24h | 7d | 30d

CVE-2026-105279

Overview

  • J4Care
  • dcm4chee-arc-light
16 Oct 2026
Published
16 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
0.24%
KEV

Description

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.

Statistics

  • 1 Post
Last activity: 7 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

CISA warns of dcm4chee vulnerabilities that expose patient data, plus unpatched EseeCloud cameras with hard-coded credentials (CVE-2026-107617).

securityonline.info/dcm4chee-v

  • 0
  • 0
  • 0
  • 7h ago

CVE-2026-96655

Overview

  • Plex
  • Media Server
23 Sep 2026
Published
23 Sep 2026
Updated
CVSS v3.1
MEDIUM (4.3)
EPSS
0.22%
KEV

Description

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

Statistics

  • 1 Post
  • 4 Interactions
Last activity: 16 hours ago

Fediverse

Profile picture fallback
Dark Web Informer :verified_paw: @DarkWebInformer

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

PoC: github.com/code-zm/plex2shell

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

Source: zmain.info/blog/plex2shell

  • 2
  • 2
  • 0
  • 16h ago

CVE-2026-76519

Overview

  • Cisco
  • Cisco Secure Email
14 Oct 2026
Published
15 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
1.57%
KEV

Description

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

Statistics

  • 1 Post
Last activity: 13 hours ago

Fediverse

Profile picture fallback
Patch or Pass @PatchOrPass

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: patchorpass.beehiiv.com/?v=2

  • 0
  • 0
  • 0
  • 13h ago

CVE-2026-104935

Overview

  • Ivanti
  • Connect Secure
13 Oct 2026
Published
13 Oct 2026
Updated
CVSS v3.1
HIGH (8.6)
EPSS
25.98%
KEV

Description

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Statistics

  • 1 Post
Last activity: 13 hours ago

Fediverse

Profile picture fallback
Patch or Pass @PatchOrPass

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: patchorpass.beehiiv.com/?v=2

  • 0
  • 0
  • 0
  • 13h ago

CVE-2026-96951

Overview

  • Microsoft
  • Outlook.com
13 Oct 2026
Published
16 Oct 2026
Updated
CVSS v3.1
HIGH (8.8)
EPSS
1.51%
KEV

Description

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Statistics

  • 1 Post
Last activity: 13 hours ago

Fediverse

Profile picture fallback
Patch or Pass @PatchOrPass

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: patchorpass.beehiiv.com/?v=2

  • 0
  • 0
  • 0
  • 13h ago

CVE-2026-0322

Overview

  • Palo Alto Networks
  • Cloud NGFW
14 Oct 2026
Published
15 Oct 2026
Updated
CVSS v4.0
HIGH (8.6)
EPSS
1.22%
KEV

Description

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

Statistics

  • 1 Post
Last activity: 13 hours ago

Fediverse

Profile picture fallback
Patch or Pass @PatchOrPass

Actively exploited flaws worth your time this week, for homelab and small-office gear:

🔴 Ivanti Connect Secure CVE-2026-104935
🔴 Windows Shell CVE-2026-96951
🔴 PAN-OS CVE-2026-0322 (if mgmt is exposed)
🔴 Cisco Secure Email Gateway CVE-2026-76519

Nothing for Proxmox, TrueNAS, UniFi, pfSense, or Synology.

I send a short version every Wednesday, free: patchorpass.beehiiv.com/?v=2

  • 0
  • 0
  • 0
  • 13h ago
Showing 51 to 56 of 56 CVEs