Tag
#security
SAP NetWeaver ICM2SHELL: Pre-Auth RCE (CVE-2026-76964)
SAP NetWeaver ICM2SHELL enables pre-auth RCE in ICM and Web Dispatcher. Check fixed kernel levels, the 7.93 exception, and gateway and SAML2 patches.
Nov 14, 2026
Seafile SeaDoc RCE via Public Share Link (CVE-2026-129167)
An anonymous SeaDoc share token reaches every converter endpoint, and a path traversal plants a P...
Nov 14, 2026
Dropbear SSH Restriction Bypass Reaches Root Sockets
A Dropbear key restricted to one TCP destination can still open unix sockets, including docker.so...
Nov 14, 2026
UnrealIRCd Command Injection, Exploited in the Wild (CVE-2026-114713)
A label tag escaping flaw lets an UnrealIRCd user run server commands on linked networks; fixed i...
Nov 14, 2026
More tagged #security
Listmonk 2FA Bypass, Fixed Only in 7.0 Beta (CVE-2026-128332)
listmonk 6.0.0 through 6.2.0 lets an attacker with a password bypass TOTP 2FA; the only fixed release is 7.0.0-beta.2.
Nov 13, 2026
SignDrop: Windows CLFS Privilege Escalation to SYSTEM
A public Windows CLFS proof of concept turns logfile authentication into SYSTEM privileges on patched Windows 11 and Server 2025, with no fix yet.
Nov 13, 2026
MongoDB Replica Set UAF: Unauthenticated Crash (CVE-2026-118383)
Unauthenticated requests can crash a lagging MongoDB replica set primary before 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16 and 9.0.7.
Nov 13, 2026
Building a Security Software Factory at Ostorlab
Ostorlab's security factory pairs detection engines with agent maintainers to reduce false positives, expand coverage, and protect scarce human attention.
Nov 13, 2026
WFX Phantom: GitHub Actions Secret Stealer Campaign
A campaign using stolen GitHub tokens pushed the wfx stealer into thousands of repositories, harvesting CI secrets and cloud credentials since November 10.
Nov 12, 2026
Portabase Master Key Overwrite, Fixed in 1.21.2 (CVE-2026-67449)
An unauthenticated path traversal in Portabase's TUS webhook overwrites the AES-256 master key that protects encrypted backups; fixed in 1.21.2.
Nov 12, 2026
Apache HTTP Server HTTP/2 RCE, Fixed in 2.4.71 (CVE-2026-119618)
A thread-safety flaw in Apache HTTP Server's mod_http2 lets an unauthenticated HTTP/2 client corrupt memory and possibly run code; fixed in 2.4.71.
Nov 12, 2026
79% vs 51%: Independent Neobanks Lag on App Security
Independent neobanks trail traditional banks by 28.1 percentage points on serious app security findings, despite leading on passkeys and attestation. Our study of 2,686 apps explains the gap.
Nov 12, 2026
Red Hat Quay Registry Takeover via Key Rotation (CVE-2026-123710)
Red Hat Quay before the fixed branch builds lets an unauthenticated caller install a signing key and forge registry tokens for any repository.
Nov 12, 2026
Traccar LDAP Auth Bypass via Empty Password (CVE-2026-126777)
Traccar 3.15 through 6.16.0 accepts an empty password on LDAP logins, so an attacker who knows a username can sign in as any user, including administrators.
Nov 12, 2026