MECCHA CHAMELEON can't hide from the RCE
We found a second delayed RCE in MECCHA CHAMELEON: a malicious custom map could write files anywhere on your system and run code after a restart. Now patched in 4.0.0. Category: Vulnerabilities & Threats
Výsledky hledání
Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
· zachyceno
SPOJENO PŘES CVE SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities 10
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.0: 10.0, CVEs: CVE-2026-83548, CVE-2026-83549, Summary: 1) CVE-2026-83548 - Pre-authentication SSRF via unintended forward-proxy A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform…
KEV ✓ EPSS 0.10 CVSS 10.0 CVE-2026-83548 CVE-2026-83549 SonicWall FI US CA IT AT FR
· zachyceno
Google Chrome Stable Channel Update for Desktop
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-84353, CVE-2026-84352, CVE-2026-84354, CVE-2026-84359, CVE-2026-84357, CVE-2026-84324, CVE-2026-84349, CVE-2026-84326, CVE-2026-84333, CVE-2026-84351, CVE-2026-84325, CVE-2026-84328, CVE-2026-84347, CVE-2026-84323, CVE-2026-84355, CVE-2026-84358, CVE-2026-84332, CVE-2026-84330, CVE-2026-84334, CVE-2026-84348 (+6 other associated CVEs), Summary: The Stable channel has been updated to…
Google FI
· zachyceno
Haavoittuvuuksia Rockwell Automation -tuotteissa
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.0: 8.6, CVEs: CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625, CVE-2026-9633, CVE-2026-9634, CVE-2026-9637, CVE-2026-16675, Summary: Rockwell Automation FactoryTalk Activation Manager Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the affected product. The following versions of Rockwell Automation RSLinx Classic are affected: RSLinx…
EPSS < 0.01 CVSS 8.6 CVE-2026-16675 CVE-2026-9621 CVE-2026-9622 CVE-2026-9624 CVE-2026-9625 CVE-2026-9633 CVE-2026-9634 CVE-2026-9637 Rockwell Automation FI
· zachyceno
Hugging Face Transformers library writes remote code to disk prior to consent check
Classification: Critical, Solution: Unavailable, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-80047, Summary: A vulnerability in the Hugging Face Transformers library (versions 4.49.0 through 5.8.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the trust_remote_code consent prompt, violating the security contract enforced across other…
EPSS < 0.01 CVE-2026-80047 Hugging Face FI
· zachyceno
Multiple vulnerabilities in SOY series
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-73827, CVE-2026-77838, CVE-2026-78238, CVE-2026-78032, Summary: SOY series provided by Tsuyoshi Saito contain multiple vulnerabilities listed below. Cross-site Scripting (CWE-79) - CVE-2026-73827, CVE-2026-77838, CVE-2026-78238 Deserialization of Untrusted Data (CWE-502) - CVE-2026-78032 An arbitrary script may be executed on the web browser of the user who is logging in to the product…
EPSS 0.01 CVSS 9.8 CVE-2026-73827 CVE-2026-77838 CVE-2026-78032 CVE-2026-78238 Tsuyoshi Saito FI
· zachyceno
SPOJENO PŘES CVE Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 5.9, CVEs: CVE-2026-20354, CVE-2026-20355, Summary: Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these…
EPSS < 0.01 CVSS 5.9 CVE-2026-20354 CVE-2026-20355 Cisco FI US
· zachyceno
SPOJENO PŘES CVE Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5, CVEs: CVE-2026-20281, Summary: A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management when an affected…
EPSS 0.01 CVSS 7.5 CVE-2026-20281 Cisco FI US
· zachyceno
SPOJENO PŘES CVE Cisco IOS XR Software Security Hardening Release: September 2026
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-20274, CVE-2026-20275, CVE-2026-20276, CVE-2026-20277, CVE-2026-20278, CVE-2026-20279, CVE-2026-20280, Summary: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered…
EPSS 0.01 CVSS 9.8 CVE-2026-20274 CVE-2026-20275 CVE-2026-20276 CVE-2026-20277 CVE-2026-20278 CVE-2026-20279 CVE-2026-20280 Cisco FI US
· zachyceno
SPOJENO PŘES CVE Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-20212, Summary: A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to…
EPSS 0.01 CVSS 9.8 CVE-2026-20212 Cisco FI US
· zachyceno
Multiples vulnérabilités dans les produits F5 (03 septembre 2026)
De multiples vulnérabilités ont été découvertes dans les produits F5. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
EPSS 0.01 CVE-2026-18329 CVE-2026-33278 CVE-2026-42959 CVE-2026-63020 CVE-2026-66362 CVE-2026-66842 CVE-2026-77180 CVE-2026-78222 CVE-2026-78689 F5 FR
· zachyceno
Multiples vulnérabilités dans SPIP (03 septembre 2026)
De multiples vulnérabilités ont été découvertes dans SPIP. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une élévation de privilèges.
