24h | 7d | 30d

CVE-2026-115646

Overview

  • Hitachi
  • HiRDB Server Version 10
10 Nov 2026
Published
10 Nov 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.38%
KEV

Description

Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50-/F through 09-66/V; HiRDB Server Version 9(32): from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-50-/F through 09-66-/V.

Statistics

  • 1 Post
Last activity: 21 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

HiRDB partial string comparison vuln (CVE-2026-115646) – CRITICAL, CVSS 9.8. Affects 10 (<10-12-01) & 9 (09-50-06 – 09-66-22). Remote unauth attackers can bypass security. No patch — watch vendor releases. radar.offseq.com/threat/partia

  • 0
  • 0
  • 0
  • 21h ago

CVE-2026-121352

Overview

  • Adobe
  • Adobe Connect
10 Nov 2026
Published
11 Nov 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
Pending
KEV

Description

Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access to sensitive resources. Exploitation of this issue does not require user interaction. Scope is changed.

Statistics

  • 1 Post
Last activity: 8 hours ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-121352 | CVSS 10.0 Adobe Connect Authorization Vulnerability NVD describes a critical Incorrect Authorization vulnerability in Adobe Connect that could enable privilege escalation and unauthorized access to sensitive… Full analysis: https://t.me/aiutocomputerhelp_lab/1409
  • 0
  • 0
  • 0
  • 8h ago

CVE-2026-84031

Overview

  • IBM
  • Guardium Data Protection
18 Sep 2026
Published
18 Sep 2026
Updated
CVSS v3.1
CRITICAL (9.0)
EPSS
0.62%
KEV

Description

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

Statistics

  • 1 Post
Last activity: 13 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-84031 IBM Guardium 12.2 remote authenticated RCE via improper input neutralization. CVSS 9, no patch confirmed. Patch or restrict access now. #CVE #infosec #IBM valtersit.com/cve/CVE-2026-840

  • 0
  • 0
  • 0
  • 13h ago

CVE-2026-113466

Overview

  • MinIO
20 Oct 2026
Published
20 Oct 2026
Updated
CVSS v4.0
MEDIUM (6.9)
EPSS
0.38%
KEV

Description

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Statistics

  • 1 Post
Last activity: 5 hours ago

Fediverse

Profile picture fallback
ZAST AI @zastai

CVE-2026-113466 — MinIO embedded Console, CVSS 3.1 5.3 Medium.

S3 Select's ParseSelectFailure response returns globalDeploymentID() as HostId. That identifier serves as both CONSOLE_PBKDF_PASSPHRASE and CONSOLE_PBKDF_SALT, so the Console cookie key is derivable offline by anyone reaching an anonymously readable bucket with a known object key.

AuthenticationMiddleware decrypts the cookie and forwards the claims as a Bearer header without validating the STS credentials; the downstream MinIO server performs the SigV4 check, so a forged session requires valid credentials to succeed.

Found and verified by the ZAST engine on RELEASE.2025-10-15T17-29-55Z. No fixed version; rotate default root credentials and remove unnecessary anonymous read policies meanwhile.

Full report: blog.zast.ai/vulnerability%20r

  • 0
  • 0
  • 0
  • 5h ago

CVE-2026-75878

Overview

  • IBM
  • Sterling File Gateway
18 Sep 2026
Published
19 Sep 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
0.64%
KEV

Description

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header.

Statistics

  • 1 Post
Last activity: 16 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-75878 IBM Sterling File Gateway auth bypass lets a remote attacker grab a fully authenticated session via an unvalidated SSO header. CVSS 9.1, no patch confirmed. Lock down SSO headers and restrict exposure now. #CVE #infosec #IBM valtersit.com/cve/CVE-2026-758

  • 0
  • 0
  • 0
  • 16h ago

CVE-2026-111793

Overview

  • Openwave Messaging (Ireland) Limited
  • Webtop Media Transcoder
16 Oct 2026
Published
11 Nov 2026
Updated
CVSS v3.1
MEDIUM (4.3)
EPSS
0.27%
KEV

Description

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: Last hour

Fediverse

Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

The U.S.

CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-20320 in Cisco BroadWorks and CVE-2026-111793 in Openwave Messaging.

The Cisco issue allows unauthorized reading of sensitive settings, while the Openwave flaw permits document processing manipulation.

FCEB agencies are required to apply patches by November 24, 2026.

While the patches for these issues were rele…

en.hacks.gr/i-cisa-proeidopoie

#Cisco #Openwave #CVE_2026_20320 #CVE_2026_111793

  • 0
  • 0
  • 0
  • Last hour
Profile picture fallback
@ssvc

I'm late in posting today but happy Patch Tuesday. CISA added 6 new vulnerabilities to the KEV Catalog, two are zero-days but only one is new today (Microsoft):

  • CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
  • CVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability
  • CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
  • CVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
  • CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
  • CVE-2026-125350 Google Chromium Use-After-Free Vulnerability

cisa.gov/news-events/alerts/20

  • 0
  • 1
  • 0
  • 9h ago

CVE-2025-39964

Overview

  • Linux
  • Linux
13 Oct 2025
Published
10 Nov 2026
Updated
CVSS v3.1
HIGH (7.8)
EPSS
1.61%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 20 hours ago

Fediverse

Profile picture fallback
CERT@VDE @certvde

🔒 New CSAF advisory published

VDE-2026-143
Bender EDGE500IP Vulnerabilities - Linux Kernel (TLS and AF_ALG)
CVE-2025-39682, CVE-2025-39964

Bender is publishing this advisory to inform customers about two vulnerabilities in the Linux kernel used by the EDGE500IP. CISA has added both vulnerabilities (CVE-2025-39682 an…

HTML: certvde.com/en/advisories/VDE-
CSAF JSON: bender.csaf-tp.certvde.com/.we

  • 1
  • 1
  • 0
  • 20h ago

CVE-2025-39682

Overview

  • Linux
  • Linux
05 Sep 2025
Published
07 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
3.31%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.

Statistics

  • 1 Post
  • 2 Interactions
Last activity: 20 hours ago

Fediverse

Profile picture fallback
CERT@VDE @certvde

🔒 New CSAF advisory published

VDE-2026-143
Bender EDGE500IP Vulnerabilities - Linux Kernel (TLS and AF_ALG)
CVE-2025-39682, CVE-2025-39964

Bender is publishing this advisory to inform customers about two vulnerabilities in the Linux kernel used by the EDGE500IP. CISA has added both vulnerabilities (CVE-2025-39682 an…

HTML: certvde.com/en/advisories/VDE-
CSAF JSON: bender.csaf-tp.certvde.com/.we

  • 1
  • 1
  • 0
  • 20h ago

CVE-2026-85101

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 13 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Update Synology DiskStation Manager now to patch CVE-2026-76954, CVE-2026-85101, and 25 other flaws allowing arbitrary file writes and crashes.

securityonline.info/synology-d

  • 1
  • 0
  • 0
  • 13h ago

CVE-2026-76954

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 13 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Update Synology DiskStation Manager now to patch CVE-2026-76954, CVE-2026-85101, and 25 other flaws allowing arbitrary file writes and crashes.

securityonline.info/synology-d

  • 1
  • 0
  • 0
  • 13h ago
Showing 71 to 80 of 114 CVEs