CVE-2023-2868

Overview

Barracuda
Barracuda Email Security Gateway

24 May 2023

Published

21 Oct 2025

Updated

CVSS v3.1

CRITICAL (9.4)

EPSS

90.02%

MITRE

KEV

Description

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

Statistics

1 Post

Last activity: 14 hours ago

Fediverse

Metasploit @metasploit

The latest #Metasploit Wrapup is here! 🎉 This week brings enhanced SMB NTLM relaying for better client compatibility (including smbclient), plus new modules for RCE in Eclipse Che (CVE-2025-12548), Barracuda ESG command injection (CVE-2023-2868), and an ESC/POS printer injector.

Check it out at https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-03-27-2026/

0
0
0
14h ago

CVE-2026-33634

Overview

aquasecurity
setup-trivy

23 Mar 2026

Published

27 Mar 2026

Updated

CVSS v4.0

CRITICAL (9.4)

EPSS

26.61%

MITRE

KEV

Description

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.

Statistics

1 Post

Last activity: 19 hours ago

Fediverse

CyberNetsecIO @netsecio

📰 CISA KEV Alert: Actively Exploited Flaws in Langflow AI Framework and Trivy Scanner

📢 CISA KEV UPDATE: Two flaws now under active exploitation! A critical RCE in Langflow AI framework (CVE-2026-33017) and a supply-chain attack via Trivy scanner (CVE-2026-33634). Patch now! ⚠️ #KEV #CyberSecurity #RCE

🔗 https://cyber.netsecops.io/articles/cisa-adds-exploited-trivy-and-langflow-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

0
0
0
19h ago

CVE-2025-12548

Overview

Red Hat
Red Hat OpenShift Dev Spaces (RHOSDS) 3.22
devspaces/code-rhel9

13 Jan 2026

Published

21 Jan 2026

Updated

CVSS

Pending

EPSS

50.73%

MITRE

KEV

Description

A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333.

Statistics

1 Post

Last activity: 14 hours ago

Fediverse

Metasploit @metasploit

The latest #Metasploit Wrapup is here! 🎉 This week brings enhanced SMB NTLM relaying for better client compatibility (including smbclient), plus new modules for RCE in Eclipse Che (CVE-2025-12548), Barracuda ESG command injection (CVE-2023-2868), and an ESC/POS printer injector.

Check it out at https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-03-27-2026/

0
0
0
14h ago

CVE-2026-34070

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

1 Post
2 Interactions

Last activity: 23 hours ago

Bluesky

Bitnewsbot @bitnewsbot.bsky.social

Three security vulnerabilities (CVE-2026-34070, CVE-2025-68664, CVE-2025-67644) were disclosed in LangChain and LangGraph frameworks, impacting over 84 million weekly downloads. The […]

1
1
0
23h ago

CVE-2025-68664

Overview

langchain-ai
langchain

23 Dec 2025

Published

24 Dec 2025

Updated

CVSS v3.1

CRITICAL (9.3)

EPSS

0.04%

MITRE

KEV

Description

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.

Statistics

1 Post
2 Interactions

Last activity: 23 hours ago

Bluesky

Bitnewsbot @bitnewsbot.bsky.social

Three security vulnerabilities (CVE-2026-34070, CVE-2025-68664, CVE-2025-67644) were disclosed in LangChain and LangGraph frameworks, impacting over 84 million weekly downloads. The […]

1
1
0
23h ago

CVE-2025-67644

Overview

langchain-ai
langgraph

10 Dec 2025

Published

11 Dec 2025

Updated

CVSS v3.1

HIGH (7.3)

EPSS

0.02%

MITRE

KEV

Description

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Versions 3.0.0 and below are vulnerable to SQL injection through the checkpoint implementation. Checkpoint allows attackers to manipulate SQL queries through metadata filter keys, affecting applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations. The _metadata_predicate() function constructs SQL queries by interpolating filter keys directly into f-strings without validation. This issue is fixed in version 3.0.1.

