As previously mentioned, via "Struts2 and Related Framework Array/Collection DoS" (26 October 2025), hundreds of JavaScript object notation (JSON) libraries are vulnerable to unconstrained resource consumption through large JSON arrays, which, when deserialised, create arbitrarily large collections/arrays/data structures. This work looks specifically at the Apache Struts2 JSON Plugin, using it
A vulnerability was identified in OWASP CRS where whitespace padding in filenames can bypass file upload extension checks, allowing uploads of dangerous files such as .php, .phar, .jsp, and .jspx. This issue has been assigned CVE‑2026‑33691. Impact: Attackers may evade CRS protections and upload web shells disguised with whitespace‑padded extensions. Exploitation is most practical on Windows back
[APOLOGIES FOR CROSS-POSTING] CALL FOR PAPERS 15th International Workshop on Cyber Crime (IWCC 2026 - https://www.ares-conference.eu/iwcc) to be held in conjunction with the International Conference on Availability, Reliability and Security (ARES 2026 - https://www.ares-conference.eu/) in Linköping, Sweden, August 24-27, 2026 IMPORTANT DATES Submission Deadline May 11, 2026 Author Notificati
SEC Consult Vulnerability Lab Security Advisory < 20260427-0 > ======================================================================= title: Missing TLS Certificate Validation leading to RCE product: DeskTime Time Tracking App vulnerable version: 1.3.671 fixed version: - CVE number: CVE-2025-10539 impact: medium homepage:https://de
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2026 Original source: https://malvuln.com/advisory/8c15ec5f0137d097a345b693f0bffedb.txt Malvuln Intelligence Feed: https://intel.malvuln.com/ Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Trojan-Spy.Win32.Small Vulnerability: Remote Command Execution Description: The malware opens a listener on TCP port 65535, allowing unau
Dear subscribers, we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. This advisory is also published at https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html --- Classification: TLP:GREEN Internal reference: DOV-7830 Type: CWE-1250 (Improper Preservation of Consis
Two memory safety vulnerabilities in libfuse's io_uring code path (introduced in 3.18.0) have been fixed in libfuse 3.18.2. Only the io_uring transport is affected; the traditional /dev/fuse path is not. Affected versions: libfuse >= 3.18.0, < 3.18.2 Fixed in: libfuse 3.18.2 https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2 CVE-2026-33150: Use-After-Free Severity: High (CVSS 7.8) CW
-------------------------------------------------------------------------- Blesta <= 5.13.1 (2Checkout) Multiple PHP Object Injection Vulnerabilities -------------------------------------------------------------------------- [-] Software Link: https://www.blesta.com [-] Affected Versions: All versions from 3.0.0 to 5.13.1. [-] Vulnerabilities Description: The vulnerabilities exist because
-------------------------------------------------------------------------------- Blesta <= 5.13.1 (Admin Interface) Multiple PHP Object Injection Vulnerabilities -------------------------------------------------------------------------------- [-] Software Link: https://www.blesta.com [-] Affected Versions: All versions from 3.0.0 to 5.13.1. [-] Vulnerabilities Description: The vulnerabili
--------------------------------------------------------------------------- Blesta <= 5.13.1 (confirm_url) Reflected Cross-Site Scripting Vulnerability --------------------------------------------------------------------------- [-] Software Link: https://www.blesta.com [-] Affected Versions: All versions from 3.2.0 to 5.13.1. [-] Vulnerability Description: User input passed through the "c
Summary ======= A vulnerability was discovered in the popular JavaScript library 'validator'. The isLength() function incorrectly handles Unicode Variation Selectors (U+FE0E and U+FE0F). An attacker can inject thousands of these zero-width characters into a string, causing the library to report a much smaller perceived length than the actual byte size. This leads to validation bypasses, potential
Hello Yuffie, Upon further investigation, the VulnCheck CNA determined that these vulnerabilities were not suitable for CVE assignment. The vulnerabilities exist within a SaaS product and are mitigated at the CSP-level which in this case, would be the vendor, EQS Group. Rather than contribute unactionable CVE records, the VulnCheck CNA used its discretionary prowess to move forward with rejecting
SEC Consult Vulnerability Lab Security Advisory < 20260218-0 > ======================================================================= title: Multiple Critical Vulnerabilities product: NesterSoft WorkTime (on-prem/cloud) vulnerable version: <= 11.8.8 fixed version: No patch available, vendor unresponsive. CVE number: CVE-2025-15563, CVE-2025-15562, CVE-2025-155
======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-001 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-001 ------------------------------------------------------------------------ Date: 2026-01-14 Risk Level:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-11-2026-2 iOS 15.8.7 and iPadOS 15.8.7 iOS 15.8.7 and iPadOS 15.8.7 addresses the following issues. Information about the security content is also available at https://support.apple.com/126632. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Ker
