24h | 7d | 30d

CVE-2013-1776

Overview

  • Pending
08 Apr 2013
Published
06 Aug 2024
Updated
CVSS
Pending
EPSS
0.37%
KEV

Description

sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.

Statistics

  • 1 Post
  • 18 Interactions
Last activity: 16 hours ago

Fediverse

Profile picture fallback
Ryan Castellucci (they/them) 🎃 :nonbinary_flag: @ryanc

ATTENTION HACKERS: I am belatedly naming CVE-2013-1776 "Grand Theft Sudo".

sudo.ws/security/advisories/tt

  • 2
  • 16
  • 0
  • 16h ago

CVE-2026-106378

Overview

  • Google
  • Chrome
06 Oct 2026
Published
07 Oct 2026
Updated
CVSS
Pending
EPSS
0.32%
KEV

Description

Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Statistics

  • 1 Post
  • 6 Interactions
Last activity: 14 hours ago

Fediverse

Profile picture fallback
Dark Web Informer :verified_paw: @DarkWebInformer

🚨 Chrome macOS GPU sandbox escape enables code execution outside the browser; CVE-2026-106378

Security researchers discovered that Chrome’s sandboxed GPU process could communicate with macOS WindowServer and inject keyboard input into the desktop.
⠀
The public proof of concept opens Spotlight, types “Calculator” and launches the application outside Chrome’s sandbox. The same technique could potentially open Terminal and execute commands.
⠀
The vulnerability is not a standalone one-click exploit. An attacker must first compromise a Chrome renderer or GPU process before using the flaw to escape the sandbox.
⠀
Key details:

• CVSS: 8.3 (CISA-ADP)
• Chromium severity: Medium
• Affected: Chrome for macOS before 155.0.8059.39
• Fixed: Chrome 155.0.8059.39 and later
• Public PoC: Available
• Active exploitation: Not reported

Technical analysis: pwn.ai/blog/chrome-escape

  • 3
  • 3
  • 0
  • 14h ago

CVE-2026-42069

Overview

  • getkirby
  • kirby
09 May 2026
Published
12 May 2026
Updated
CVSS v4.0
HIGH (7.1)
EPSS
0.23%
KEV

Description

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0.

Statistics

  • 1 Post
  • 20 Interactions
Last activity: 10 hours ago

Fediverse

Profile picture fallback
xssfox (crossy) @xssfox

Patch is out. It has been assigned CVE-2026-42069 (also known as 99xssballoons)

  • 1
  • 19
  • 0
  • 10h ago

CVE-2026-93977

Overview

  • code-projects
  • Assessment Management
20 Sep 2026
Published
24 Sep 2026
Updated
CVSS v4.0
MEDIUM (5.1)
EPSS
0.35%
KEV

Description

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 4 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-93977: XSS in code-projects Assessment Management 1.0, add-single-mark.php via the mark argument. CVSS 3.5, exploit publicly disclosed, no patch available. Restrict exposure and review input handling now. #CVE #infosec #cybersecurity valtersit.com/cve/CVE-2026-939

  • 1
  • 0
  • 0
  • 4h ago

CVE-2026-120209

Overview

  • anji-plus
  • AJ-Report
31 Oct 2026
Published
31 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
Pending
KEV

Description

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 12 hours ago

Fediverse

Profile picture fallback
Kyle Reddoch (CybersecKyle) @cyberseckyle

VulnCheck reports CVE-2026-120209 in AJ-Report ≤1.7.1. A hard-coded JWT signing secret can enable forged share tokens and unauthenticated remote code execution.

No in-the-wild exploitation or fixed release was confirmed in the sources checked. Admins: inventory installations, restrict exposure and track vendor guidance.

vulncheck.com/advisories/aj-re

  • 1
  • 0
  • 0
  • 12h ago

CVE-2026-93976

Overview

  • code-projects
  • Assessment Management
20 Sep 2026
Published
21 Sep 2026
Updated
CVSS v4.0
MEDIUM (4.8)
EPSS
0.37%
KEV

Description

A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument level results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 18 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-93976: reflected XSS in code-projects Assessment Management 1.0 admin/add-user.php via the level parameter. CVSS 2.4, public exploit, no patch yet. Validate and update when a fix lands. #CVE #infosec #cybersecurity valtersit.com/cve/CVE-2026-939

  • 1
  • 0
  • 0
  • 18h ago

CVE-2026-111585

Overview

  • TeamViewer
  • Full Client
27 Oct 2026
Published
27 Oct 2026
Updated
CVSS v3.1
HIGH (8.8)
EPSS
0.29%
KEV

Description

An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 23 hours ago

Fediverse

Profile picture fallback
ransomNews @ransomnews

⚠️ TeamViewer hosts can attack connecting computers

CVE-2026-111585 can crash viewers and may allow code execution; fixed in version 15.83.
🔗 read more: remedio.io/research/vulnerabil

#ransomNews #cyberthreats #TeamViewer

  • 1
  • 0
  • 0
  • 23h ago

CVE-2026-93978

Overview

  • code-projects
  • Internship Management System
20 Sep 2026
Published
21 Sep 2026
Updated
CVSS v4.0
MEDIUM (6.9)
EPSS
0.43%
KEV

Description

A vulnerability was identified in code-projects Internship Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Such manipulation of the argument Password leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 14 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-93978: SQL injection in code-projects Internship Management System 1.0, /login.php via Password arg. CVSS 7.3, exploit public, no patch known. Patch or isolate now. #CVE #infosec #cybersecurity valtersit.com/cve/CVE-2026-939

  • 0
  • 1
  • 0
  • 14h ago

CVE-2026-106173

Overview

  • Fortinet
  • FortiSIEM
13 Oct 2026
Published
21 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.4)
EPSS
1.00%
KEV

Description

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 18 hours ago

Bluesky

Profile picture fallback
marktsec @marktsec.bsky.social
CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE horizon3.ai/attack-resea...
  • 0
  • 1
  • 0
  • 18h ago

CVE-2026-116689

Overview

  • follow-redirects
  • follow-redirects
27 Oct 2026
Published
30 Oct 2026
Updated
CVSS v3.1
MEDIUM (5.9)
EPSS
0.27%
KEV

Description

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

Statistics

  • 1 Post
Last activity: 21 hours ago

Bluesky

Profile picture fallback
Lambda Watchdog @lambdawatchdog.bsky.social
🚨 New HIGH CVE detected in AWS Lambda 🚨 CVE-2026-116689 impacts follow-redirects in 4 Lambda base images. Details: https://github.com/aws/aws-lambda-base-images/issues/788 More: https://lambdawatchdog.com/ #AWS #Lambda #CVE #CloudSecurity #Serverless
  • 0
  • 0
  • 0
  • 21h ago
Showing 11 to 20 of 51 CVEs