Vulnerability Report Archives • Page 7 of 119 • Daily CyberSecurity

Microsoft Tracks Zimbra CVE-2026-73570 Attacks That Steal Mail and Auth Keys Zimbra CVE-2026-73570 command injection attack chain from crafted email to web shells and mailbox theft

Zimbra CVE-2026-73570 command injection attack chain from crafted email to web shells and mailbox theft

Microsoft Tracks Zimbra CVE-2026-73570 Attacks That Steal Mail and Auth Keys

Do Son September 30, 2026

A single crafted email can give attackers a shell on an unpatched Zimbra mail server. Microsoft Threat...

Cisco SD-WAN Manager Authentication Bypass CVE-2026-76504 Exploited in the Wild

Do Son September 30, 2026

TL;DR Cisco has patched CVE-2026-76504, a CVSS 9.8 authentication bypass in Cisco SD-WAN Manager. Attackers already exploit...

Critical Apache PLC4X Flaw Lets Attackers Hijack OPC UA Connections to PLCs Apache PLC4X vulnerability CVE-2026-102508 in the OPC UA driver allowing server impersonation and credential theft

Apache PLC4X vulnerability CVE-2026-102508 in the OPC UA driver allowing server impersonation and credential theft

Critical Apache PLC4X Flaw Lets Attackers Hijack OPC UA Connections to PLCs

Do Son September 30, 2026

TL;DR The Apache Software Foundation disclosed CVE-2026-102508, a critical Apache PLC4X vulnerability in its OPC UA driver,...

TeamViewer Fixes Five High-Severity Flaws in Full Client and Host TeamViewer vulnerabilities CVE-2026-92370, CVE-2026-19743 and CVE-2026-92368 in TeamViewer Full Client and Host

TeamViewer vulnerabilities CVE-2026-92370, CVE-2026-19743 and CVE-2026-92368 in TeamViewer Full Client and Host

TeamViewer Fixes Five High-Severity Flaws in Full Client and Host

Do Son September 30, 2026

TL;DR TeamViewer disclosed five TeamViewer vulnerabilities on September 29, 2026, in its Full Client and Host for...

Electron Fixes Five High-Severity Sandbox and Isolation Vulnerabilities Electron vulnerabilities CVE-2026-102676, CVE-2026-102673 and CVE-2026-102674 weakening sandbox and isolation in desktop apps

Electron vulnerabilities CVE-2026-102676, CVE-2026-102673 and CVE-2026-102674 weakening sandbox and isolation in desktop apps

Electron Fixes Five High-Severity Sandbox and Isolation Vulnerabilities

Do Son September 30, 2026

TL;DR Electron maintainers published five Electron vulnerabilities on September 29, 2026, all rated High, with CVSS scores...

HPE Patches 18 Instant ON Access Point Vulnerabilities, Five Rated Critical HPE Instant ON vulnerabilities in access points, including critical RCE flaws CVE-2026-76721 and CVE-2026-76722

HPE Instant ON vulnerabilities in access points, including critical RCE flaws CVE-2026-76721 and CVE-2026-76722

HPE Patches 18 Instant ON Access Point Vulnerabilities, Five Rated Critical

Do Son September 30, 2026

TL;DR HPE Networking disclosed 18 HPE Instant ON vulnerabilities on September 29, 2026, in its Instant ON...

WatchGuard Patches 14 Fireware OS Vulnerabilities, Including CVSS 9.2 RCE WatchGuard Fireware OS vulnerabilities including critical BOVPN Over TLS code injection CVE-2026-86131 and pre-auth fingerd overflow CVE-2026-81433 on Firebox appliances

WatchGuard Fireware OS vulnerabilities including critical BOVPN Over TLS code injection CVE-2026-86131 and pre-auth fingerd overflow CVE-2026-81433 on Firebox appliances

WatchGuard Patches 14 Fireware OS Vulnerabilities, Including CVSS 9.2 RCE

Do Son September 30, 2026

TL;DR WatchGuard disclosed 14 Fireware OS vulnerabilities on September 29, 2026, affecting its Firebox firewalls. The worst,...

Branch Target Reuse Spectre-v2 attack against JIT engines, with the VUSec research paper and proof-of-concept exploit code publicly released

Branch Target Reuse Spectre-v2 Attack: Full Details and PoC Code Released

Do Son September 30, 2026

TL;DR Researchers at VUSec have published full details and proof-of-concept code for Branch Target Reuse (BTR), a...