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-11-2026-1 iOS 16.7.15 and iPadOS 16.7.15 iOS 16.7.15 and iPadOS 16.7.15 addresses the following issues. Information about the security content is also available at https://support.apple.com/126646. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-02-11-2026-9 Safari 26.3 Safari 26.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/126354. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. CFNetwork Available for: macOS Sonoma
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-02-11-2026-8 visionOS 26.3 visionOS 26.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/126353. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. AppleMobileFileIntegrity Availabl
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-02-11-2026-7 watchOS 26.3 watchOS 26.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/126352. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Bluetooth Available for: Apple Watc
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-02-11-2026-6 tvOS 26.3 tvOS 26.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/126351. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Bluetooth Available for: Apple TV HD and
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-02-11-2026-5 macOS Sonoma 14.8.4 macOS Sonoma 14.8.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/126350. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. AppleMobileFileIntegr
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-02-11-2026-4 macOS Sequoia 15.7.4 macOS Sequoia 15.7.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/126349. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. AppleMobileFileInte
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-02-11-2026-3 macOS Tahoe 26.3 macOS Tahoe 26.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/126348. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Admin Framework Available f
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-02-11-2026-2 iOS 18.7.5 and iPadOS 18.7.5 iOS 18.7.5 and iPadOS 18.7.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/126347. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Acc
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-02-11-2026-1 iOS 26.3 and iPadOS 26.3 iOS 26.3 and iPadOS 26.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/126346. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibili
CyberDanube Security Research 20260119-0 ------------------------------------------------------------------------------- title| Authenticated Command Injection product| TC Router 5004T-5G EU vulnerable version| 1.06.18 fixed version| 1.06.23 CVE number| CVE-2025-41717 impact| High homepage| https://www.phoenixcontact.c
SEC Consult Vulnerability Lab Security Advisory < 20260224-0 > ======================================================================= title: Multiple vulnerabilities product: CPSD CryptoPro Secure Disk for BitLocker vulnerable version: 7.6.4.16432 (76212) fixed version: 7.6.6 / 7.7.1 CVE number: CVE-2025-10010 impact: high homepage
Dear Art, Thank you for sharing your detailed evaluation and for pointing out the relevant sections of the CNA Rules. Your argument is well reasoned, particularly with respect to the current guidance on SaaS and exclusively hosted services. I have forwarded your evaluation to the CNA for further consideration. It will also be important to understand the vendor’s perspective in light of
1. SUMMARY Two independently confirmed vulnerabilities in Jump Crypto's Firedancer Solana validator (https://github.com/firedancer-io/firedancer, commit 7cd3b6dce): A) Three undefined behavior / logic bugs in QUIC transport parameter processing, triggerable by a malicious QUIC server with zero authentication. Enables remote connection kill or hang. B) Incorrect Rust saturating cas
KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking Title: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking Advisory ID: KL-001-2026-001 Publication Date: 2026-01-08 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2026-001.txt 1. Vulnerability Details Affected Vendor: yintibao Affected Product: Fun Print Mobile
Hi @ll, the following is a condensed form of <https://skanthak.hier-im-netz.de/whispers.html#whisper3> and <https://skanthak.hier-im-netz.de/whispers.html#whisper4>. Windows Vista moved the shared start menu from "%ALLUSERSPROFILE%\Start Menu\" to "%ProgramData%\Microsoft\Windows\Start Menu\", with some shortcuts (*.lnk) "reflected" from the (immutable) component store below %SystemRoot%\WinSxS\
The Asterisk Development Team would like to announce security release Asterisk 23.2.2. The release artifacts are available for immediate download at https://github.com/asterisk/asterisk/releases/tag/23.2.2 and https://downloads.asterisk.org/pub/telephony/asterisk Repository: https://github.com/asterisk/asterisk Tag: 23.2.2 ## Change Log for Release asterisk-23.2.2 ### Links: - [Full Cha
The Asterisk Development Team would like to announce security release Asterisk 21.12.1. The release artifacts are available for immediate download at https://github.com/asterisk/asterisk/releases/tag/21.12.1 and https://downloads.asterisk.org/pub/telephony/asterisk Repository: https://github.com/asterisk/asterisk Tag: 21.12.1 ## Change Log for Release asterisk-21.12.1 ### Links: - [Full
The Asterisk Development Team would like to announce security release Asterisk 22.8.2. The release artifacts are available for immediate download at https://github.com/asterisk/asterisk/releases/tag/22.8.2 and https://downloads.asterisk.org/pub/telephony/asterisk Repository: https://github.com/asterisk/asterisk Tag: 22.8.2 ## Change Log for Release asterisk-22.8.2 ### Links: - [Full Cha
