Overzicht van binnengekomen advisories.
1553 resultaten gevonden
CVE-2026-81093 describes a Server-Side Request Forgery (SSRF) vulnerability in the Apify MCP Server's get-html-skeleton tool. The tool accepted caller-supplied URLs and only validated their syntax (http/https scheme and parseable format) without inspecting the hostname or resolved IP address. This allowed loopback, link-local, and private IP ranges to pass validation, including cloud provider instance metadata endpoints (e.g., 169.254.169.254). Any caller of the MCP server could exploit this to make the server fetch internal-only endpoints and return the response, potentially exposing sensitive instance credentials and internal services. The vulnerability resided in src/tools/common/get_html_skeleton.ts using the isValidHttpUrl function from src/utils/generic.ts. The fix in version 0.9.12 removes the vulnerable tool entirely rather than patching the URL validation logic.
Bekijk origineel advisory →openssl_encrypt versions prior to 1.4.9 contain a critical signature verification vulnerability in the gpg_runner.verify_detached function. The flaw arises from only checking the VALIDSIG status while ignoring REVKEYSIG, EXPKEYSIG statuses and GPG exit codes. This oversight allows attackers who possess revoked or expired signing keys to bypass signature verification entirely. Successful exploitation enables the execution of malicious plugins within the host process. The vulnerability poses a significant risk as it undermines the integrity of the plugin loading mechanism. Users are advised to upgrade to version 1.4.9 or later to remediate the issue.
Bekijk origineel advisory →A critical vulnerability chain has been discovered in the Avada WordPress theme, one of the most popular commercial WordPress themes. The flaw allows unauthenticated attackers to execute arbitrary PHP code on the server without any user interaction, qualifying it as a zero-click remote code execution (RCE) vulnerability. The attack requires no authentication, significantly raising its risk level and potential for mass exploitation. WordPress sites using the Avada theme are at risk of full server compromise. The vulnerability chain suggests multiple flaws are combined to achieve code execution. Site administrators using Avada are strongly urged to apply patches or mitigations immediately. The critical nature of this vulnerability, combined with the wide adoption of the Avada theme, could expose a large number of websites to attack.
Bekijk origineel advisory →A newly disclosed hardware attack named GPUThor targets NVIDIA GPUs by exploiting Rowhammer-style bit-flip vulnerabilities to bypass Error-Correcting Code (ECC) memory protections. The attack can enable denial-of-service (DoS) conditions as well as root-level privilege escalation on affected systems. ECC is typically considered a robust defense against Rowhammer attacks in DRAM, but GPUThor demonstrates it can be defeated in GPU memory contexts. This represents a significant threat to cloud and high-performance computing environments where NVIDIA GPUs are widely deployed. The attack highlights the growing security risks associated with GPU hardware, which is increasingly used in sensitive workloads including AI and cryptographic operations. Successful exploitation could allow an attacker to gain elevated privileges or destabilize GPU-dependent systems.
Bekijk origineel advisory →Medical technology company Boston Scientific has been targeted by a cyberattack that disrupted some of its IT systems and caused operational disruptions globally. The attack impacted the company's operations across multiple regions. Boston Scientific is a major medical device manufacturer, making this incident significant for the healthcare and medical technology sector. The full scope and nature of the attack, including whether ransomware was involved or data was exfiltrated, is not fully detailed in the article. The incident highlights ongoing cybersecurity threats targeting critical healthcare and medical technology infrastructure.
Bekijk origineel advisory →Attackers are actively targeting a chained exploit involving two Microsoft SharePoint vulnerabilities that together allow remote code execution on unpatched servers. The threat intelligence firm Defused reported the active exploitation attempts. A proof-of-concept (PoC) exploit is available, significantly lowering the barrier for attackers. The vulnerability chain enables arbitrary code execution without requiring high privileges. Organizations running unpatched SharePoint servers are at significant risk. The chained nature of the exploit makes it particularly dangerous as it bypasses individual mitigations. Microsoft has released patches and administrators are urged to apply them immediately. This follows a broader trend of SharePoint vulnerabilities being targeted by sophisticated threat actors.
