Overview of incoming advisories.
2179 results found
Nearly 22,000 Microsoft Exchange servers exposed to the internet remain unpatched against a high-severity authentication bypass vulnerability. This flaw allows attackers to hijack all user mailboxes on affected servers. The vulnerability is classified as high-severity and represents a significant risk to organizations still running unpatched versions. The large number of exposed servers indicates widespread failure to apply available security updates. Successful exploitation could lead to full compromise of email communications, data exfiltration, and further lateral movement within affected organizations.
View original advisory →CISA published an advisory regarding a denial-of-service vulnerability (CVE-2021-42260) affecting multiple Rockwell Automation programmable logic controllers including ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380, and CompactLogix 5480. The vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop) and can be triggered by sending corrupt crafted data to the affected devices. Successful exploitation can cause a major nonrecoverable fault (MNRF), requiring a program download for safety controllers or a stage 2 reset for non-safety controllers. The CVSS v3.1 base score is 7.5 (HIGH) and CVSS v4.0 base score is 8.7 (HIGH), with the attack vector being network-based, requiring no authentication or user interaction. Affected firmware versions are below 34.015, 35.014, 36.013, and 37.011 across the impacted product lines. Rockwell Automation reported the vulnerability to CISA and recommends updating to the patched firmware versions. The advisory affects critical manufacturing infrastructure deployed worldwide. No known public exploitation has been reported at the time of publication.
View original advisory →CISA has published an advisory for two vulnerabilities affecting Rockwell Automation Historian ME (FactoryTalk Historian Machine Edition) in Series B 5.202 and Series C 7.101. CVE-2025-12768 is a high-severity out-of-bounds write vulnerability (CVSS 3.1: 8.0) that allows a low-privileged, network-adjacent attacker to achieve remote code execution. CVE-2026-12661 is a medium-severity stack-based buffer overflow (CVSS 3.1: 4.5) that enables an authenticated adjacent attacker to crash the device via crafted web requests, causing denial of service. Affected critical infrastructure sectors include Chemical, Critical Manufacturing, Food and Agriculture, Healthcare and Public Health, and Water and Wastewater Systems. No public exploitation has been reported. Mitigations include following Rockwell Automation security best practices, minimizing network exposure, using firewalls, and employing VPNs for remote access. Rockwell Automation self-reported these vulnerabilities to CISA.
View original advisory →A privilege escalation vulnerability (CVE-2026-16675) exists in Rockwell Automation FactoryTalk Activation Manager V5.02 and below. The flaw stems from custom installer actions that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated local attacker can hijack these console windows to obtain a SYSTEM-level command prompt, granting full access to files, processes, and system resources. The vulnerability carries a CVSS v3.1 score of 7.8 (HIGH) and CVSS v4.0 score of 8.5 (HIGH). Affected sectors include Critical Manufacturing deployed worldwide. Rockwell Automation recommends updating to V5.03 to remediate the issue. No known public exploitation has been reported to CISA at this time.
View original advisory →A denial-of-service vulnerability (CVE-2026-9637) exists in multiple Rockwell Automation Logix Platform products due to improper validation of input length during CIP message processing. Affected products include ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, and Compact GuardLogix 5380 across multiple firmware versions up to V36. Exploitation can cause a major nonrecoverable fault (MNRF), requiring a power cycle to restore operation. The vulnerability is remotely exploitable with no authentication or user interaction required, scoring 7.5 (HIGH) on CVSS v3.1 and 8.7 (HIGH) on CVSS v4.0. Rockwell Automation reported the issue to CISA and has released patched firmware versions (V34.015, V35.014, V36.013, V37.011). Organizations unable to patch are advised to follow Rockwell Automation security best practices and isolate control systems from internet exposure. No known public exploitation has been reported at the time of publication.
View original advisory →CISA published an ICS advisory detailing four denial-of-service vulnerabilities in Rockwell Automation RSLinx Classic versions 4.50 and earlier. The vulnerabilities (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625) can be exploited via crafted CIP packets, causing the RSLinx Classic service to crash and require a restart. Root causes include integer overflow, integer underflow, insufficient data length validation, and classic buffer overflow. CVSS v3.1 scores range from 7.5 to 8.6 (HIGH), while CVSS v4.0 scores range from 8.7 to 9.2 (HIGH to CRITICAL). The fix is available in RSLinx Classic version 4.60. These vulnerabilities affect critical manufacturing sectors worldwide. No known public exploitation has been reported at the time of publication. Rockwell Automation self-reported the vulnerabilities to CISA.