Statistics

1 Post
2 Interactions

Last activity: 23 hours ago

Bluesky

Bitnewsbot @bitnewsbot.bsky.social

Three security vulnerabilities (CVE-2026-34070, CVE-2025-68664, CVE-2025-67644) were disclosed in LangChain and LangGraph frameworks, impacting over 84 million weekly downloads. The […]

1
1
0
23h ago

CVE-2026-4368

Overview

NetScaler
ADC

23 Mar 2026

Published

24 Mar 2026

Updated

CVSS v4.0

HIGH (7.7)

EPSS

0.02%

MITRE

KEV

Description

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

Statistics

1 Post

Last activity: 21 hours ago

Fediverse

Andi @Andi

Zwei kritische Schwachstellen beherrschen die Lage für deutsche Unternehmen.
Das BSI warnt vor einer aktiv ausgenutzten Lücke in Microsoft SharePoint. Die CISA hatte die Schwachstelle am 18. März in ihren Katalog ausgenutzter Sicherheitslücken aufgenommen. CERT-EU veröffentlichte am 25. März ein Advisory und verwies auf Maßnahmen aus der ToolShell-Angriffskampagne des Vorjahres. Der CVSS-Score liegt bei 9.8 von 10 und wurde hochgestuft, nachdem sich herausstellte, dass eine Ausnutzung auch ohne Authentifizierung möglich ist.
Parallel dazu hat CERT-Bund am 24. März Alarm wegen zweier Schwachstellen in Citrix NetScaler ADC und NetScaler Gateway geschlagen. CVE-2026-3055 ermöglicht es nicht authentifizierten Angreifern, aktive Session-Token aus dem Speicher betroffener Geräte auszulesen. CVE-2026-4368 kann durch eine Race Condition zur Übernahme fremder Benutzersitzungen führen. Besonders gefährdet sind Systeme, die als SAML Identity Provider konfiguriert sind, also eine in Unternehmensumgebungen weit verbreitete Konfiguration für Single Sign-On. Sicherheitsforscher bewerten eine baldige aktive Ausnutzung als sehr wahrscheinlich.
Sofortmaßnahmen: SharePoint patchen, NetScaler aktualisieren und aktiven Sessions beenden.

Cybersicherheitswarnung 2026-238220-1032 (25.03.2026) | CERT-Bund WID-SEC-2026-0836 (24.03.2026)
CVE-2026-20963 | CVE-2026-3055 | CVE-2026-4368
#Informationssicherheit #CISO #BSI #SharePoint #Citrix #NetScaler #Patchmanagement #NIS2 #CyberSecurity #ITSicherheit

0
0
0
21h ago

CVE-2026-4747

Overview

FreeBSD
FreeBSD

26 Mar 2026

Published

27 Mar 2026

Updated

CVSS

Pending

EPSS

0.15%

MITRE

KEV

Description

Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer, but fails to ensure that the buffer is sufficiently large, and a malicious client can trigger a stack overflow. Notably, this does not require the client to authenticate itself first. As kgssapi.ko's RPCSEC_GSS implementation is vulnerable, remote code execution in the kernel is possible by an authenticated user that is able to send packets to the kernel's NFS server while kgssapi.ko is loaded into the kernel. In userspace, applications which have librpcgss_sec loaded and run an RPC server are vulnerable to remote code execution from any client able to send it packets. We are not aware of any such applications in the FreeBSD base system.

Statistics

1 Post

Last activity: 19 hours ago

Bluesky

piggo @pigondrugs.bsky.social

~Cybergcca~ Security updates released for WatchGuard, Siemens, FreeBSD (RCE), and Ericsson. - IOCs: CVE-2026-4747, CVE-2026-4266, CVE-2026-4652 - #Patch #ThreatIntel #Vulnerability

0
0
0
19h ago

CVE-2026-4652

Overview

FreeBSD
FreeBSD

26 Mar 2026

Published

26 Mar 2026

Updated

CVSS

Pending

EPSS

0.05%

MITRE

KEV

Description

On a system exposing an NVMe/TCP target, a remote client can trigger a kernel panic by sending a CONNECT command for an I/O queue with a bogus or stale CNTLID. An attacker with network access to the NVMe/TCP target can trigger an unauthenticated Denial of Service condition on the affected machine.

Statistics

1 Post

Last activity: 19 hours ago

Bluesky

piggo @pigondrugs.bsky.social

~Cybergcca~ Security updates released for WatchGuard, Siemens, FreeBSD (RCE), and Ericsson. - IOCs: CVE-2026-4747, CVE-2026-4266, CVE-2026-4652 - #Patch #ThreatIntel #Vulnerability

0
0
0
19h ago

CVE-2026-4266

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

1 Post

Last activity: 19 hours ago

Bluesky

piggo @pigondrugs.bsky.social

~Cybergcca~ Security updates released for WatchGuard, Siemens, FreeBSD (RCE), and Ericsson. - IOCs: CVE-2026-4747, CVE-2026-4266, CVE-2026-4652 - #Patch #ThreatIntel #Vulnerability

0
0
0
19h ago