Bekijk origineel advisory →Cybersecurity researchers have uncovered a new adversary-in-the-middle (AitM) phishing toolkit called NovaCookies, offered as a subscription-based service at $320/month. The toolkit operates as a proxy to redirect Microsoft 365 sign-in flows, capturing authenticated session cookies in the process. NovaCookies campaigns abuse legitimate Docusign notification emails to lend credibility to the phishing attempts, making detection more difficult for end users. By intercepting real authentication sessions, attackers can bypass multi-factor authentication (MFA) protections. The platform was analyzed and reported by Island, who shared findings with The Hacker News ahead of publication. This represents a growing trend of phishing-as-a-service (PhaaS) platforms targeting enterprise identity infrastructure. The abuse of genuine third-party service notifications highlights the sophistication of modern phishing campaigns.
Bekijk origineel advisory →Ubiquiti has released security patches addressing three maximum-severity vulnerabilities in its products. These vulnerabilities can be exploited remotely by threat actors without requiring any privileges, making them especially dangerous. The flaws represent critical risks to organizations and individuals using Ubiquiti networking equipment. Ubiquiti has urged users to apply the patches immediately to mitigate potential exploitation. No additional technical details about specific CVEs or exploitation in the wild were provided in the article excerpt.
Bekijk origineel advisory →CISA published results of simultaneous red team assessments conducted against two critical infrastructure organizations using similar tradecraft. Both organizations were fully compromised at the domain level. The assessments revealed sharply different defensive outcomes between the two organizations. One organization failed to detect any of the red team's activities throughout the engagement. The findings highlight significant gaps in detection and response capabilities within critical infrastructure sectors. The report serves as a warning about the state of cybersecurity readiness in critical infrastructure. CISA used the assessments to demonstrate the importance of robust monitoring, detection, and incident response capabilities.
Bekijk origineel advisory →CERT/CC has disclosed two unpatched vulnerabilities in Kaltura's mwEmbed HTML5 video player library, tracked as CVE-2026-19913 and CVE-2026-19912. Both flaws originate from unsafe deserialization in the mwEmbedLoader.php endpoint. A remote, unauthenticated attacker could exploit these vulnerabilities to read arbitrary files from the server or execute arbitrary code. The vulnerabilities remain unpatched at the time of disclosure. The impact is significant given the widespread use of Kaltura's video platform in enterprise and educational environments. No active exploitation has been confirmed, but the unauthenticated nature of the attack vector increases risk considerably.
Bekijk origineel advisory →Attackers are actively exploiting a critical-severity vulnerability in Gitea, a self-hosted Git service platform. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed the exploitation of this flaw in code injection attacks. The vulnerability allows attackers to inject malicious code into affected Gitea instances. CISA's involvement indicates the threat is considered significant and widespread. Organizations running self-hosted Gitea instances are urged to apply patches immediately. The flaw is classified as critical severity, suggesting a high potential for damage. Code injection vulnerabilities can lead to full system compromise, data theft, or further network infiltration. This incident highlights the risks associated with self-hosted source code management platforms.
Bekijk origineel advisory →Vercel has patched two vulnerabilities in Next.js, a popular React framework for web application development. The first vulnerability, CVE-2026-75604, allows attackers to execute arbitrary code on the application server. It specifically affects Next.js applications hosted on Windows environments using both Pages and App routers without the Cache Component. The second vulnerability, which had not yet received a CVE identifier at time of publication, also enables remote code execution by supplying a malicious media file to a vulnerable application. Both vulnerabilities have been resolved by Vercel. Users of Next.js, especially those on Windows-based deployments, are advised to update immediately.
Bekijk origineel advisory →CISA has issued a warning about active exploitation of a critical remote code execution vulnerability in Gitea, tracked as CVE-2026-60004 with a CVSS score of 9.8. The flaw allows an attacker with ordinary write access to a repository to execute arbitrary shell commands. Reported attacks are dropping a miner-like payload on compromised systems. The vulnerability has been recently patched, but active exploitation campaigns are already underway. Organizations using Gitea are urged to apply the patch immediately given the severity and active exploitation status.