View original advisory →Two recently patched security vulnerabilities in PaperCut NG and MF print management software are being actively exploited in data theft attacks. The vulnerabilities were initially exploited as zero-days before patches were released. Attackers are leveraging these flaws to steal data from affected organizations. PaperCut is widely used print management software deployed across enterprises and educational institutions. The exploitation occurred shortly after patches were made available, indicating rapid weaponization by threat actors. Organizations using PaperCut NG or MF are strongly advised to apply the available patches immediately. The active exploitation underscores the risk of delayed patching for critical software vulnerabilities.
View original advisory →Threat actors are actively exploiting two critical vulnerabilities in Langflow and Ruby on Rails, as reported by VulnCheck. CVE-2026-0768 (CVSS 9.8) affects Langflow and allows attackers to execute arbitrary Python code as root due to improper input validation. CVE-2026-66066 affects Ruby on Rails. The exploitation activity includes credential-probing and command-and-control (C2) operations. Both vulnerabilities are rated critical and are being leveraged in active attack campaigns. Organizations using these platforms are urged to apply patches immediately. The findings highlight the ongoing risk of unpatched web application frameworks being weaponized by threat actors.
View original advisory →This article analyzes a Guildma (also known as Astaroth) malware infection originating from a Brazilian Portuguese phishing email. Guildma is a sophisticated banking trojan primarily targeting Brazilian users and organizations. The malware is typically distributed via spam email campaigns written in Brazilian Portuguese to target local victims. Astaroth/Guildma is known for its use of living-off-the-land binaries (LOLBins) to evade detection and execute its payload. The infection chain often involves malicious attachments or links leading to multi-stage loaders. This malware is capable of credential theft, keylogging, and intercepting banking transactions. The article was published on September 1st and appears on the SANS Internet Storm Center diary.
View original advisory →CVE-2026-61774 is a high-severity vulnerability affecting NVIDIA Megatron Bridge. The flaw involves deserialization of untrusted data, which can be exploited by an attacker to achieve remote code execution, data tampering, and information disclosure. The vulnerability is tracked under NVIDIA's product security advisory and listed in the National Vulnerability Database. No specific exploitation in the wild has been mentioned, but the potential impact is significant given the range of consequences. NVIDIA has published a security advisory on GitHub. Users of NVIDIA Megatron Bridge are advised to review the advisory and apply any available mitigations or patches promptly.
View original advisory →CVE-2026-84121 is a high-severity vulnerability in Firefox involving a use-after-free condition in the DOM Security component that enables sandbox escape. The flaw allows an attacker to potentially break out of the browser sandbox, which could lead to arbitrary code execution or privilege escalation. Mozilla has addressed the vulnerability in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2. Multiple Mozilla Security Advisories (MFSA2026-82 through MFSA2026-85) have been published in relation to this issue. The vulnerability is tracked in Mozilla's Bugzilla under bug ID 2059018. Users of affected Firefox versions are strongly urged to update immediately. The sandbox escape nature of the bug makes it particularly critical as it bypasses a key security boundary in the browser.
View original advisory →LibreNMS versions prior to 26.5.0 contain a remote code execution vulnerability in the AboutController component. The snmpget configuration parameter is passed directly to shell_exec() without proper sanitization or validation. An authenticated administrator can exploit this by modifying the snmpget configuration to reference a malicious executable. Code execution is then triggered by simply accessing the /about endpoint. The vulnerability requires administrator-level authentication, limiting the attack surface but not eliminating the risk. Fixes are available in LibreNMS version 26.5.0 and later. The issue is documented across NVD, GitHub Security Advisories, and VulnCheck.
View original advisory →CVE-2026-61774 affects NVIDIA Megatron Bridge, a component likely related to NVIDIA's AI/ML infrastructure tooling. The vulnerability involves deserialization of untrusted data, a well-known and dangerous vulnerability class. A successful exploit could allow an attacker to achieve remote code execution, tamper with data, or disclose sensitive information. The vulnerability is currently undergoing analysis on the NVD. NVIDIA has published a security advisory referencing this CVE in their product-security GitHub repository. No patch or workaround details are included in the available content. The severity is rated High based on the potential impact of code execution and data compromise. Organizations using NVIDIA Megatron Bridge should monitor for updates from NVIDIA and apply patches as soon as they become available.