SPIP FR
SPOJENO PŘES CVE Hackers exploit Sangoma Switchvox flaw to deploy reverse shells
Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. [...]
KEV ✓ EPSS 0.19 CVE-2026-9586 Sangoma telekomunikace US
WordPress backup plugin flaw exposes millions of sites to takeover attacks
An SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress could allow unauthenticated attackers to execute remote code and take control of affected websites. [...]
CVE-2026-19949 * WordPress All-in-One WP Migration and Backup US
Progress Software security advisory (AV26-875)
Serial number: AV26-875Date: September 2, 2026 As of September 2, 2026, Progress Software is affected by vulnerabilities in the following product: Telerik UI for ASP.NET AJAX Prior to 2026.3.812 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Telerik Web Forms RadImageEditor Path Traversal Vulnerability (CVE-2026-18672) Telerik Web Forms DialogHandler UploadPaths Tampering Vulnerability (CVE-2026…
EPSS 0.01 CVE-2026-18672 CVE-2026-19219 Progress Software CA
Google security advisory (AV26-874)
Serial number: AV26-874Date: September 2, 2026 As of September 2, 2026, Google is affected by vulnerabilities in the following product: Chrome Prior to 152.0.7977.75 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Stable Channel Update for Desktop
Google CA
Risolte vulnerabilità in prodotti HPE Aruba Networking
Rilasciati aggiornamenti di sicurezza per risolvere 86 vulnerabilità, di cui 6 con gravità "critica" e 46 con gravità "alta", che interessano i prodotti HPE Aruba Networking AOS-CX e Fabric Composer.
HPE IT
ALERTĂ: Multiple vulnerabilități critice la nivelul Ubiquiti UniFi
CONTEXT La sfârșitul lunii august 2026, Ubiquiti a publicat Security Advisory Bulletin 067, ...
Ubiquiti RO
HPE security advisory (AV26-873)
Serial number: AV26-873Date: September 2, 2026 As of September 1, 2026, Hewlett Packard Enterprise (HPE) is affected by vulnerabilities in the following products: HPE Networking AOS-CX Prior to or equal to 10.10.1180 Prior to or equal to 10.13.1180 Prior to or equal to 10.16.1051 Prior to or equal to 10.17.1021 Prior to or equal to 10.18.0001 HPE Networking Fabric Composer Prior to or equal to 7.3.3 The Cyber Centre encourages users and administrators to review the provided web links and apply…
HPE CA
Risolte vulnerabilità in prodotti Elastic
Aggiornamenti di sicurezza Elastic sanano 4 vulnerabilità con gravità "alta" presenti nei prodotti Elasticsearch, Kibana e Winlogbeat.
EPSS 0.01 CVE-2024-14047 CVE-2026-63137 CVE-2026-72649 CVE-2026-78592 Elastic IT
Risolte vulnerabilità in prodotti Zohocorp ManageEngine
Aggiornamenti di sicurezza Zohocorp sanano una vulnerabilità con gravità "alta" presente nei prodotti ManageEngine Password Manager Pro, PAM360 e Access Manager Plus. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato autenticato di eludere i meccanismi di sicurezza sui sistemi interessati.
EPSS 0.03 CVE-2026-14828 Zoho IT
[Control systems] Schneider Electric security advisory (AV26-871)
Serial Number: AV26-871Date: September 2, 2026 As of September 1, 2026, Schneider Electric is affected by vulnerabilities in the following products: NetBotz 5 - 750/755 Versions prior to or equal to 5.5.2 PowerChute Serial Shutdown Versions prior to or equal to 1.5 The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested mitigations and apply the necessary updates. Multiple Vulnerabilities on NetBotz 5 - 750/755 Products Improper Restriction…
iba: Deserialization vulnerability in ibaPDA and ibaDatCoordinator
[VDE-2026-051] A vulnerability has been identified in ibaPDA, ibaDatCoordinator and ibaLogic. The affected applications do not properly restrict the .NET BinaryFormatter when deserializing client-server input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected applications. This is the same issue that exists for the .NET BinaryFormatter: https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300.