Bekijk origineel advisory →Cybersecurity researchers from SOCRadar Threat Research Unit (STRU) have uncovered a phishing-as-a-service (PhaaS) platform called AnonyMousKIT designed to bypass Apple's Activation Lock on stolen devices. The platform uses rented AI voice agents to call theft victims, impersonating Apple Support, and tricks them into revealing their device passcode and two-factor authentication codes. The service operates on a credit-metered model, lowering the barrier for cybercriminals to conduct sophisticated social engineering attacks. By obtaining the passcode and 2FA codes, attackers can disable Activation Lock and fully take over stolen Apple devices. This represents a significant evolution in vishing (voice phishing) attacks, leveraging AI to scale and automate deceptive phone calls. The campaign highlights growing abuse of AI voice technology in cybercrime and the increasing sophistication of PhaaS platforms targeting Apple ecosystem users.
Bekijk origineel advisory →CVE-2015-5287 is a privilege escalation vulnerability in Red Hat's Automatic Bug Reporting Tool (ABRT). It allows local users with certain permissions to gain elevated privileges by performing a symlink attack on a file with a predictable name. The vulnerability affects an open-source component that may be used across multiple products. The impacted product(s) may be end-of-life or end-of-service, and users are advised to discontinue use or transition to a supported version. A fix is referenced in the ABRT GitHub repository. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Forensic triage guidance is also available through CISA's BOD 26-04 implementation resources. The NVD entry confirms the severity and details of this vulnerability.
Bekijk origineel advisory →CVE-2019-1068 is a remote code execution vulnerability affecting Microsoft SQL Server. An attacker who successfully exploits this vulnerability could execute arbitrary code in the context of the SQL Server Database Engine service account. The vulnerability is tracked by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Microsoft has published an official advisory through the Microsoft Security Response Center. CISA also references forensic triage requirements under BOD 26-04 implementation guidance. The vulnerability is catalogued in the National Vulnerability Database (NVD). Organizations running affected versions of Microsoft SQL Server are advised to apply the relevant security patches promptly. The current risk rating is High (H), indicating significant potential impact if exploited.
Bekijk origineel advisory →CVE-2021-23758 affects Ajax.NET Professional (AjaxPro), an open-source .NET library, which contains a deserialization of untrusted data vulnerability. This flaw allows attackers to exploit arbitrary .NET class deserialization, potentially leading to remote code execution. The vulnerability is catalogued in CISA's Known Exploited Vulnerabilities catalog under BOD 26-04. The affected product may be end-of-life or end-of-service, and users are advised to discontinue use or migrate to a supported alternative. A patch commit is available on GitHub for reference. The issue stems from improper handling of untrusted data during deserialization, a common and critical vulnerability class in web frameworks. Organizations using AjaxPro in their web applications are at risk of full system compromise if exploited. CISA has flagged this for prioritized remediation under its binding operational directive.
Bekijk origineel advisory →CVE-2015-3246 is a race condition vulnerability in Red Hat's libuser library. It allows authenticated local users to corrupt the /etc/passwd file, potentially leading to a denial of service or privilege escalation. The vulnerability affects an open-source component that may be used across multiple products. It has been flagged under CISA's BOD 26-04 directive, which prioritizes security updates based on risk. Forensic triage requirements are also associated with this vulnerability per BOD 26-04 implementation guidance. The vulnerability is rated High severity and has been catalogued in the NVD.
Bekijk origineel advisory →CVE-2022-0995 is an out-of-bounds memory write vulnerability in the Linux Kernel. It allows a local user to gain elevated privileges or cause a denial of service on affected systems. The vulnerability is tracked by CISA and listed under BOD 26-04, which prioritizes security updates based on risk. It affects an open-source component that may be used across a wide range of products and distributions. A patch has been committed to the mainline Linux kernel repository by Linus Torvalds. CISA has provided forensic triage requirements and implementation guidance for organizations needing to remediate. The vulnerability is rated High severity, underscoring the importance of timely patching for Linux-based environments.
Bekijk origineel advisory →CVE-2026-8452 affects Citrix NetScaler ADC and NetScaler Gateway products, involving an improper restriction of operations within the bounds of a memory buffer. This vulnerability could be exploited to cause a denial of service condition. The issue has been flagged by CISA and is subject to BOD 26-04, which mandates prioritizing security updates based on risk. Citrix has published an advisory (CTX696604) with remediation guidance. The vulnerability is tracked in the NVD and carries a high criticality rating. Federal agencies and organizations using affected Citrix products are urged to apply patches promptly. Forensics triage requirements are also outlined in the BOD 26-04 implementation guidance.
Bekijk origineel advisory →