: 22 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Red Hat Satellite vulnerabilities fixed: CVE-2026-107360 (CVSS 9.6) sandbox bypass leads 21 new Red Hat CVEs across Satellite, RHEL and Ansible.

securityonline.info/red-hat-sa

  • 0
  • 0
  • 0
  • 22h ago

CVE-2026-91202

Overview

  • Red Hat
  • Red Hat Enterprise Linux 10
  • cockpit-files
18 Sep 2026
Published
11 Nov 2026
Updated
CVSS
Pending
EPSS
0.16%
KEV

Description

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.

Statistics

  • 1 Post
Last activity: 20 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-91202 Cockpit: low-priv local user abuses symlink with "Paste as owner" to change file ownership outside intended dir, compromising integrity (CVSS 6.1, unpatched). Restrict cockpit-files access until a fix lands. #CVE #infosec #cybersecurity valtersit.com/cve/CVE-2026-912

  • 0
  • 0
  • 0
  • 20h ago

CVE-2026-107410

Overview

  • Citrix NetScaler
  • ADC
13 Nov 2026
Published
13 Nov 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
0.36%
KEV

Description

Memory overflow in NetScaler Push can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler

Statistics

  • 1 Post
Last activity: 17 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-107410: CRITICAL memory overflow in Citrix NetScaler ADC & Gateway (CVSS 9.3) risks denial of service & unpredictable behavior. No patch yet — monitor Citrix for updates. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 17h ago

CVE-2026-61633

Overview

  • nanomq
  • nanomq
18 Sep 2026
Published
18 Sep 2026
Updated
CVSS v3.1
LOW (2.0)
EPSS
0.34%
KEV

Description

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not handle a failed read_uint16() while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curpos unchanged while topic_count continues to increase, allowing a malicious MQTT broker to hang a connecting MQTT 3.1.1 client, consume CPU and memory, and repeatedly deny service when automatic reconnection is enabled. The broker-side nmq_unsubinfo_decode path is not affected. This issue is fixed in version 0.24.14.

Statistics

  • 1 Post
Last activity: 13 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-61633 NanoMQ client DoS: malformed UNSUBSCRIBE packets can hang MQTT clients and burn CPU/memory. CVSS 2. Patch under review - watch for 0.24.14. #CVE #infosec #NanoMQ valtersit.com/cve/CVE-2026-616

  • 0
  • 0
  • 0
  • 13h ago

CVE-2026-88235

Overview

  • Microsoft
  • Windows 10 Version 1607
10 Nov 2026
Published
13 Nov 2026
Updated
CVSS v3.1
HIGH (7.8)
EPSS
0.34%
KEV

Description

Unintended proxy or intermediary ('confused deputy') in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.

Statistics

  • 1 Post
Last activity: 11 hours ago

Bluesky

Profile picture fallback
r/redteamsec bot @r-redteamsec.bsky.social
TrustFall (CVE-2026-88235) — TrustedInstaller/CBS Session COM LPE, any interactive user → SYSTEM write (public PoC)
  • 0
  • 0
  • 0
  • 11h ago

CVE-2026-44639

Overview

  • nanomq
  • nanomq
18 Sep 2026
Published
18 Sep 2026
Updated
CVSS v3.1
LOW (3.7)
EPSS
0.44%
KEV

Description

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the entire linked list for each property added by decode_buf_properties(). A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet containing many User Properties, causing O(N²) linked-list insertion and CPU work that makes the broker unresponsive; repeated packets can sustain the denial of service. This issue is fixed in version 0.24.14.

Statistics

  • 1 Post
Last activity: 16 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-44639 NanoMQ MQTT v5 property decoder allows remote unauthenticated DoS via O(N²) linked-list work, CVSS 3.7. Fixed in 0.24.14, patch under review. Update when available. #CVE #infosec #NanoMQ valtersit.com/cve/CVE-2026-446

  • 0
  • 0
  • 0
  • 16h ago

CVE-2026-126325

Overview

  • PTC
  • Windchill
11 Nov 2026
Published
11 Nov 2026
Updated
CVSS v4.0
CRITICAL (9.2)
EPSS
0.51%
KEV

Description

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

Statistics

  • 1 Post
Last activity: 13 hours ago

Fediverse

Profile picture fallback
ekiledjian @edwardk

PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution

PTC has released patches for a critical vulnerability in its Windchill and FlexPLM software that could allow remote code execution. The flaw, tracked as CVE-2026-126325 with a CVSS v4 score of 9.2, is a case of improper input validation and deserialization of untrusted data. thehackernews.com/2026/11/ptc-

  • 0
  • 0
  • 0
  • 13h ago

CVE-2026-111497

Overview

  • Google
  • Brotli
  • github.com/google/brotli
22 Oct 2026
Published
10 Nov 2026
Updated
CVSS v4.0
CRITICAL (9.2)
EPSS
82.64%
KEV

Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Statistics

  • 1 Post
Last activity: 8 hours ago

Fediverse

Profile picture fallback
Upsun @upsun

Security patches wait for no one, especially when a Node.js Brotli decoder vulnerability pops up. 🚨

Node.js patched CVE-2026-111497 on October 21, 2026, and we updated our Upsun images right away to keep you covered.

Dive into our practical guide to see affected versions and learn what to do if your app uses Node.js inside PHP, Ruby, Java, or Rust images. 🛠️

👉 developer.upsun.com/posts/rele

#NodeJS #CyberSecurity #DevOps #AppSec

  • 0
  • 0
  • 0
  • 8h ago

CVE-2026-71575

Overview

  • Apache Software Foundation
  • Apache CXF
  • org.apache.cxf:cxf-rt-rs-security-sso-oidc
09 Oct 2026
Published
15 Oct 2026
Updated
CVSS
Pending
EPSS
0.36%
KEV

Description

The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Statistics

  • 1 Post
Last activity: 22 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

wso2am <4.7.0-r4 has a CRITICAL flaw (CVE-2026-71575): max_age auth-freshness check is broken due to logic/units errors. Token reuse risk — upgrade to 4.7.0-r4 ASAP. radar.offseq.com/threat/wso2am

  • 0
  • 0
  • 0
  • 22h ago

CVE-2026-127277

Overview

  • Linksys
  • EA8100
13 Nov 2026
Published
13 Nov 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
0.56%
KEV

Description

A security flaw has been discovered in Linksys EA8100 1.0.3.216940. The affected element is an unknown function of the file etc/init.d/service_smbd.sh of the component SMB Service. Performing a manipulation of the argument ANON_ACCESS results in improper initialization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Statistics

  • 1 Post
Last activity: 21 hours ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-127277 | CVSS 10.0 Linksys EA8100 SMB Service Flaw CVE-2026-127277 affects Linksys EA8100 version 1.0.3.216940, according to the NVD record. Full analysis: https://t.me/aiutocomputerhelp_lab/1417
  • 0
  • 0
  • 0
  • 21h ago
Showing 41 to 50 of 60 CVEs