24h | 7d | 30d

CVE-2026-102523

Overview

  • MariaDB
  • server
05 Nov 2026
Published
05 Nov 2026
Updated
CVSS v3.1
HIGH (8.0)
EPSS
Pending
KEV

Description

MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Statistics

  • 1 Post
Last activity: 3 hours ago

Bluesky

Profile picture fallback
セキュリティ対策Lab @securitylab-jp.bsky.social
MariaDBに認証済みユーザーによる権限回避の脆弱性「CVE-2026-102523」　他のテーブルを不正に読み取り・変更するおそれ rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース
  • 0
  • 0
  • 0
  • 3h ago

CVE-2026-122192

Overview

  • AWS
  • firecracker
04 Nov 2026
Published
04 Nov 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.16%
KEV

Description

Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping. To remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later.

Statistics

  • 1 Post
Last activity: 8 hours ago

Bluesky

Profile picture fallback
Eyal Estrin ☁️ @eyalestrin.bsky.social
CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard #patchmanagement
  • 0
  • 0
  • 0
  • 8h ago

CVE-2026-102704

Overview

  • Xen
  • Xen
04 Nov 2026
Published
04 Nov 2026
Updated
CVSS
Pending
EPSS
0.14%
KEV

Description

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches details internally to reuse already validated data. The conditions on when to re-validate the internal data were not correct in some cases: - Frame numbers and grant references could wrongly be mixed up. This is CVE-2026-102703. - Copying by frame number (rather than grant reference) is permitted only when operating on the caller's own memory. The check to enforce this restriction was misplaced. This is CVE-2026-102704.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 22 hours ago

Bluesky

Profile picture fallback
Eyal Estrin ☁️ @eyalestrin.bsky.social
Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory (CVE-2026-102703 and CVE-2026-102704) #patchmanagement
  • 1
  • 0
  • 0
  • 22h ago

CVE-2026-113374

Overview

  • Sonatype
  • Nexus Repository 3
04 Nov 2026
Published
04 Nov 2026
Updated
CVSS v4.0
HIGH (8.6)
EPSS
0.28%
KEV

Description

Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-based authentication for the instance. A remote client can then authenticate as an existing user, including an administrator, without credentials.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Update Sonatype Nexus Repository 3 to version 3.98.0 now to fix CVE-2026-113373, CVE-2026-113374, and five other critical security flaws.

securityonline.info/sonatype-n

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-113373

Overview

  • Sonatype
  • Nexus Repository 3
04 Nov 2026
Published
04 Nov 2026
Updated
CVSS v4.0
CRITICAL (9.1)
EPSS
0.25%
KEV

Description

Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Update Sonatype Nexus Repository 3 to version 3.98.0 now to fix CVE-2026-113373, CVE-2026-113374, and five other critical security flaws.

securityonline.info/sonatype-n

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-63774

Overview

  • Subnet Solutions
  • PowerSYSTEM Center 2024
06 Nov 2026
Published
06 Nov 2026
Updated
CVSS v3.1
CRITICAL (9.0)
EPSS
Pending
KEV

Description

Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

Statistics

  • 1 Post
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

CISA warns of critical Subnet Solutions PowerSYSTEM Center flaws CVE-2026-63017 and CVE-2026-63774 that allow authorization bypass and SQL injection.

securityonline.info/subnet-sol

  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-63017

Overview

  • Subnet Solutions
  • PowerSYSTEM Center 2020
06 Nov 2026
Published
06 Nov 2026
Updated
CVSS v3.1
CRITICAL (9.0)
EPSS
Pending
KEV

Description

Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

Statistics

  • 1 Post
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

CISA warns of critical Subnet Solutions PowerSYSTEM Center flaws CVE-2026-63017 and CVE-2026-63774 that allow authorization bypass and SQL injection.

securityonline.info/subnet-sol

  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-121720

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
Last activity: 6 hours ago

Fediverse

Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

OpenVPN 2.7.9 fixes two Windows-specific security issues: CVE-2026-121720 tightens checks on values passed by the service to the main program, while CVE-2026-115342 improves handling of command-line arguments with malformed quotation marks and aligns parsing between the main program and interactive service.

The release also restricts Windows plugin dependencies to trusted directories and adds Linux IFF_BACKPRESSURE support where available.

en.hacks.gr/i-openvpn-2-7-9-di

#OpenVPN #Windows #Linux #VPN

  • 0
  • 0
  • 0
  • 6h ago

CVE-2026-83542

Overview

  • Apache Software Foundation
  • Apache OFBiz
05 Nov 2026
Published
05 Nov 2026
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following: -- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient. -- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk. -- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response — it is not limited to the login-failure rendering path used in the original report. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Statistics

  • 1 Post
Last activity: 3 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

46 Apache OFBiz vulnerabilities, including pre-auth RCE CVE-2026-68524 and CVE-2026-83542, are fixed in OFBiz 24.09.08. Upgrade now.

securityonline.info/apache-ofb

  • 0
  • 0
  • 0
  • 3h ago

CVE-2026-77690

Overview

  • Zohocorp
  • ManageEngine Key Manager Plus
04 Nov 2026
Published
05 Nov 2026
Updated
CVSS v3.1
HIGH (8.8)
EPSS
15.58%
KEV

Description

ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Patch ManageEngine Key Manager Plus, Log360, and PAM360 now to fix CVE-2026-77690, CVE-2026-13594, and nine other critical and high flaws.

securityonline.info/manageengi

  • 0
  • 0
  • 0
  • 2h ago
Showing 71 to 80 of 119 CVEs