GeoServer Cloud Fixes CVSS 10 GitHub Actions Flaw That Exposed Repository Secrets GeoServer Cloud vulnerability in a GitHub Actions pull_request_target workflow that could allow code execution and secrets exfiltration

GeoServer Cloud vulnerability in a GitHub Actions pull_request_target workflow that could allow code execution and secrets exfiltration

GeoServer Cloud Fixes CVSS 10 GitHub Actions Flaw That Exposed Repository Secrets

Do Son September 30, 2026

TL;DR GeoServer maintainers disclosed a CVSS 10 GeoServer Cloud vulnerability in a GitHub Actions workflow. It could...

Podman Flaw CVE-2026-94603 Lets Container Images Disable Sandboxing Podman vulnerability CVE-2026-94603 letting a checkpoint image annotation override container sandbox settings in podman run

Podman vulnerability CVE-2026-94603 letting a checkpoint image annotation override container sandbox settings in podman run

Podman Flaw CVE-2026-94603 Lets Container Images Disable Sandboxing

Do Son September 30, 2026

TL;DR A Podman vulnerability, CVE-2026-94603, rated CVSS 10.0, lets a container image switch off nearly all sandboxing...

JupyterLab Desktop Flaw CVE-2026-102530 Turns a Malicious Server URL Into Code Execution JupyterLab Desktop vulnerability CVE-2026-102530, an XSS in the Connect to Remote Server dialog that leads to remote code execution

JupyterLab Desktop vulnerability CVE-2026-102530, an XSS in the Connect to Remote Server dialog that leads to remote code execution

JupyterLab Desktop Flaw CVE-2026-102530 Turns a Malicious Server URL Into Code Execution

Do Son September 30, 2026

TL;DR A JupyterLab Desktop vulnerability, CVE-2026-102530, rated CVSS 9.4, lets a malicious server URL run code on...

Chrome Security Update Fixes 32 Flaws, Including Critical ANGLE Bug CVE-2026-102331 Chrome security update 154.0.8037.92 fixing 33 flaws, including critical ANGLE buffer overflow CVE-2026-102331 and V8 type confusion bugs

Chrome security update 154.0.8037.92 fixing 33 flaws, including critical ANGLE buffer overflow CVE-2026-102331 and V8 type confusion bugs

Chrome Security Update Fixes 32 Flaws, Including Critical ANGLE Bug CVE-2026-102331

Do Son September 29, 2026

TL;DR Google released a Chrome security update, version 154.0.8037.92/.93, that fixes 32 security flaws. The top issue...

Critical MikroTik RouterOS Flaw CVE-2026-84411 Allows Unauthenticated Root RCE MikroTik RouterOS vulnerability CVE-2026-84411, an unauthenticated integer underflow in the web management service enabling root remote code execution

MikroTik RouterOS vulnerability CVE-2026-84411, an unauthenticated integer underflow in the web management service enabling root remote code execution

Critical MikroTik RouterOS Flaw CVE-2026-84411 Allows Unauthenticated Root RCE

Do Son September 29, 2026

TL;DR CISA published advisory ICSA-26-272-06 on September 29, 2026, for a critical MikroTik RouterOS vulnerability, CVE-2026-84411. A...

CISA Warns of 10 Toptech TMS7 and TopHAT Vulnerabilities, One Rated CVSS 10.0 Toptech TMS7 vulnerabilities in the CISA ICS advisory, including CVSS 10.0 flaw CVE-2026-71379 affecting TMS7 and TopHAT terminal management systems

Toptech TMS7 vulnerabilities in the CISA ICS advisory, including CVSS 10.0 flaw CVE-2026-71379 affecting TMS7 and TopHAT terminal management systems

CISA Warns of 10 Toptech TMS7 and TopHAT Vulnerabilities, One Rated CVSS 10.0

Do Son September 29, 2026

TL;DR CISA published advisory ICSA-26-272-02 on September 29, 2026, covering 10 Toptech TMS7 vulnerabilities that also affect...

OpenSSL Patches 14 Vulnerabilities, Including High-Severity DTLS Memory Leak OpenSSL vulnerabilities fixed in the September 29, 2026 advisory, including the high-severity DTLS flaw CVE-2026-84782 and X.509 use-after-free CVE-2026-84783

OpenSSL vulnerabilities fixed in the September 29, 2026 advisory, including the high-severity DTLS flaw CVE-2026-84782 and X.509 use-after-free CVE-2026-84783

OpenSSL Patches 14 Vulnerabilities, Including High-Severity DTLS Memory Leak

Do Son September 29, 2026

TL;DR OpenSSL fixed 14 OpenSSL vulnerabilities in a security advisory on September 29, 2026. One is rated...

macOS SMB Kernel Flaw CVE-2026-84543: Details and PoC Exploit Released macOS SMB kernel vulnerability CVE-2026-84543 in SMBFS, with technical details and proof-of-concept exploit released by researcher Peter Malone

macOS SMB kernel vulnerability CVE-2026-84543 in SMBFS, with technical details and proof-of-concept exploit released by researcher Peter Malone

macOS SMB Kernel Flaw CVE-2026-84543: Details and PoC Exploit Released

Do Son September 29, 2026

TL;DR Researcher Peter Malone has published full details and proof-of-concept code for CVE-2026-84543, a macOS SMB kernel...

