24h | 7d | 30d

CVE-2026-122192

Overview

  • AWS
  • firecracker
04 Nov 2026
Published
04 Nov 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
Pending
KEV

Description

Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping. To remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later.

Statistics

  • 1 Post
Last activity: 4 hours ago

Bluesky

Profile picture fallback
r/netsec bot @r-netsec.bsky.social
Escaping AWS Firecracker from guest userspace: VMM memory corruption (CVE-2026-122192)
  • 0
  • 0
  • 0
  • 4h ago

CVE-2026-121639

Overview

  • WatchGuard
  • AuthPoint Authentication Gateway
04 Nov 2026
Published
04 Nov 2026
Updated
CVSS v4.0
CRITICAL (9.2)
EPSS
Pending
KEV

Description

A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 9 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Update WatchGuard AuthPoint Gateway to version 7.6.0 now to fix CVE-2026-121639, CVE-2026-121638, and two other critical authentication flaws.

securityonline.info/watchguard

  • 1
  • 0
  • 0
  • 9h ago

CVE-2026-121638

Overview

  • WatchGuard
  • AuthPoint Authentication Gateway
04 Nov 2026
Published
04 Nov 2026
Updated
CVSS v4.0
CRITICAL (9.1)
EPSS
Pending
KEV

Description

An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 9 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Update WatchGuard AuthPoint Gateway to version 7.6.0 now to fix CVE-2026-121639, CVE-2026-121638, and two other critical authentication flaws.

securityonline.info/watchguard

  • 1
  • 0
  • 0
  • 9h ago

CVE-2026-58882

Overview

  • Google
  • Android
02 Nov 2026
Published
02 Nov 2026
Updated
CVSS
Pending
EPSS
0.19%
KEV

Description

In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 17 hours ago

Fediverse

Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

Google has released its November 2026 Android security bulletin, detailing 216 vulnerabilities with 23 rated critical.

Key items include CVE-2026-58868 affecting Android 14 through 17, and CVE-2026-58882 allowing remote denial-of-service via WAP Push messages.

Fixes are available through security patch levels 2026-11-01 and 2026-11-05.

en.hacks.gr/i-google-diorthone

#Android #Google #Patch #Mobile

  • 0
  • 1
  • 0
  • 17h ago

CVE-2026-73695

Overview

  • Control Web Panel
  • Control Web Panel
02 Nov 2026
Published
03 Nov 2026
Updated
CVSS v4.0
HIGH (8.7)
EPSS
0.95%
KEV

Description

Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Update Control Web Panel to version 1.29 now to patch CVE-2026-73695, CVE-2026-73696, and eight other flaws allowing unauthenticated root RCE.

securityonline.info/control-we

  • 0
  • 1
  • 0
  • 1h ago

CVE-2026-102704

Overview

  • Xen
  • Xen
04 Nov 2026
Published
04 Nov 2026
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches details internally to reuse already validated data. The conditions on when to re-validate the internal data were not correct in some cases: - Frame numbers and grant references could wrongly be mixed up. This is CVE-2026-102703. - Copying by frame number (rather than grant reference) is permitted only when operating on the caller's own memory. The check to enforce this restriction was misplaced. This is CVE-2026-102704.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 14 hours ago

Fediverse

Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

The Xen Project published advisory Xsa-523 detailing two memory-handling flaws, CVE-2026-102703 and CVE-2026-102704, found in grant copy operations.

All Xen versions from 4.6 onward are vulnerable, while versions up to 4.16 lack patches.

Xcp-ng and Qubes OS have issued fixes for supported configurations requiring host reboots.

en.hacks.gr/sovara-kena-asfale

#Xen #Virtualization #OpenSource #Linux

  • 0
  • 1
  • 0
  • 14h ago

CVE-2026-73696

Overview

  • Control Web Panel
  • Control Web Panel
02 Nov 2026
Published
03 Nov 2026
Updated
CVSS v4.0
HIGH (8.6)
EPSS
0.49%
KEV

Description

Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Update Control Web Panel to version 1.29 now to patch CVE-2026-73695, CVE-2026-73696, and eight other flaws allowing unauthenticated root RCE.

securityonline.info/control-we

  • 0
  • 1
  • 0
  • 1h ago

CVE-2026-100252

Overview

  • Apache Software Foundation
  • Apache ZooKeeper
  • org.apache.zookeeper:zookeeper
04 Nov 2026
Published
04 Nov 2026
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canonicalization fails and the error is only logged. The client-requested authzid then becomes the session's SASL identity for all ACL checks. An authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server's default realm, such as a principal from a cross-realm trusted realm. The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.

Statistics

  • 1 Post
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

35 Apache vulnerabilities fixed, including Apache ZooKeeper flaws CVE-2026-115448 and CVE-2026-100252, plus OpenOffice, ActiveMQ and Juneau bugs.

securityonline.info/apache-vul

  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-112116

Overview

  • ASUS
  • System Control Interface
04 Nov 2026
Published
04 Nov 2026
Updated
CVSS v4.0
HIGH (8.5)
EPSS
0.11%
KEV

Description

An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through crafted device control requests, ultimately resulting in a complete compromise of the affected system. Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Install the ASUS security vulnerabilities update to fix four critical ASUS security vulnerabilities affecting ASUS routers and Windows system software.

securityonline.info/asus-secur

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-84730

Overview

  • ASUS
  • Router firmware
04 Nov 2026
Published
04 Nov 2026
Updated
CVSS v4.0
HIGH (8.7)
EPSS
0.34%
KEV

Description

Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name. Refer to the ' Security Update for ASUS Router AiCloud Feature ' section on the ASUS Security Advisory for more information.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Install the ASUS security vulnerabilities update to fix four critical ASUS security vulnerabilities affecting ASUS routers and Windows system software.

securityonline.info/asus-secur

  • 0
  • 0
  • 0
  • 2h ago
Showing 71 to 80 of 122 CVEs