Tag
#security
Cronicle Task Scheduler Privilege Escalation (CVE-2026-85076)
A non-admin Cronicle user can inject environment variables through event params and run code in another job's context. Fixed in 0.9.124.
Nov 07, 2026
SonicWall SSLVPN SAML Bypass, Exploited in the Wild (CVE-2026-19868)
A SonicOS SSLVPN flaw lets an account with valid alternate-method credentials skip SAML and its M...
Nov 07, 2026
Kubeflow Pipelines Cross-Tenant RCE (CVE-2026-77596)
Kubeflow Pipelines before 2.18.0 skips authorization for shared pipeline uploads, letting a low-p...
Nov 06, 2026
OpenEMR IDOR Exposes Any Patient Document (CVE-2026-102940)
Any signed-in OpenEMR user can move another patient's document to a record they can read, bypassi...
Nov 06, 2026
More tagged #security
kaniko Azure Token Leak to Lookalike Registries (CVE-2026-105769)
kaniko before 1.25.20 sends the build's Azure Resource Manager token to any registry host containing .azurecr.io, including attacker lookalikes.
Nov 06, 2026
FreeSWITCH SIP MESSAGE RCE, Exploited in the Wild (CVE-2026-116779)
A SIP MESSAGE to a stock FreeSWITCH profile can run FreeSWITCH API and OS commands; fixed in 1.11.3 and exploited in the wild.
Nov 06, 2026
OpenSSH musl Password Bypass, Fixed in 10.6p2 (CVE-2026-123158)
OpenSSH on musl libc without PAM accepts a 257-byte password for locked accounts; fixed in 10.6p2 and Alpine's packages.
Nov 06, 2026
Keycloak SAML Auth Bypass, Fixed in 26.8.2 (CVE-2026-117691)
Keycloak's SAML redirect binding verifies a different parameter than it processes, letting an attacker log in as any federated user; fixed in 26.8.2.
Nov 05, 2026
GPUStack Auth Bypass RCE, Exploited in the Wild (CVE-2026-102895)
GPUStack before 2.2.0 trusts a loopback request source, so a same-host reverse proxy turns a remote request into admin access and code execution.
Nov 05, 2026
Malicious ARTEX Docker Image Hands Out Root Shells
A copycat ARTEX Docker image added a hidden login handler that runs shell commands as root, and 62 internet consoles served it in November 2026.
Nov 05, 2026
APT29 Watering Holes Exploit Mobile n-Days (CVE-2024-27834)
APT29 compromised Plerdy's analytics script and legitimate sites to serve patched iOS and Android exploit chains; CISA added a chain CVE to KEV.
Nov 05, 2026
Apache OFBiz Pre-Auth RCE Fixed in 24.09.08 (CVE-2026-68524)
Apache OFBiz before 24.09.08 loads a screen definition from an attacker-chosen file descriptor on the login page and runs code; 46 CVEs are fixed.
Nov 05, 2026
APT Package-Swap RCE as Root on Debian and Ubuntu (CVE-2026-109518)
APT on Debian and Ubuntu can install an attacker's package after a redirect and a retry, giving an on-path attacker root; fixed in 3.3.6 and 3.0.4.
Nov 05, 2026
NIKKE PC Launcher Supply-Chain Attack Installed a Backdoor
Attackers modified four official NIKKE PC launcher scripts on Level Infinite's CDN to install the K2F remote-access agent; the fix shipped November 4.
Nov 05, 2026