EPSS 0.01 CVE-2026-8024 iba DE
· zachyceno
CISA Adds Seven Known Exploited Vulnerabilities to Catalog
CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability CVE-2026-49869 Kestra OSS OS Command Injection Vulnerability CVE-2026-59822 BerriAI LiteLLM Improper Authentication Vulnerability CVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability CVE-2026-83548…
KEV ✓ EPSS 0.70 CVE-2026-48710 CVE-2026-49869 CVE-2026-59822 CVE-2026-82329 CVE-2026-83548 CVE-2026-83549 CVE-2026-9586 Sangoma JFrog SonicWall BerriAI veřejná správa US
SPOJENO PŘES CVE Závažná zranitelnost ohrožuje téměř 22 000 Microsoft Exchange serverů
Microsoft 11. srpna 2026 vydal opravu zranitelnosti CVE-2026-62911 (CVSS 8,0), přesto téměř 22 000 veřejně dostupných Exchange serverů zůstává zranitelných. V Česku Shadowserver eviduje přibližně 300 unikátních IP adres Exchange serverů, které vyhodnocuje jako zranitelné (na jednu či více zranitelností). Zranitelnost postihuje Exchange Server 2016, 2019 a Subscription Edition a může vést až k převzetí uživatelských e-mailových schránek. Exploit je již veřejně dostupný. Verze 2016 a 2019 jsou…
EPSS 0.01 CVSS 8.8 CVE-2026-62911 Microsoft finance veřejná správa CZ NL US
Two critical Chrome flaws put users at risk on malicious websites
Chrome is rolling out an update for its desktop browser. The update includes 26 security fixes, two of which Google rates as critical use-after-free vulnerabilities. The Stable channel has been updated to 152.0.7977.75/.76 for Windows and Mac, and 152.0.7977.75 for Linux. How to update Chrome If you don’t want to wait for the rollout to reach you, manually updating is easy. The easiest option is to allow Chrome to update automatically. But you can end up lagging behind if you never close your…
EPSS < 0.01 CVE-2026-84352 CVE-2026-84353 Google US
Rilevate vulnerabilità in Erlang/OTP
Rilevate molteplici vulnerabilità di sicurezza, di cui 11 con gravità "alta", in diversi componenti di Erlang/OTP, piattaforma open source basata sul linguaggio Erlang e sul relativo set di librerie OTP, utilizzata per lo sviluppo di sistemi distribuiti ad alta disponibilità.
EPSS 0.01 CVE-2026-55951 CVE-2026-66357 CVE-2026-66835 CVE-2026-69664 CVE-2026-70399 CVE-2026-71380 CVE-2026-73270 CVE-2026-73276 CVE-2026-73812 CVE-2026-74835 CVE-2026-75538 Erlang IT
NCSC-2026-0337 [1.00] [H/H] Zero-Day kwetsbaarheden verholpen in SMA1000 Appliance van SonicWall
SonicWall heeft kwetsbaarheden verholpen in de SMA1000 Appliance. De SMA1000 Appliance bevat twee kwetsbaarheden. De eerste is een pre-authenticatie Server-Side Request Forgery (SSRF) in de Work Place interface, waarmee een externe, niet-geauthenticeerde aanvaller ongeautoriseerde acties kan uitvoeren. De tweede kwetsbaarheid betreft post-authenticatie remote code execution, waarbij een aanvaller met geldige inloggegevens willekeurige code op afstand kan uitvoeren. Beide kwetsbaarheden zijn als…
SonicWall NL
Aggiornamenti di sicurezza Dell Technologies
Dell Technologies ha rilasciato aggiornamenti di sicurezza per risolvere 17 vulnerabilità, di cui 3 con gravità "critica" e 13 con gravità "alta", presenti in Dell PowerStore.
EPSS 0.01 CVE-2026-58566 CVE-2026-58567 CVE-2026-58569 CVE-2026-58571 CVE-2026-58572 CVE-2026-58574 CVE-2026-58575 CVE-2026-67262 CVE-2026-67271 CVE-2026-70415 CVE-2026-76111 CVE-2026-79682 CVE-2026-79683 CVE-2026-79684 CVE-2026-79686 CVE-2026-79687 Dell Technologies IT
Risolte vulnerabilità su GitHub Enterprise Server
Rilasciati aggiornamenti di sicurezza che risolvono 4 nuove vulnerabilità, di cui 3 con gravità “alta”, in GitHub Enterprise Server.
