CVE-2026-40372

Overview

Microsoft
ASP.NET Core 10.0

21 Apr 2026

Published

22 Apr 2026

Updated

CVSS v3.1

CRITICAL (9.1)

EPSS

Pending

MITRE

KEV

Description

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Statistics

6 Posts
10 Interactions

Last activity: Last hour

Fediverse

.NET @dotnet

📰 .NET 10.0.7 Out-of-Band Security Update

We are releasing .NET 10.0.7 as an out-of-band security update to address CVE-2026-40372.

https://devblogs.microsoft.com/dotnet/dotnet-10-0-7-oob-security-update/ #dotnet

4
3
0
15h ago

Barret @barret

From the .NET blog...

Bluesky

Ninja Owl @ninjaowl.ai

Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...

0
0
0
Last hour

CVE-2026-32201

Overview

Microsoft
Microsoft SharePoint Enterprise Server 2016

14 Apr 2026

Published

21 Apr 2026

Updated

CVSS v3.1

MEDIUM (6.5)

EPSS

2.05%

MITRE

KEV

Description

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Statistics

5 Posts
12 Interactions

Last activity: Last hour

Fediverse

ekiledjian @edwardk

Over 1,370 Microsoft SharePoint servers are exposed online to a spoofing vulnerability (CVE-2026-32201), which is actively exploited in the wild. This critical flaw, identified by The Shadowserver Foundation, allows unauthorized attackers to bypass security protocols and potentially compromise sensitive corporate data, highlighting a significant patch management problem for many organizations.
https://gbhackers.com/1370-microsoft-sharepoint-servers-at-risk-of-spoofing-attacks/

0
0
0
4h ago

Bluesky

The Shadowserver Foundation @shadowserver.bsky.social

We are also scanning & reporting Microsoft SharePoint CVE-2026-32201 (Improper input validation in SharePoint allows an unauthorized attacker to perform spoofing over a network). This vulnerability is known exploited in the wild & on US CISA KEV list. 1370 IPs seen unpatched. Top: US

5
7
0
16h ago

The Shadowserver Foundation @shadowserver.bsky.social

CVE-2026-32201 tracker: dashboard.shadowserver.org/statistics/c... This is a version based scan. Microsoft Advisory: msrc.microsoft.com/update-guide...

0
0
0
16h ago

CyberVeille @cyberveille-ch.bsky.social

📢 Plus de 1 300 serveurs SharePoint non patchés exposés à CVE-2026-32201, exploitée en zero-day 📝 📰 **Source** : BleepingComputer, article de … https://cyberveille.ch/posts/2026-04-22-plus-de-1-300-serveurs-sharepoint-non-patches-exposes-a-cve-2026-32201-exploitee-en-zero-day/ #CISA_KEV #Cyberveille

0
0
0
Last hour

Cybersecurity News Everyday @hendryadrian.bsky.social

Over 1,300 Microsoft SharePoint servers remain unpatched against zero-day spoofing flaw CVE-2026-32201, affecting Server 2016, 2019, and Subscription Edition. Fewer than 200 patched despite active exploitation. #MicrosoftSharePoint #CISA #USA

0
0
0
Last hour

CVE-2026-20133

Overview

Cisco
Cisco Catalyst SD-WAN Manager

25 Feb 2026

Published

21 Apr 2026

Updated

CVSS v3.1

MEDIUM (6.5)

EPSS

1.97%

MITRE

KEV

Description

A vulnerability in Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due to insufficient file system access restrictions. An attacker could exploit this vulnerability by accessing the API of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.

Statistics

5 Posts
3 Interactions

Last activity: 4 hours ago

Bluesky

The IT Nerd @theitnerd.ca

The CISA adds eight Cisco SD-WAN flaws to KEV and gives organizations four days to fix them The CISA has added eight vulnerabilities to its KEV catalog, including CVE-2026-20133, another flaw affecting Cisco Catalyst SD-WAN Manager that Federal agencies have been given four days to secure their…

1
2
1
15h ago

Help Net Security @helpnetsecurity.com

CISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133) 📖 Read more: www.helpnetsecurity.com/2026/04/21/c... #cybersecurity #cybersecuritynews #government @cisco.com @vulncheck.bsky.social #CISA

0
0
0
23h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

CISA orders federal agencies to patch CVE-2026-20133 in Cisco Catalyst SD-WAN Manager by April 24 after active exploitation found. Flaw allows unauthenticated access to sensitive OS data via API. #SDWANFlaw #CVE202620133 #USA

0
0
0
14h ago

キタきつね @kitafox.bsky.social

CISAは、Cisco Catalyst SD-WAN Managerの別の脆弱性（CVE-2026-20133）が悪用されたことを警告した CISA flags another Cisco Catalyst SD-WAN Manager bug as exploited (CVE-2026-20133) #HelpNetSecurity (Apr 21) www.helpnetsecurity.com/2026/04/21/c...