The Asterisk Development Team would like to announce security release Asterisk 20.18.2. The release artifacts are available for immediate download at https://github.com/asterisk/asterisk/releases/tag/20.18.2 and https://downloads.asterisk.org/pub/telephony/asterisk Repository: https://github.com/asterisk/asterisk Tag: 20.18.2 ## Change Log for Release asterisk-20.18.2 ### Links: - [Full
The Asterisk Development Team would like to announce security release Certified Asterisk 20.7-cert9. The release artifacts are available for immediate download at https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert9 and https://downloads.asterisk.org/pub/telephony/certified-asterisk Repository: https://github.com/asterisk/asterisk Tag: certified-20.7-cert9 ## Change Log f
Advisory ID: SYSS-2025-014 Product: MX4200 (and potentially others) Manufacturer: Linksys Affected Version(s): 1.0.13.210200 (and potentially others) Tested Version(s): 1.0.13.210200 MX4200 Risk Level: Critical Solution Status: Fixed Manufacturer Notification: 2025-03-18 Solution Date: 2025-06-24 Publi
Advisory ID: SYSS-2025-011 Product: MR9600, MX4200 (and potentially others) Manufacturer: Linksys Tested Version(s): 1.0.4.205530 for MR9600, 1.0.13.210200 for MX4200 Vulnerability Type: OS Command Injection (CWE-78) Risk Level: High Solution Status: Open Manufacturer Notification: 2025-03-18 Solution Date:
Advisory ID: SYSS-2025-010 Product: MR9600, MX4200 (and potentially others) Manufacturer: Linksys Tested Version(s): 1.0.4.205530 for MR9600, 1.0.13.210200 for MX4200 Vulnerability Type: OS Command Injection (CWE-78) Risk Level: High Solution Status: Open Manufacturer Notification: 2025-03-18 Solution Date:
Advisory ID: SYSS-2025-009 Product: MR9600, MX4200 (and potentially others) Manufacturer: Linksys Tested Version(s): 1.0.4.205530 for MR9600, 1.0.13.210200 for MX4200 Vulnerability Type: SQL Injection (CWE-89) Risk Level: High Solution Status: Open Manufacturer Notification: 2025-03-18 Solution Date:
Advisory ID: SYSS-2025-002 Product: MR9600, MX4200 (and potentially others) Manufacturer: Linksys Tested Version(s): 1.0.4.205530 for MR9600, 1.0.13.210200 for MX4200 Risk Level: Medium Solution Status: Open Manufacturer Notification: 2025-03-18 Solution Date: - Public Disclosure: 2026-02-12 CVE Ref
Advisory ID: SYSS-2025-001 Product: MR9600, MX4200 (and potentially others) Manufacturer: Linksys Tested Version(s): 1.0.4.205530 for MR9600, 1.0.13.210200 for MX4200 Vulnerability Type: Path Traversal (CWE-22) Risk Level: Medium Solution Status: Open Manufacturer Notification: 2025-03-18 Solution Date:
SEC Consult Vulnerability Lab Security Advisory < 20260212-0 > ======================================================================= title: Multiple Vulnerabilities product: Various Solax Power Pocket WiFi models vulnerable version: See section below fixed version: See section below CVE number: CVE-2025-15573, CVE-2025-15574, CVE-2025-15575
Hi, the vulnerabilities are no longer considered eligible for CVE tracking, despite being real, independently discovered, responsibly disclosed, and acknowledged by the vendor. CVE IDs *can* be assigned for SaaS or similarly "cloud only" software. For a period of time, there was a restriction that only the provider could make or request such an assignment. But the current CVE rules remove thi
🔓 The Attack Path — No Login, SYSTEM Access 1. Boot into setup.exe (via USB, PXE, or OOBM like Intel vPro). 2. Click “Repair your computer” → Enter WinRE. 3. Press Shift + F10 → SYSTEM-level Command Prompt. 4. From there, attacker can: - Run `net user` to create new admin accounts - Use `diskpart` to wipe or reformat drives - Use `manage-bde -off` or `bcdedit` to disable BitLocker - R
UPDATE: Following the publication of these vulnerabilities and the subsequent CVE assignments, the CVE identifiers have now been revoked. The vendor (EQS Group) contacted the CVE Program (via a CNA) and disputed the records, stating that the affected product is an exclusively hosted SaaS platform with no customer-managed deployment or versioning. Based on this argument, the CVE Program con
# Exploit Title: Elgg - Username Enumeration # Date: 1/2026 # Exploit Author: Andrey Stoykov # Version: 6.3.3 # Tested on: Ubuntu 22.04 # Blog: https://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-47-lack-of.html // HTTP Request - Resetting Password - Valid User POST /action/user/requestnewpassword HTTP/1.1 Host: elgg.local User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:14
# Exploit Title: Elgg - Lack of Password Complexity # Date: 1/2026 # Exploit Author: Andrey Stoykov # Version: 6.3.3 # Tested on: Ubuntu 22.04 # Blog: https://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-48-weak.html // HTTP Request - Changing Password POST /action/usersettings/save HTTP/1.1 Host: elgg.local User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100
SEC Consult Vulnerability Lab Security Advisory < 20260126-2 > ======================================================================= title: UART Leaking Sensitive Data product: dormakaba registration unit 9002 (PIN pad) vulnerable version: <SW0039 fixed version: SW0039 CVE number: CVE-2025-59109 impact: medium homepage:https://www
SEC Consult Vulnerability Lab Security Advisory < 20260126-1 > ======================================================================= title: Multiple Critical Vulnerabilities product: dormakaba Access Manager vulnerable version: Multiple firmware and hardware revisions (details below) fixed version: Multiple firmware and hardware revisions (details below)