CVE-2026-24778

Overview

TryGhost
Ghost

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

HIGH (8.8)

EPSS

Pending

MITRE

KEV

Description

Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially leading to account takeover. Ghost Portal versions 2.29.1 through 2.51.4 and 2.52.0 through 2.57.0 were vulnerable to this issue. Ghost automatically loads the latest patch of the members Portal component via CDN. For Ghost 5.x users, upgrading to v5.121.0 or later fixes the vulnerability. v5.121.0 loads Portal v2.51.5, which contains the patch. For Ghost 6.x users, upgrading to v6.15.0 or later fixes the vulnerability. v6.15.0 loads Portal v2.57.1, which contains the patch. For Ghost installations using a customized or self-hosted version of Portal, it will be necessary to manually rebuild from or update to the latest patch version.

Statistics

1 Post

Last activity: 11 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-24778 - High (8.8)

Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaSc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24778/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
11h ago

CVE-2026-24538

Overview

omnipressteam
Omnipress
omnipress

23 Jan 2026

Published

26 Jan 2026

Updated

CVSS

Pending

EPSS

0.11%

MITRE

KEV

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in omnipressteam Omnipress omnipress allows PHP Local File Inclusion.This issue affects Omnipress: from n/a through <= 1.6.6.

Statistics

1 Post

Last activity: 18 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-24538 - High (7.6)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in omnipressteam Omnipress omnipress allows PHP Local File Inclusion.This issue affects Omnipress: from n/a through <= 1.6.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
18h ago

CVE-2026-0648

Overview

Eclipse Foundation
Eclipse ThreadX

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

Pending

MITRE

KEV

Description

The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) when handling the return value of osek_get_counter(). Specifically, the current code checks if cntr_id equals 0u to determine failure, but @osek_get_counter() actually returns E_OS_SYS_STACK (defined as 12U) when it fails. This mismatch causes the error branch to never execute even when the counter pool is exhausted. As a result, when the counter pool is depleted, the code proceeds to cast the error code (12U) to a pointer (OSEK_COUNTER *), creating a wild pointer. Subsequent writes to members of this pointer lead to writes to illegal memory addresses (e.g., 0x0000000C), which can trigger immediate HardFaults or silent memory corruption. This vulnerability poses significant risks, including potential denial-of-service attacks (via repeated calls to exhaust the counter pool) and unauthorized memory access.

Statistics

1 Post

Last activity: 17 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-0648 - High (7.8)

The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) when handling the return value of osek_get_counter(). Specifically, the current code chec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
17h ago

CVE-2019-11043

Overview

PHP
PHP

28 Oct 2019

Published

21 Oct 2025

Updated

CVSS v3.1

HIGH (8.7)

EPSS

94.10%

MITRE

KEV

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Statistics

1 Post

Last activity: 4 hours ago

Bluesky

ICS Advisory Project @advisoryics.bsky.social

ICS[AP] Dashboards are updated with the 4 CISA Advisories released on 1/27/26: iba Systems: 1 New Festo Didactic SE: 1 New | 1 KEV Match - CVE-2019-11043 Schneider Electric: 1 New Johnson Controls Inc.: 1 New www.icsadvisoryproject.com #icssecurity #otsecurity #vulnerabilitymanagement

0
0
0
4h ago

CVE-2025-33234

Overview

NVIDIA
NVIDIA runx

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

Pending

MITRE

KEV

Description

NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Statistics

1 Post

Last activity: 15 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2025-33234 - High (7.8)

NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33234/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
15h ago

CVE-2025-20393

Overview

Cisco
Cisco Secure Email

17 Dec 2025

Published

15 Jan 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

6.14%

MITRE

KEV

Description

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

Statistics

1 Post

Last activity: 23 hours ago

Fediverse

kaito834 @kaito834

第288回投げます。一石、！スペシャル！ - podcast - #セキュリティのアレ https://www.tsujileaks.com/?p=2172

2026年1月19日公開の #セキュリティのアレ
・生成AIによる音声からのなりすまし詐欺から始める、様々なコミュニケーション(電話/LINE/ChatWorkなど)におけるなりすまし手口
・Cisco Secure Email製品における脆弱性: CVE-2025-20393

お便りコーナーの「ログアウトする・しない」も興味深く聴きました

一つの手口ではなく類似の手口を複数並べることで共通項が見えてきて面白いです／コミュニケーションツールの使い方は場所によって様々だから、それぞれの中の人が「汎用的な手口を理解し、技術的に対策した上でその手口に気をつける」とよさそう。あと状況次第で誰でもなりすましに引っかかると思うから、「引っかからないこと」に注意を促すだけじゃなく、素早い事後対応も大事にしたい／LastPass, FerrariのCEOディープフェイクへの対策も勉強になる

0
0
0
23h ago

CVE-2025-40551

Overview

SolarWinds
Web Help Desk

28 Jan 2026

Published

28 Jan 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

Pending

MITRE

KEV

Description

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

Statistics

1 Post

Last activity: Last hour

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2025-40551 - Critical (9.8)

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without au...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40551/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
Last hour

CVE-2026-24398

Overview

honojs
hono

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

MEDIUM (4.8)

EPSS

Pending

MITRE

KEV

Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The `IPV4_REGEX` pattern and `convertIPv4ToBinary` function in `src/utils/ipaddr.ts` do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP addresses that bypass IP-based access controls. Version 4.11.7 contains a patch for the issue.

Statistics

1 Post

Last activity: 22 hours ago

Bluesky

Undercode Testing @undercode.bsky.social

How to Hack (and Secure) a HonoJS Server: The Critical IP Spoofing Flaw You Can’t Ignore (CVE-2026-24398) + Video Introduction: A recently disclosed vulnerability in the popular HonoJS web framework, CVE-2026-24398, exposes a critical weakness in its IP restriction middleware. This flaw allows…

0
0
0
22h ago

CVE-2026-24833

Overview

dnnsoftware
Dnn.Platform

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

HIGH (7.7)

EPSS

Pending

MITRE

KEV

Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module could install with richtext in its description field which could contain scripts that will run for user in the Persona Bar. Versions 9.13.10 and 10.2.0 contain a fix for the issue.

Statistics

1 Post

Last activity: 9 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-24833 - High (7.6)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module could install with richtext in its description field which could contain scripts that will...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
9h ago

CVE-2025-68670

Overview

neutrinolabs
xrdp

27 Jan 2026

Published

27 Jan 2026

Updated

CVSS v3.1

CRITICAL (9.1)

EPSS

Pending

MITRE

KEV

Description

xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.

Statistics

1 Post

Last activity: 17 hours ago

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2025-68670 - Critical (9.1)

xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-68670/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
17h ago