EPSS 0.01 CVE-2026-18730 CVE-2026-19118 CVE-2026-76851 GitHub IT
NCSC-2026-0336 [1.00] [M/H] Kwetsbaarheid verholpen in JFrog Artifactory
JFrog heeft een kwetsbaarheid verholpen in JFrog Artifactory. De kwetsbaarheid bevindt zich in de standaardconfiguratie van JFrog Artifactory, waarbij onvoldoende authenticatiecontroles aanwezig zijn. Hierdoor kan een niet-geauthenticeerde aanvaller met netwerktoegang de privileges escaleren naar administratief niveau. Dit kan leiden tot volledige administratieve controle over het systeem.
JFrog NL
Risolte vulnerabilità in Google Chrome
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 26 nuove vulnerabilità di sicurezza, di cui 2 con gravità “critica” e 9 con gravità “alta”.
EPSS < 0.01 CVE-2026-84324 CVE-2026-84325 CVE-2026-84326 CVE-2026-84333 CVE-2026-84349 CVE-2026-84351 CVE-2026-84352 CVE-2026-84353 CVE-2026-84354 CVE-2026-84357 CVE-2026-84359 Google IT
Vulnerabilità in prodotti Rockwell Automation
Rilevate nuove vulnerabilità di cui cinque con gravità “alta” in vari prodotti Rockwell Automation.
EPSS < 0.01 CVE-2025-12768 CVE-2026-12661 CVE-2026-16675 CVE-2026-9633 CVE-2026-9634 CVE-2026-9637 Rockwell Automation IT
Risolte vulnerabilità in prodotti Mozilla
Aggiornamenti di sicurezza sanano 11 vulnerabilità di sicurezza, di cui 3 con gravità “critica” e 8 con gravità “alta”, nei prodotti Firefox, Firefox ESR, Thunderbird.
EPSS < 0.01 CVE-2026-16365 CVE-2026-75874 CVE-2026-84117 CVE-2026-84119 CVE-2026-84121 CVE-2026-84123 CVE-2026-84143 CVE-2026-84144 CVE-2026-84145 CVE-2026-84639 CVE-2026-84640 Mozilla IT
SonicWall warns of actively exploited SMA1000 zero-day flaws
SonicWall warned customers that threat actors are chaining two new SMA1000 zero-day vulnerabilities in remote code execution attacks. [...]
CVE-2025-40602 * CVE-2026-15409 * CVE-2026-15410 * CVE-2026-83548 * CVE-2026-83549 * SonicWall US
· zachyceno
SonicWall SMA1000 Appliances OS Command Injection Vulnerability (CVE-2026-83549)
CISA added CVE-2026-83549 to the Known Exploited Vulnerabilities catalog. Affected product: SonicWall SMA1000 Appliances. Remediation due date: 2026-09-05.
KEV ✓ EPSS 0.10 CVE-2026-83549 SonicWall US
· zachyceno
SPOJENO PŘES CVE SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability (CVE-2026-83548)
CISA added CVE-2026-83548 to the Known Exploited Vulnerabilities catalog. Affected product: SonicWall SMA1000 Appliances. Remediation due date: 2026-09-05.
KEV ✓ EPSS 0.08 CVE-2026-83548 SonicWall US FR
· zachyceno
Kestra OSS OS Command Injection Vulnerability (CVE-2026-49869)
CISA added CVE-2026-49869 to the Known Exploited Vulnerabilities catalog. Affected product: Kestra Kestra OSS. Remediation due date: 2026-09-05.
KEV ✓ EPSS 0.02 CVE-2026-49869 Kestra US
· zachyceno
Kludex Starlette HTTP Request/Response Smuggling Vulnerability (CVE-2026-48710)
CISA added CVE-2026-48710 to the Known Exploited Vulnerabilities catalog. Affected product: Kludex Starlette. Remediation due date: 2026-09-16.
KEV ✓ EPSS 0.70 CVE-2026-48710 Kludex US
· zachyceno
SonicWall 83548 83549
Categories: Threat ResearchTags: advisory, vulnerability, SonicWall
SonicWall GB
· zachyceno
Multiples vulnérabilités dans Curl (02 septembre 2026)
De multiples vulnérabilités ont été découvertes dans Curl. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et un contournement de la politique de sécurité.
