24h | 7d | 30d

CVE-2026-3055

Overview

  • NetScaler
  • ADC
23 Mar 2026
Published
31 Mar 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
87.17%
KEV

Description

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Statistics

  • 1 Post
Last activity: 17 hours ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Recordedfuture~ 73 high-impact CVEs were actively exploited; AI-assisted operations targeted enterprise systems. - IOCs: CVE-2026-3055, CVE-2026-39987, CVE-2026-33017 - #CVE #ThreatIntel #Vulnerability
  • 0
  • 0
  • 0
  • 17h ago

CVE-2026-77550

Overview

  • Ubiquiti Inc
  • UniFi OS Server
26 Aug 2026
Published
27 Aug 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
0.49%
KEV

Description

A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

Statistics

  • 1 Post
Last activity: 13 hours ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Arcticwolf~ Three unauthenticated UniFi flaws enable remote code execution or authentication bypass; patch immediately. - IOCs: CVE-2026-77537, CVE-2026-77550, CVE-2026-77554 - #CVE-2026-77537 #CVE-2026-77550 #ThreatIntel
  • 0
  • 0
  • 0
  • 13h ago

CVE-2026-77554

Overview

  • Ubiquiti Inc
  • UniFi Talk Application
26 Aug 2026
Published
26 Aug 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
0.99%
KEV

Description

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device.

Statistics

  • 1 Post
Last activity: 13 hours ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Arcticwolf~ Three unauthenticated UniFi flaws enable remote code execution or authentication bypass; patch immediately. - IOCs: CVE-2026-77537, CVE-2026-77550, CVE-2026-77554 - #CVE-2026-77537 #CVE-2026-77550 #ThreatIntel
  • 0
  • 0
  • 0
  • 13h ago

CVE-2025-21202

Overview

  • Microsoft
  • Windows 10 Version 1507
14 Jan 2025
Published
09 Jun 2026
Updated
CVSS v3.1
MEDIUM (6.1)
EPSS
0.88%
KEV

Description

Windows Recovery Environment Agent Elevation of Privilege Vulnerability

Statistics

  • 1 Post
  • 10 Interactions
Last activity: 17 hours ago

Fediverse

Profile picture fallback
Maxim Suhanov @errno_fail

I posted the slides from two talks here: dfir.ru/2026/09/09/two-confere

If you like BitLocker bypasses, here is my list: CVE-2024-43513 dubbed "bitlockpick", CVE-2025-21202 dubbed "bitlockpick 2", CVE-2026-20928 dubbed "cold boot attack without cold and boot", CVE-2025-21214 – a bug from the 90’s, CVE-2025-21215 – turning the Windows boot loader into the keylogger to capture the BitLocker’s PIN.

But the talk wasn't limited to those!

  • 5
  • 5
  • 0
  • 17h ago

CVE-2025-21214

Overview

  • Microsoft
  • Windows 10 Version 1507
14 Jan 2025
Published
09 Jun 2026
Updated
CVSS v3.1
MEDIUM (4.2)
EPSS
0.71%
KEV

Description

Windows BitLocker Information Disclosure Vulnerability

Statistics

  • 1 Post
  • 10 Interactions
Last activity: 17 hours ago

Fediverse

Profile picture fallback
Maxim Suhanov @errno_fail

I posted the slides from two talks here: dfir.ru/2026/09/09/two-confere

If you like BitLocker bypasses, here is my list: CVE-2024-43513 dubbed "bitlockpick", CVE-2025-21202 dubbed "bitlockpick 2", CVE-2026-20928 dubbed "cold boot attack without cold and boot", CVE-2025-21214 – a bug from the 90’s, CVE-2025-21215 – turning the Windows boot loader into the keylogger to capture the BitLocker’s PIN.

But the talk wasn't limited to those!

