24h | 7d | 30d

CVE-2026-114148

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
Last activity: 1 hour ago

Bluesky

Profile picture fallback
Information Security Briefly @infosecbriefly.bsky.social
Microsoft released out-of-band emergency .NET patches for .NET 8, 9, 10, and .NET 11 RC3 to fix CVE-2026-111497 and CVE-2026-114148.
  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-48356

Overview

  • Adobe
  • Adobe Commerce
14 Jul 2026
Published
27 Aug 2026
Updated
CVSS v3.1
CRITICAL (9.3)
EPSS
30.58%
KEV

Description

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Statistics

  • 1 Post
Last activity: 21 hours ago

Fediverse

Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

Dutch e-commerce security firm Sansec reports that an unknown threat actor has infected 953 online stores, mostly running Magento, in a campaign active since July 2025.

The campaign injects malicious JavaScript loader code into store pages, filtering out security scanners.

Investigators observed infections linked to vulnerabilities including CVE-2026-48356 and CVE-2025-54236, with loader versions utilizing browser fingerpr…

en.hacks.gr/epithesi-se-schedo

#Magento #Sansec #CVE202648356 #CVE202554236

  • 0
  • 0
  • 0
  • 21h ago

CVE-2026-115893

Overview

  • bytecodealliance
  • wasmtime
23 Oct 2026
Published
23 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.9)
EPSS
0.43%
KEV

Description

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

Statistics

  • 1 Post
Last activity: 19 hours ago

Fediverse

Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

Two severe security flaws, each rated 9.9 out of 10, have been discovered in the Wasmtime WebAssembly runtime.

Both bugs reside in Cranelift, the default compiler used by Wasmtime.

CVE-2026-115889 affects all processor architectures, while CVE-2026-115893 impacts ARM64 systems.

Fixed release lines include 36.0.19, 48.0.7, 49.0.4, and 50.0.0 or later.

en.hacks.gr/dyo-sovara-kena-as

#Wasmtime #WebAssembly #Cranelift #Vulnerability

  • 0
  • 0
  • 0
  • 19h ago

CVE-2026-115889

Overview

  • bytecodealliance
  • wasmtime
23 Oct 2026
Published
26 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.9)
EPSS
0.45%
KEV

Description

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.

Statistics

  • 1 Post
Last activity: 19 hours ago

Fediverse

Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

Two severe security flaws, each rated 9.9 out of 10, have been discovered in the Wasmtime WebAssembly runtime.

Both bugs reside in Cranelift, the default compiler used by Wasmtime.

CVE-2026-115889 affects all processor architectures, while CVE-2026-115893 impacts ARM64 systems.

Fixed release lines include 36.0.19, 48.0.7, 49.0.4, and 50.0.0 or later.

en.hacks.gr/dyo-sovara-kena-as

#Wasmtime #WebAssembly #Cranelift #Vulnerability

  • 0
  • 0
  • 0
  • 19h ago

CVE-2021-33045

Overview

  • Some Dahua IP Camera, Video Intercom, NVR, XVR devices
15 Sep 2021
Published
12 Jan 2026
Updated
CVSS
Pending
EPSS
99.59%
KEV

Description

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

Statistics

  • 1 Post
Last activity: 10 hours ago

Fediverse

Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

CERT-UA and SSSCIP have issued an alert warning of unauthorized remote access campaigns targeting Dahua video surveillance systems.

Attacks leverage predictable device serial numbers for automated discovery alongside older authentication bypass vulnerabilities (CVE-2021-33044 and CVE-2021-33045) and weak passwords.

Intelligence reports also highlight broader campaigns compromising internet-exposed cameras across multiple manuf…

en.hacks.gr/proeidopoiisi-stin

#Dahua #Surveillance #IoT #Vulnerability

  • 0
  • 0
  • 0
  • 10h ago

CVE-2023-4863

Overview

  • Google
  • Chrome
12 Sep 2023
Published
21 Oct 2025
Updated
CVSS
Pending
EPSS
99.98%
KEV

Description

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Statistics

  • 1 Post
Last activity: 1 hour ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Cisa~ Critical flaws enable code execution, authentication bypass, and arbitrary operations; patch affected products. - IOCs: CVE-2023-4863, CVE-2026-16436, CVE-2026-16437 - #CVE #ICS #ThreatIntel
  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-16437

Overview

  • Mitsubishi Electric Corporation
  • GENESIS
15 Oct 2026
Published
16 Oct 2026
Updated
CVSS v4.0
HIGH (7.1)
EPSS
0.09%
KEV

Description

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

Statistics

  • 1 Post
Last activity: 1 hour ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Cisa~ Critical flaws enable code execution, authentication bypass, and arbitrary operations; patch affected products. - IOCs: CVE-2023-4863, CVE-2026-16436, CVE-2026-16437 - #CVE #ICS #ThreatIntel
  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-114597

Overview

  • The EPICS Community
  • EPICS Base
27 Oct 2026
Published
27 Oct 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
Pending
KEV

Description

In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.

Statistics

  • 1 Post
Last activity: 1 hour ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Cisa~ EPICS Base <=7.0.10 flaws enable DoS, memory disclosure, corruption, or code execution; update to 7.0.11. - IOCs: CVE-2026-114595, CVE-2026-114596, CVE-2026-114597 - #CVE #ICS #ThreatIntel
  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-28864

Overview

  • Apple
  • iOS and iPadOS
25 Mar 2026
Published
26 Oct 2026
Updated
CVSS
Pending
EPSS
0.18%
KEV

Description

This issue was addressed with improved permissions checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, iOS 26.7.2 and iPadOS 26.7.2, macOS Sequoia 15.7.5, macOS Sequoia 15.8.2, macOS Sonoma 14.8.5, macOS Tahoe 26.4, macOS Tahoe 26.7.2, visionOS 26.4, watchOS 26.4. A local attacker may gain access to user's Keychain items.

Statistics

  • 1 Post
Last activity: 8 hours ago

Fediverse

Profile picture fallback
ekiledjian @edwardk

Apple Patches for October 2026, (Mon, Oct 26th)

Apple has released its October 2026 security updates, covering 304 vulnerabilities across iOS, iPadOS, macOS, tvOS, watchOS, visionOS and Safari, according to the SANS Internet Storm Center. No new vulnerability in this release is marked as already exploited, but the update delivers iOS 18 patches for CVE-2026-86950, an already-exploited CoreGraphics flaw first patched a month ago; other notable fixes include CVE-2026-86990, which let a malicious app access the camera without permission, and CVE-2026-28864, which let a local attacker access a user’s Keychain items. isc.sans.edu/diary/rss/33458

  • 0
  • 0
  • 0
  • 8h ago

CVE-2026-111459

Overview

  • Moxa
  • Moxa Remote Connect Suite (MRC Client)
27 Oct 2026
Published
27 Oct 2026
Updated
CVSS v4.0
HIGH (7.6)
EPSS
0.17%
KEV

Description

An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications.

Statistics

  • 1 Post
Last activity: 1 hour ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Cybergcca~ Critical PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 are in CISA KEV; update affected products. - IOCs: CVE-2026-109618, CVE-2026-109619, CVE-2026-111459 - #CVE #Cybersecurity #ThreatIntel
  • 0
  • 0
  • 0
  • 1h ago
Showing 71 to 80 of 85 CVEs