EPSS 0.01 CVE-2026-13608 CVE-2026-18924 CVE-2026-19931 CVE-2026-80229 CVE-2026-80230 CVE-2026-80231 CVE-2026-80255 CVE-2026-82208 CVE-2026-82209 curl FR
· zachyceno
Multiples vulnérabilités dans les produits Elastic (02 septembre 2026)
De multiples vulnérabilités ont été découvertes dans les produits Elastic. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Elastic FR
· zachyceno
Multiples vulnérabilités dans les produits Mozilla (02 septembre 2026)
De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Mozilla FR
· zachyceno
Multiples vulnérabilités dans Google Chrome (02 septembre 2026)
De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
EPSS 0.01 a dalších 9 CVE-2026-84332 CVE-2026-84333 CVE-2026-84334 CVE-2026-84335 CVE-2026-84347 CVE-2026-84348 CVE-2026-84349 CVE-2026-84350 CVE-2026-84351 CVE-2026-84352 CVE-2026-84353 CVE-2026-84354 CVE-2026-84355 CVE-2026-84356 CVE-2026-84357 CVE-2026-84358 CVE-2026-84359 Google FR
· zachyceno
Multiples vulnérabilités dans les produits HPE Aruba Networking (02 septembre 2026)
De multiples vulnérabilités ont été découvertes dans les produits HPE Aruba Networking. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
HPE FR
Erlang security advisory (AV26-870)
Serial number: AV26-870Date: September 1, 2026 As of September 1, 2026, Erlang is affected by vulnerabilities in the following product: OTP - Multiple versions The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates. Erlang Security Advisories
Erlang CA
Rockwell Automation security advisory (AV26-869)
Serial number: AV26-869Date: September 1, 2026 As of September 1, 2026, Rockwell Automation is affected by vulnerabilities in the following products: 1756-ENBT Module All versions ArmorStart LT Prior to or equal to v2.001 CompactLogix 5380 / ControlLogix 5580 Prior to or equal to V33 V34.011 to V34.014 V35.011 to V35.013 V36.011 to V36.012 RSLinx Classic Prior to or equal to V4.50 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary…
Mozilla security advisory (AV26-868)
Serial number: AV26-868Date: September 1, 2026 As of September 1, 2026, Mozilla is affected by vulnerabilities in the following products: Firefox ESR Versions prior to 115.40 Versions prior to 140.15 Versions prior to 153.2 Firefox Versions prior to 155 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security Vulnerabilities fixed in Firefox ESR 115.40 — Mozilla Security Vulnerabilities fixed in…
Mozilla CA
Critical Langflow flaw exploited to steal OpenAI and AWS keys
Threat actors are exploiting an unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, an open-source framework for building AI applications, to steal credentials, tokens, and keys. [...]
EPSS 0.28 CVE-2026-0768 Langflow US
SPOJENO PŘES CVE WebPros security advisory (AV26-866)
Serial number: AV26-866Date: September 1, 2026 As of September 1, 2026, WebPros is affected by vulnerabilities in the following product: Plesk Prior to 18.0.79.9 Prior to 18.0.80.5 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. CVE-2026-67394: Vulnerability in Plesk allows privilege escalation to root
EPSS 0.01 CVE-2026-67394 WebPros Plesk CA IT
NCSC-2026-0335 [1.00] [M/H] Kwetsbaarheden verholpen in WatchGuard Fireware OS
WatchGuard heeft kwetsbaarheden verholpen in WatchGuard Fireware OS, specifiek in het iked-proces en de epm-service van het Mobile Security onderdeel. De kwetsbaarheden bevinden zich in het iked-proces en de epm-service van WatchGuard Fireware OS. Het iked-proces bevat een stack-based buffer overflow, een type confusion kwetsbaarheid en een heap overflow. Deze kwetsbaarheden kunnen worden misbruikt door een ongeauthenticeerde aanvaller door speciaal vervaardigd netwerkverkeer te verzenden. Dit…
WatchGuard NL
Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks
Nearly 22,000 Microsoft Exchange servers exposed online remain unpatched against a high-severity authentication bypass vulnerability that allows attackers to hijack all user mailboxes. [...]
Tenda: PoC pubblici per 3 nuove vulnerabilità
Disponibili Proof of Concept (PoC) per lo sfruttamento di 3 nuove vulnerabilità con gravità "critica", che interessano i router Tenda AC1206 e AC18.