Octopus Server Flaw CVE-2026-101169 Allows Code Execution via Insecure Deserialization Octopus Server vulnerability CVE-2026-101169 insecure JSON deserialization enabling code execution in the Octopus Deploy server process

Octopus Server vulnerability CVE-2026-101169 insecure JSON deserialization enabling code execution in the Octopus Deploy server process

Octopus Server Flaw CVE-2026-101169 Allows Code Execution via Insecure Deserialization

Do Son September 29, 2026

TL;DR Octopus Deploy has fixed a high-severity Octopus Server vulnerability, CVE-2026-101169. An authenticated user who can edit...

Exploited Citrix NetScaler Flaw CVE-2026-88771: Details and PoC Now Public Citrix NetScaler CVE-2026-88771 pre-auth command injection exploited in the wild, with technical details and a proof-of-concept detection tool released by watchTowr

Citrix NetScaler CVE-2026-88771 pre-auth command injection exploited in the wild, with technical details and a proof-of-concept detection tool released by watchTowr

Exploited Citrix NetScaler Flaw CVE-2026-88771: Details and PoC Now Public

Do Son September 29, 2026

TL;DR watchTowr has published a technical analysis and a public proof-of-concept for CVE-2026-88771, a Citrix NetScaler flaw...

Apache Karaf Vulnerabilities Let Low-Privilege Users Reach Admin and Code Execution Apache Karaf vulnerabilities CVE-2026-92142, CVE-2026-91012 and CVE-2026-91048 allowing privilege escalation and remote code execution, fixed in Karaf 4.4.12

Apache Karaf vulnerabilities CVE-2026-92142, CVE-2026-91012 and CVE-2026-91048 allowing privilege escalation and remote code execution, fixed in Karaf 4.4.12

Apache Karaf Vulnerabilities Let Low-Privilege Users Reach Admin and Code Execution

Do Son September 29, 2026

TL;DR The Apache Karaf project has fixed four Apache Karaf vulnerabilities in version 4.4.12. Two are rated...

wolfSSL 5.9.4 Fixes 10 Vulnerabilities, Including TLS Authentication Bypass Flaws wolfSSL vulnerabilities fixed in release 5.9.4, including TLS authentication bypass flaws CVE-2026-93302, CVE-2026-89102 and CVE-2026-89136

wolfSSL vulnerabilities fixed in release 5.9.4, including TLS authentication bypass flaws CVE-2026-93302, CVE-2026-89102 and CVE-2026-89136

wolfSSL 5.9.4 Fixes 10 Vulnerabilities, Including TLS Authentication Bypass Flaws

Do Son September 29, 2026

TL;DR wolfSSL shipped version 5.9.4 on September 25, 2026, fixing 10 wolfSSL vulnerabilities. Three are rated High,...

Critical LXD Vulnerabilities Let Container Users Write Files as Root on the Host Critical LXD vulnerabilities CVE-2026-87799, CVE-2026-85185 and CVE-2026-85526 enabling root file writes on the host through migration and btrfs backup restore

Critical LXD vulnerabilities CVE-2026-87799, CVE-2026-85185 and CVE-2026-85526 enabling root file writes on the host through migration and btrfs backup restore

Critical LXD Vulnerabilities Let Container Users Write Files as Root on the Host

Do Son September 29, 2026

TL;DR Canonical has patched three critical LXD vulnerabilities rated CVSS 9.6 to 9.9. Each one lets a...

Authlib Signature Bypass Vulnerability Exposes Apps Diagram showing the Authlib signature bypass vulnerability attack path and CVE-2026-96760 forge process

Diagram showing the Authlib signature bypass vulnerability attack path and CVE-2026-96760 forge process

Authlib Signature Bypass Vulnerability Exposes Apps

Do Son September 29, 2026

TL;DR CERT/CC released an advisory warning of an Authlib signature bypass vulnerability tracked as CVE-2026-96760. This flaw...