View original advisory →CVE-2026-61771 affects NVIDIA Megatron Bridge, a component related to NVIDIA's AI and deep learning infrastructure. The vulnerability involves deserialization of untrusted data, a class of vulnerability that can be particularly severe. A successful exploit could lead to remote code execution, data tampering, and information disclosure. This type of deserialization flaw typically allows attackers to craft malicious serialized objects that, when processed by the target application, execute arbitrary code. The vulnerability is currently undergoing analysis by NVD. NVIDIA has published a security advisory on their GitHub product-security repository. Given the potential for code execution and data tampering, this is rated as high severity.
View original advisory →CVE-2026-61779 is a deserialization of untrusted data vulnerability found in NVIDIA Megatron Bridge. An attacker who successfully exploits this vulnerability could achieve remote code execution, tamper with data, and cause information disclosure. The vulnerability is currently undergoing analysis on the NVD. NVIDIA has published a security advisory on their GitHub product-security repository. The flaw represents a high-severity risk given the potential for full code execution on affected systems. Organizations using NVIDIA Megatron Bridge should monitor for patches and apply mitigations as soon as they become available. The CVE record is also tracked on the official CVE.org portal.
View original advisory →CVE-2026-61769 is a deserialization of untrusted data vulnerability affecting NVIDIA Megatron Bridge. An attacker who successfully exploits this vulnerability could achieve remote code execution, data tampering, and information disclosure. The vulnerability is currently undergoing analysis by NVD. NVIDIA has published a security advisory via their product-security GitHub repository. The flaw is classified as high criticality given the potential impact of code execution and data compromise. No additional technical details or proof-of-concept code are currently referenced. Users of NVIDIA Megatron Bridge should monitor NVIDIA's security advisories for patches and mitigations.
View original advisory →A critical vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer (AFC). An unauthenticated remote attacker can exploit this flaw to gain administrative access to vulnerable AFC hosts. Successful exploitation allows arbitrary command execution as a privileged user on the underlying operating system. This leads to complete system compromise without requiring any credentials. The vulnerability is tracked as CVE-2026-76658 and is currently awaiting full analysis by NVD. HPE has published a security bulletin with remediation guidance. The severity is rated High given the unauthenticated remote exploitation vector and full system compromise potential.
View original advisory →A cleartext storage vulnerability exists in the @step and @remote decorator pipeline components of the Amazon SageMaker Python SDK prior to versions v3.11.0 and v2.256.0. An authenticated remote user can extract an HMAC signing key from SageMaker DescribePipeline API responses due to the key being stored in plaintext. The exposed key allows an attacker to forge valid integrity signatures for specially crafted function payloads. This forgery enables code execution within another user's pipeline execution context inside the same AWS account. The vulnerability represents a significant lateral movement and privilege escalation risk within shared AWS environments. Fixes have been released in SageMaker Python SDK v2.256.0 and v3.11.0. AWS has published a security bulletin and GitHub advisory addressing the issue.
View original advisory →CVE-2026-61762 is a high-severity vulnerability identified in NVIDIA Megatron Bridge involving deserialization of untrusted data. An attacker who successfully exploits this vulnerability could achieve remote code execution, tamper with sensitive data, and disclose confidential information. The vulnerability was published via the National Vulnerability Database (NVD) and is referenced in NVIDIA's product security advisories. Deserialization vulnerabilities are particularly dangerous as they can allow attackers to execute arbitrary code on the affected system. NVIDIA has acknowledged the issue and linked it to their official product security repository. Organizations using NVIDIA Megatron Bridge should review the advisory and apply any available mitigations or patches promptly. The potential impact spans code execution, data integrity, and confidentiality, making this a critical concern for affected deployments.
View original advisory →Memos versions 0.26.0 through 0.30.0 contain a vulnerability where refresh tokens are not invalidated when a user changes their password. This allows an attacker who has obtained a refresh token to continue generating valid access tokens indefinitely via the RefreshToken RPC, effectively bypassing the security intent of a password change. The vulnerability is classified as Insufficient Session Expiration. An attacker maintaining a stolen refresh token can rotate it perpetually, preserving unauthorized account access even after the legitimate user has updated their credentials. The issue is documented in the Memos authenticator and user service source files. A fix requires implementing token revocation logic tied to password change events.
View original advisory →