CVE-2026-94031

Overview

0-Gaurav-0
nexus-mcp

20 Sep 2026

Published

21 Sep 2026

Updated

CVSS v4.0

MEDIUM (5.3)

EPSS

1.07%

MITRE

KEV

Description

A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function child_process.exec of the file src/auth/browser.ts of the component nexus_reauth MCP tool. The manipulation of the argument url results in command injection. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Statistics

1 Post

Last activity: 2 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-94031: command injection in Gaurav nexus-mcp (child_process.exec, url arg). CVSS 6.3, public exploit, no patch. Restrict access and update immediately. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94031/

0
0
0
2h ago

CVE-2020-10808

Overview

Pending

22 Mar 2020

Published

04 Aug 2024

Updated

CVSS

Pending

EPSS

77.50%

MITRE

KEV

Description

Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters.

Statistics

1 Post

Last activity: 2 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

Still running VestaCP? A 2019 package set on a dead repo, hit by CVE-2020-10808. HestiaCP is the maintained fork. https://www.valtersit.com/guides/hosting/hestiacp-the_minimalists_revenge_and_the_true_heir_to_vestacp/

0
0
0
2h ago

CVE-2026-94113

Overview

Frappe
ERPNext

20 Sep 2026

Published

21 Sep 2026

Updated

CVSS v4.0

HIGH (7.1)

EPSS

0.42%

MITRE

KEV

Description

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.

Statistics

1 Post

Last activity: 15 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-94113: Frappe ERPNext leaks billable timesheet data (project names, billing amounts, work logs) to any authenticated user via unpermitted endpoints. CVSS 6.5. Fix in 15.121.0 and 16.34.0, patch under review - upgrade now. #CVE #infosec #ERPNext https://www.valtersit.com/cve/CVE-2026-94113/

0
0
0
15h ago

CVE-2026-120192

Overview

Presenton

01 Nov 2026

Published

01 Nov 2026

Updated

CVSS v4.0

MEDIUM (6.9)

EPSS

0.85%

MITRE

KEV

Description

A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is able to mitigate this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. The affected component should be upgraded.

Statistics

1 Post

Last activity: 19 hours ago

Fediverse

OffSequence @offseq

CVE-2026-120192: MEDIUM severity info disclosure in Presenton ≤0.9.11-beta. Remote, unauthenticated exploitation via /app_data — public exploit code exists. Patch: upgrade to 0.9.12-beta. https://radar.offseq.com/threat/cve-2026-120192-information-disclosure-in-presenton-7ee6bdee4c432f8b #OffSeq #Vulnerability #Infosec #CVE2026_120192

0
0
0
19h ago

CVE-2026-110264

Overview

GitLab
GitLab

22 Oct 2026

Published

30 Oct 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

1.35%

MITRE

KEV

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

Statistics

2 Posts
4 Interactions

Last activity: 1 hour ago

Bluesky

The Shadowserver Foundation @shadowserver.bsky.social

We are currently tracking over 1000 GitLab instances vulnerable to CVE-2026-97229 (on @CISACyber KEV) and over 11300 instances vulnerable to CVE-2026-110264 (out of around 39K GitLab instances we see daily). Tree Map Dashboard stats (both vulns) dashboard.shadowserver.org/statistics/c...

1
3
0
1h ago

The Shadowserver Foundation @shadowserver.bsky.social

IP data in our Vulnerable HTTP reporting tagged 'cve-2026-97229' or 'cve-2026-110264': www.shadowserver.org/what-we-do/n... World Map view: dashboard.shadowserver.org/statistics/c... Tracker: dashboard.shadowserver.org/statistics/c... Patch info: docs.gitlab.com/releases/pat...

0
0
0
1h ago

CVE-2026-58240

Overview

SAP_SE
SAP NetWeaver (Message Server)

08 Sep 2026

Published

09 Sep 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

0.53%

MITRE

KEV

Description

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.