0
0
0
4h ago

CVE-2026-34197

Overview

Apache Software Foundation
Apache ActiveMQ Broker
org.apache.activemq:activemq-broker

07 Apr 2026

Published

17 Apr 2026

Updated

CVSS

Pending

EPSS

59.64%

MITRE

KEV

Description

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

Statistics

3 Posts

Last activity: 5 hours ago

Fediverse

HackerWorkspace @hackerworkspace

CVE-2026-34197 ActiveMQ RCE via Jolokia API

https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/

Read on HackerWorkspace: https://hackerworkspace.com/article/cve-2026-34197-activemq-rce-via-jolokia-api

#cybersecurity #vulnerability #exploit

0
0
0
18h ago

ekiledjian @edwardk

Thousands of Apache ActiveMQ instances remain unpatched weeks after a critical remote code injection vulnerability (CVE-2026-34197) was discovered, highlighting a dangerous lag in security updates. Experts warn that with AI capable of rapidly weaponizing newly found bugs, slow patching cycles are a significant network security risk.
https://www.csoonline.com/article/4161532/thousands-of-apache-activemq-instances-still-unpatched-weeks-after-an-actively-exploited-hole-discovered.html

0
0
0
5h ago

Bluesky

Kees - Nijkerk @keesnk.bsky.social

6000+ Apache ActiveMQ Instances Vulnerable to CVE-2026-34197 exposed Online: cybersecuritynews.com/apache-activ...

0
0
0
5h ago

CVE-2023-33538

Overview

Pending

07 Jun 2023

Published

20 Dec 2025

Updated

CVSS

Pending

EPSS

89.90%

MITRE

KEV

Description

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

Statistics

3 Posts
5 Interactions

Last activity: 9 hours ago

Fediverse

Patrick C Miller :donor: @patrickcmiller

CVE-2023-33538 under attack for a year, but exploitation still unsuccessful https://securityaffairs.com/191040/hacking/cve-2023-33538-under-attack-for-a-year-but-exploitation-still-unsuccessful.html

2
3
1
9h ago

Chris Short @ChrisShort

TP-Link router owners beware | A Deep Dive Into Attempted Exploitation of CVE-2023-33538 #devopsish https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/

0
0
0
11h ago

CVE-2026-41285

Overview

OpenBSD
OpenBSD

20 Apr 2026

Published

21 Apr 2026

Updated

CVSS v3.1

MEDIUM (4.3)

EPSS

0.01%

MITRE

KEV

Description

In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "nd_opt_len * 8 - 2" expression with no preceding check for whether nd_opt_len is zero.

Statistics

2 Posts

Last activity: 7 hours ago

Fediverse

Nad @Nadsec

Another1 - CVE-2026-41285 - OpenBSD

https://nvd.nist.gov/vuln/detail/CVE-2026-41285

(Project asswing was not involved)

0
0
0
7h ago

Bluesky

Nad @nadsec.online

Another1 - CVE-2026-41285 - OpenBSD nvd.nist.gov/vuln/detail/... (Project asswing was not involved)

0
0
0
7h ago

CVE-2026-33825

Overview

Microsoft
Microsoft Defender Antimalware Platform

14 Apr 2026

Published

21 Apr 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

0.06%

MITRE

KEV

Description

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Statistics

2 Posts

Last activity: 5 hours ago

Fediverse

ekiledjian @edwardk

Three publicly available exploits, BlueHammer, RedSun, and UnDefend, are being used to turn Microsoft Defender into an attacker tool, with two enabling SYSTEM-level access and one disrupting Defender's update mechanism. While a patch exists for BlueHammer (CVE-2026-33825), RedSun and UnDefend exploit separate flaws, allowing attackers to escalate privileges or weaken defenses with minimal modifications.
https://www.darkreading.com/cyberattacks-data-breaches/exploits-turn-windows-defender-attacker-tool

0
0
0
5h ago

Bluesky

piggo @pigondrugs.bsky.social

~Huntress~ Nightmare-Eclipse LPE tools (BlueHammer/RedSun) are being actively exploited in the wild following FortiGate VPN compromise. - IOCs: staybud. dpdns. org, 78. 29. 48. 29, 179. 43. 140. 214 - #CVE202633825 #NightmareEclipse #threatintel

0
0
0
18h ago

CVE-2026-35616

Overview

Fortinet
FortiClientEMS

04 Apr 2026

Published

21 Apr 2026

Updated

CVSS v3.1

CRITICAL (9.1)

EPSS

32.03%

MITRE

KEV

Description

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

Statistics

1 Post
4 Interactions

Last activity: Last hour

Fediverse

N_{Dario Fadda} @nuke

Critical Fortinet FortiClient EMS Zero-Day CVE-2026-35616 Exploited Before Official Patch Was Released
#CyberSecurity
https://securebulletin.com/critical-fortinet-forticlient-ems-zero-day-cve-2026-35616-exploited-before-official-patch-was-released/

4
0
0
Last hour

CVE-2026-41316

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

1 Post
2 Interactions

Last activity: 14 hours ago

Fediverse

Fernando Briano @picandocodigo

Ruby 4.0.3 Released
This release only contains ERB 6.0.1.1, which fixes CVE-2026-41316.

https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released/

#Ruby

2
0
0
14h ago

CVE-2026-40933

Overview

FlowiseAI
Flowise

21 Apr 2026

Published

21 Apr 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

Pending

MITRE

KEV

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. The vulnerability lies in a bug in the input sanitization from the “Custom MCP” configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example "npx" can be combined with code execution arguments ("-c touch /tmp/pwn") that enable direct code execution on the underlying OS. This vulnerability is fixed in 3.1.0.

Statistics

1 Post
1 Interaction

Last activity: 7 hours ago

Fediverse

OffSequence @offseq

🚨 CRITICAL: CVE-2026-40933 in FlowiseAI Flowise (< 3.1.0) allows authenticated OS command injection via unsafe MCP adapter serialization. Upgrade to 3.1.0+ to fully mitigate. CVSS 10 — patch now! https://radar.offseq.com/threat/cve-2026-40933-cwe-78-improper-neutralization-of-s-3bdaeff3 #OffSeq #Vulnerability #FlowiseAI #Cybersecurity

1
0
0
7h ago