24h | 7d | 30d

CVE-2026-118773

Overview

  • isaacs
  • node-glob
29 Oct 2026
Published
30 Oct 2026
Updated
CVSS v4.0
MEDIUM (6.3)
EPSS
0.35%
KEV

Description

Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.

Statistics

  • 1 Post
Last activity: 21 hours ago

Bluesky

Profile picture fallback
Lambda Watchdog @lambdawatchdog.bsky.social
🚨 New MEDIUM CVE detected in AWS Lambda 🚨 CVE-2026-118773 impacts glob in 4 Lambda base images. Details: https://github.com/aws/aws-lambda-base-images/issues/789 More: https://lambdawatchdog.com/ #AWS #Lambda #CVE #CloudSecurity #Serverless
  • 0
  • 0
  • 0
  • 21h ago

CVE-2026-102764

Overview

  • BeyondTrust
  • Remote Support
15 Oct 2026
Published
17 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
18.95%
KEV

Description

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

Statistics

  • 1 Post
Last activity: 14 hours ago

Bluesky

Profile picture fallback
Cybersecurity News Everyday @hendryadrian.bsky.social
Rapid7 demonstrated CVE-2026-102764 in Remote Support 24.1.2: an anonymous customer session could forge a local MRS router ID, upload a PHP file, and execute code as msfuser. Other affected releases and fixed builds remain undetermined.
  • 0
  • 0
  • 0
  • 14h ago

CVE-2026-112445

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
Last activity: 23 hours ago

Bluesky

Profile picture fallback
r/blueteamsec bot @r-blueteamsec.bsky.social
CVE-2026-112445: CVE-2026-112445: The Simplest macOS Local Privilege Escalation to Date
  • 0
  • 0
  • 0
  • 23h ago

CVE-2026-14844

Overview

  • Unknown
  • Master Slider
20 Sep 2026
Published
20 Sep 2026
Updated
CVSS
Pending
EPSS
0.43%
KEV

Description

The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed. No fixed version is available. Until one ships, restrict the Contributor role to trusted users, or deactivate the Master Slider WordPress plugin through 3.11.2. Site owners who need to keep it active can block the ms_slider shortcode for roles below Editor, for example with a shortcode-restriction Master Slider WordPress plugin through 3.11.2, which prevents the attack without removing the Master Slider WordPress plugin through 3.11.2.

Statistics

  • 1 Post
Last activity: 21 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-14844: Stored XSS in Master Slider WordPress plugin (through 3.11.2), CVSS 6.8. Contributor-level users can inject scripts that fire when posts are viewed. No patch yet, so restrict Contributor access or disable the plugin. valtersit.com/cve/CVE-2026-148

  • 0
  • 0
  • 0
  • 21h ago

CVE-2026-94113

Overview

  • Frappe
  • ERPNext
20 Sep 2026
Published
21 Sep 2026
Updated
CVSS v4.0
HIGH (7.1)
EPSS
0.42%
KEV

Description

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-94113: Frappe ERPNext leaks billable timesheet data (project names, billing amounts, work logs) to any authenticated user via unpermitted endpoints. CVSS 6.5. Fix in 15.121.0 and 16.34.0, patch under review - upgrade now. #CVE #infosec #ERPNext valtersit.com/cve/CVE-2026-941

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-120192

Overview

  • Presenton
01 Nov 2026
Published
01 Nov 2026
Updated
CVSS v4.0
MEDIUM (6.9)
EPSS
Pending
KEV

Description

A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is able to mitigate this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. The affected component should be upgraded.

Statistics

  • 1 Post
Last activity: 6 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-120192: MEDIUM severity info disclosure in Presenton ≤0.9.11-beta. Remote, unauthenticated exploitation via /app_data — public exploit code exists. Patch: upgrade to 0.9.12-beta. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 6h ago

CVE-2026-94003

Overview

  • Comfast
  • CF-N1-S
20 Sep 2026
Published
24 Sep 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
0.61%
KEV

Description

A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Statistics

  • 1 Post
Last activity: 11 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-94003: stack buffer overflow in Comfast CF-N1-S web interface, remote, public exploit, CVSS 10, unpatched. Restrict access now. #CVE #infosec #cybersecurity valtersit.com/cve/CVE-2026-940

  • 0
  • 0
  • 0
  • 11h ago

CVE-2026-120201

Overview

  • dromara
  • Jpom
31 Oct 2026
Published
31 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
Pending
KEV

Description

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.

Statistics

  • 1 Post
Last activity: 11 hours ago

Fediverse

Profile picture fallback
Kyle Reddoch (CybersecKyle) @cyberseckyle

VulnCheck: Jpom 2.10.0–2.11.12 (CVE-2026-120201) mishandles JPOM-USER-TOKEN, allowing unauthenticated admin access and command execution via scripts.

No confirmed in-the-wild exploitation or fixed release in checked sources. Admins: inventory deployments, restrict management access and monitor vendor updates.

vulncheck.com/advisories/jpom-

  • 0
  • 0
  • 0
  • 11h ago

CVE-2026-118527

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 17 hours ago

Fediverse

Profile picture fallback
Dark Web Informer :verified_paw: @DarkWebInformer

🚨 Attackers chain three Ivanti Connect Secure flaws for unauthenticated root access

A previously unknown threat actor tracked as UTA0576 exploited three vulnerabilities to compromise fully patched Ivanti Connect Secure VPN appliances and execute commands as root without authentication.
⠀
• CVE-2026-104935: Authentication bypass and RCE - CVSS 8.6
• CVE-2026-111357: Privilege escalation - CVSS 8.8
• CVE-2026-118527: Predictable identifier allowing controlled file uploads - CVSS 4.3
• Affected: ICS 25.1.1.2 and earlier, and 22.8R2.5 and earlier
• Fixed: ICS 25.1.1.3 and 22.8R2.6
⠀
The actor extracted VPN and Active Directory credentials, searched for LAPS passwords and BitLocker recovery keys, conducted password spraying and deleted evidence from system logs.

CISA has added all three vulnerabilities to its Known Exploited Vulnerabilities catalog.

Source: volexity.com/blog/2026/10/13/a

  • 0
  • 1
  • 0
  • 17h ago

CVE-2026-111357

Overview

  • Ivanti
  • Connect Secure
15 Oct 2026
Published
31 Oct 2026
Updated
CVSS v3.1
HIGH (7.0)
EPSS
0.53%
KEV

Description

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 17 hours ago

Fediverse

Profile picture fallback
Dark Web Informer :verified_paw: @DarkWebInformer

🚨 Attackers chain three Ivanti Connect Secure flaws for unauthenticated root access

A previously unknown threat actor tracked as UTA0576 exploited three vulnerabilities to compromise fully patched Ivanti Connect Secure VPN appliances and execute commands as root without authentication.
⠀
• CVE-2026-104935: Authentication bypass and RCE - CVSS 8.6
• CVE-2026-111357: Privilege escalation - CVSS 8.8
• CVE-2026-118527: Predictable identifier allowing controlled file uploads - CVSS 4.3
• Affected: ICS 25.1.1.2 and earlier, and 22.8R2.5 and earlier
• Fixed: ICS 25.1.1.3 and 22.8R2.6
⠀
The actor extracted VPN and Active Directory credentials, searched for LAPS passwords and BitLocker recovery keys, conducted password spraying and deleted evidence from system logs.

CISA has added all three vulnerabilities to its Known Exploited Vulnerabilities catalog.

Source: volexity.com/blog/2026/10/13/a

  • 0
  • 1
  • 0
  • 17h ago
Showing 41 to 50 of 51 CVEs