Statistics

1 Post

Last activity: 6 hours ago

Fediverse

ThreatNoir @threatnoir

⚠️ CRITICAL: 2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server

SAP released patches for two critical unauthenticated remote code execution vulnerabilities in SAP Kernel and NetWeaver Message Server (CVE-2026-44756 and CVE-2026-58240). Any unpatched SAP system is exploitable without credentials, giving attackers full OS command execution and complete system com…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

0
0
0
6h ago

CVE-2026-118386

Overview

Gitea
Gitea
gitea.dev

01 Nov 2026

Published

01 Nov 2026

Updated

CVSS

Pending

EPSS

0.20%

MITRE

KEV

Description

Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit of their own in it, through a fork pull request or an AGit push, and submit a review naming that commit on a pull request whose head branch is in the same repository. On instances with a runner serving the repository, the attacker's workflow then ran without approval, received the Actions secrets of the repository and its owner, and got a `GITEA_TOKEN` with write access to the repository. Review-triggered workflows now run on the pull request head.

Statistics

1 Post

Last activity: 7 hours ago

Fediverse

🛡️ #1 hacks.gr @hacksgr

Gitea has released version 28.3, addressing 20 security vulnerabilities alongside performance improvements.

Key fixes include resolution for CVE-2026-120263, an OAuth2 account takeover vulnerability affecting installations with automatic account linking and open registration, and CVE-2026-118386 regarding workflow execution permissions.

The update also tackles private repository access controls, runner token handling, and migration…

https://en.hacks.gr/i-gitea-kykloforei-nea-ekdosi-poy-diorthonei-eikosi-provlimata-asfaleias/

#Gitea #OAuth2 #DevOps #OpenSource

0
0
0
7h ago

CVE-2026-120263

Overview

Gitea
Gitea
gitea.dev

01 Nov 2026

Published

01 Nov 2026

Updated

CVSS

Pending

EPSS

0.20%

MITRE

KEV

Description

When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the OAuth2 provider. An attacker with an account on a configured OAuth2 provider could submit another user's name, link their external identity to that Gitea account and be signed in as it without its password, including as an administrator. The link persisted for later sign-ins. Automatic linking now only happens when the existing account matches the provider's email or provider-derived user name; otherwise the account password is required.

Statistics

1 Post

Last activity: 7 hours ago

Fediverse

🛡️ #1 hacks.gr @hacksgr

Gitea has released version 28.3, addressing 20 security vulnerabilities alongside performance improvements.

Key fixes include resolution for CVE-2026-120263, an OAuth2 account takeover vulnerability affecting installations with automatic account linking and open registration, and CVE-2026-118386 regarding workflow execution permissions.

The update also tackles private repository access controls, runner token handling, and migration…

https://en.hacks.gr/i-gitea-kykloforei-nea-ekdosi-poy-diorthonei-eikosi-provlimata-asfaleias/

#Gitea #OAuth2 #DevOps #OpenSource

0
0
0
7h ago

CVE-2026-44756

Overview

SAP_SE
SAP Extended Passport (EPP) Processing

08 Sep 2026

Published

22 Sep 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

1.40%

MITRE

KEV

Description

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application.

Statistics

1 Post

Last activity: 6 hours ago

Fediverse

ThreatNoir @threatnoir

⚠️ CRITICAL: 2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server

SAP released patches for two critical unauthenticated remote code execution vulnerabilities in SAP Kernel and NetWeaver Message Server (CVE-2026-44756 and CVE-2026-58240). Any unpatched SAP system is exploitable without credentials, giving attackers full OS command execution and complete system com…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

0
0
0
6h ago

Quick check

Overview

Description

Statistics

Fediverse

Overview

Description

Statistics

Fediverse

Overview

Description

Statistics

Fediverse

Overview

Description

Statistics

Fediverse

Overview

Description

Statistics

Bluesky

Overview

Description

Statistics

Fediverse

Overview

Description

Statistics

Fediverse

Overview

Description

Statistics

Fediverse

Overview

Description

Statistics

Fediverse