EPSS 0.01 CVE-2026-82693 CVE-2026-82694 CVE-2026-82695 Tenda IT
· zachyceno
Rockwell Automation FactoryTalk Activation Manager
View CSAF Summary The following versions of Rockwell Automation FactoryTalk Activation Manager are affected: FactoryTalk Activation Manager V5.02_and_below (CVE-2026-16675) CVSS Vendor Equipment Vulnerabilities v3 7.8 Rockwell Automation Rockwell Automation FactoryTalk Activation Manager Improper Restriction of Excessive Authentication Attempts Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United States…
EPSS < 0.01 CVSS 7.8 CVE-2026-16675 Rockwell Automation výroba a průmysl US
· zachyceno
Rockwell Automation Redundancy Module Configuration Tool
View CSAF Summary Successful exploitation of these vulnerabilities could allow for an attacker to escalate and execute processes with administrator privileges. The following versions of Rockwell Automation Redundancy Module Configuration Tool are affected: Redundancy Module Configuration Tool 10.00.00 (CVE-2026-9633) Redundancy Module Configuration Tool >=9.00.00|<=10.00.00 (CVE-2026-9634) CVSS Vendor Equipment Vulnerabilities v3 7.3 Rockwell Automation Rockwell Automation Redundancy Module…
EPSS < 0.01 CVSS 7.3 CVE-2026-9633 CVE-2026-9634 Rockwell Automation výroba a průmysl US
· zachyceno
Rockwell Automation Logix Platform
View CSAF Summary The following versions of Rockwell Automation Logix Platform are affected: ControlLogix 5580 <=V33, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012 (CVE-2026-9637, CVE-2026-9637, CVE-2026-9637, CVE-2026-9637) CompactLogix 5380 <=V33, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012 (CVE-2026-9637, CVE-2026-9637, CVE-2026-9637, CVE-2026-9637) GuardLogix 5580 <=V33, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012 (CVE-2026-9637, CVE-2026-9637, CVE-2026-9637, CVE-2026-9637)…
EPSS < 0.01 CVSS 7.5 CVE-2026-9637 Rockwell Automation výroba a průmysl US
· zachyceno
Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix
View CSAF Summary The following versions of Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix are affected: ControlLogix 5580 <34.015, <35.014, <36.013, <37.011 (CVE-2021-42260, CVE-2021-42260, CVE-2021-42260, CVE-2021-42260) GuardLogix 5580 <34.015, <35.014, <36.013, <37.011 (CVE-2021-42260, CVE-2021-42260, CVE-2021-42260, CVE-2021-42260) CompactLogix 5380 <34.015, <35.014, <36.013, <37.011 (CVE-2021-42260, CVE-2021-42260, CVE-2021-42260, CVE…
EPSS 0.03 CVSS 7.5 CVE-2021-42260 Rockwell Automation výroba a průmysl US
· zachyceno
Rockwell Automation Historian ME
View CSAF Summary Successful exploitation of these vulnerabilities could crash the device being accessed; an out-of-bounds write condition may allow remote code execution. The following versions of Rockwell Automation Historian ME are affected: Series B 5.202 (CVE-2025-12768, CVE-2026-12661) Series C 7.101 (CVE-2025-12768, CVE-2026-12661) CVSS Vendor Equipment Vulnerabilities v3 8 Rockwell Automation Rockwell Automation Historian ME Out-of-bounds Write, Stack-based Buffer Overflow Background…
EPSS < 0.01 CVSS 8.0 CVE-2025-12768 CVE-2026-12661 Rockwell Automation výroba a průmysl zdravotnictví vodárenství US
· zachyceno
Rockwell Automation RSLinx Classic
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the affected product. The following versions of Rockwell Automation RSLinx Classic are affected: RSLinx Classic <=4.50 (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625) CVSS Vendor Equipment Vulnerabilities v3 8.6 Rockwell Automation Rockwell Automation RSLinx Classic Integer Overflow or Wraparound, Integer Underflow (Wrap or Wraparound), Buffer Copy…
EPSS < 0.01 CVSS 8.6 CVE-2026-9621 CVE-2026-9622 CVE-2026-9624 CVE-2026-9625 Rockwell Automation výroba a průmysl US
Infostealers are hijacking Claude accounts at users’ expense
Anthropic has warned some Claude users that criminals are using information stealers to take over their accounts. Rather than guessing passwords or intercepting two-factor authentication (2FA) codes, the attackers steal the browser sessions that prove a user is already logged in. According to a warning email shared publicly by an affected user, the attackers used common infostealer malware to copy Claude login sessions from victims’ computers. They then used those sessions to access the…
Anthropic US