  • 5
  • 5
  • 0
  • 17h ago

CVE-2025-21215

Overview

  • Microsoft
  • Windows 10 Version 1507
14 Jan 2025
Published
09 Jun 2026
Updated
CVSS v3.1
MEDIUM (4.6)
EPSS
0.82%
KEV

Description

Secure Boot Security Feature Bypass Vulnerability

Statistics

  • 1 Post
  • 10 Interactions
Last activity: 17 hours ago

Fediverse

Profile picture fallback
Maxim Suhanov @errno_fail

I posted the slides from two talks here: dfir.ru/2026/09/09/two-confere

If you like BitLocker bypasses, here is my list: CVE-2024-43513 dubbed "bitlockpick", CVE-2025-21202 dubbed "bitlockpick 2", CVE-2026-20928 dubbed "cold boot attack without cold and boot", CVE-2025-21214 – a bug from the 90’s, CVE-2025-21215 – turning the Windows boot loader into the keylogger to capture the BitLocker’s PIN.

But the talk wasn't limited to those!

  • 5
  • 5
  • 0
  • 17h ago

CVE-2026-20928

Overview

  • Microsoft
  • Windows 10 Version 1607
14 Apr 2026
Published
14 Aug 2026
Updated
CVSS v3.1
MEDIUM (4.6)
EPSS
0.43%
KEV

Description

Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized attacker to bypass a security feature with a physical attack.

Statistics

  • 1 Post
  • 10 Interactions
Last activity: 17 hours ago

Fediverse

Profile picture fallback
Maxim Suhanov @errno_fail

I posted the slides from two talks here: dfir.ru/2026/09/09/two-confere

If you like BitLocker bypasses, here is my list: CVE-2024-43513 dubbed "bitlockpick", CVE-2025-21202 dubbed "bitlockpick 2", CVE-2026-20928 dubbed "cold boot attack without cold and boot", CVE-2025-21214 – a bug from the 90’s, CVE-2025-21215 – turning the Windows boot loader into the keylogger to capture the BitLocker’s PIN.

But the talk wasn't limited to those!

  • 5
  • 5
  • 0
  • 17h ago

CVE-2026-33671

Overview

  • micromatch
  • picomatch
26 Mar 2026
Published
27 Mar 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.40%
KEV

Description

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.

Statistics

  • 1 Post
Last activity: 1 hour ago

Fediverse

Profile picture fallback
CERT@VDE @certvde

🔄 CSAF advisory updated (version 2.0.0)

VDE-2026-088
METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4
CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671, CVE-2026-0915 (+60 more)

Changes: corrected version

HTML: certvde.com/en/advisories/VDE-
CSAF JSON: mettler-toledo.csaf-tp.certvde

  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-39821

Overview

  • Go standard library
  • net/http
  • net/http
22 May 2026
Published
09 Sep 2026
Updated
CVSS
Pending
EPSS
0.69%
KEV

Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Statistics

  • 1 Post
Last activity: 1 hour ago

Fediverse

Profile picture fallback
CERT@VDE @certvde

🔄 CSAF advisory updated (version 2.0.0)

VDE-2026-088
METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4
CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671, CVE-2026-0915 (+60 more)

Changes: corrected version

HTML: certvde.com/en/advisories/VDE-
CSAF JSON: mettler-toledo.csaf-tp.certvde

  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-4800

Overview

  • lodash
  • lodash
31 Mar 2026
Published
09 Sep 2026
Updated
CVSS v3.1
HIGH (8.1)
EPSS
2.76%
KEV

Description

Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function(). Patches: Users should upgrade to version 4.18.0. Workarounds: Do not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.

Statistics

  • 1 Post
Last activity: 1 hour ago

Fediverse

Profile picture fallback
CERT@VDE @certvde

🔄 CSAF advisory updated (version 2.0.0)

VDE-2026-088
METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4
CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671, CVE-2026-0915 (+60 more)

Changes: corrected version

HTML: certvde.com/en/advisories/VDE-
CSAF JSON: mettler-toledo.csaf-tp.certvde

  • 0
  • 0
  • 0
  • 1h ago
Showing 81 to 90 of 91 CVEs