https://skopnix.com/news/CVE-2026-911-ghsa-wx4m-69m9-gx3m-home-assistant-xss-in-statistics-graph-c skopnix en 2026-09-22T20:40:55.000Z GHSA-wx4m-69m9-gx3m: Home Assistant: XSS in Statistics Graph Card https://skopnix.com/news/CVE-2026-857-ghsa-vv3m-f8x4-7377-lightrag-hku-ssrf-via-ipv6-transition-ad skopnix en 2026-09-22T20:40:25.000Z GHSA-vv3m-f8x4-7377: lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown im https://skopnix.com/news/CVE-2026-857-ghsa-frch-4w6v-q5xx-lightrag-hku-no-rate-limiting-on-login-e skopnix en 2026-09-22T20:40:22.000Z GHSA-frch-4w6v-q5xx: lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks https://skopnix.com/news/CVE-2026-775-ghsa-328g-jx67-v94g-tinyauth-forward-auth-per-app-acl-is-mat skopnix en 2026-09-22T20:37:08.000Z GHSA-328g-jx67-v94g: Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, lettin https://skopnix.com/news/CVE-2026-623-ghsa-5jpj-293f-rhvj-kubeedge-command-injection-in-nodeupgrad skopnix en 2026-09-22T20:37:04.000Z GHSA-5jpj-293f-rhvj: KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API https://skopnix.com/news/CVE-2026-623-ghsa-9vm9-pqxx-x83v-kubeedge-keadm-decompresstargz-path-trav skopnix en 2026-09-22T20:36:59.000Z GHSA-9vm9-pqxx-x83v: KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join https://skopnix.com/news/CVE-2026-631-ghsa-34fc-gh42-pj53-openbaos-recovery-mode-vulnerable-to-tok skopnix en 2026-09-22T20:36:51.000Z GHSA-34fc-gh42-pj53: OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack https://skopnix.com/news/CVE-2026-715-ghsa-59w7-v8rr-pr4p-openbaos-templated-policies-allow-privil skopnix en 2026-09-22T20:36:49.000Z GHSA-59w7-v8rr-pr4p: OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters https://skopnix.com/news/CVE-2026-621-ghsa-m3c6-2p7h-cfr3-kubeedge-configupdatejob-updatefields-en skopnix en 2026-09-22T20:36:44.000Z GHSA-m3c6-2p7h-cfr3: KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes https://skopnix.com/news/CVE-2026-772-ghsa-93xw-j965-9mx3-mcp-atlassian-arbitrary-file-readexfiltr skopnix en 2026-09-22T20:36:37.000Z GHSA-93xw-j965-9mx3: MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path() https://skopnix.com/news/CVE-2026-566-ghsa-5mj8-gf6m-fhw8-9router-has-an-authentication-bypass-in skopnix en 2026-09-22T16:34:06.000Z GHSA-5mj8-gf6m-fhw8: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header https://skopnix.com/news/4bf76d623443-check-point-warns-of-management-server-zero-day-exploited-in skopnix en 2026-09-22T16:32:47.000Z Check Point warns of Management Server zero-day exploited in attacks https://skopnix.com/news/bbe00974ebe1-eviltokens-phaas-disrupted-after-compromising-12000-microsof skopnix en 2026-09-22T15:00:00.000Z EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts https://skopnix.com/news/1bbc2c4488af-unmasking-eviltokens-getting-to-the-root-of-device-code-phis skopnix en 2026-09-22T15:00:00.000Z Unmasking EvilTokens: Getting to the root of device code phishing https://skopnix.com/news/CVE-2026-582-ghsa-92cr-jxw4-5wjg-sync-in-server-has-a-complete-2fa-bypass skopnix en 2026-09-22T14:46:30.000Z GHSA-92cr-jxw4-5wjg: Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token` https://skopnix.com/news/CVE-2026-616-ghsa-jjhp-8crj-mppq-roomi-fieldsnotebooklm-mcp-has-a-path-tr skopnix en 2026-09-22T14:43:26.000Z GHSA-jjhp-8crj-mppq: @roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside https://skopnix.com/news/5daab5673438-ncsc-2026-0386-100-hh-kwetsbaarheid-verholpen-in-f5-networks skopnix en 2026-09-22T14:39:41.000Z NCSC-2026-0386 [1.00] [H/H] Kwetsbaarheid verholpen in F5 Networks BIG-IP Access Policy Manager https://skopnix.com/news/21e9d048815c-recent-zyxel-switch-vulnerability-exploited-by-chinese-hacke skopnix en 2026-09-22T11:55:20.000Z Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers https://skopnix.com/news/f7013485135e-ransomware-qilin-columbus-informatica skopnix en 2026-09-22T11:41:44.805Z Ransomware: qilin → Columbus Informatica https://skopnix.com/news/CVE-2026-897-new-linux-kernel-flaw-gives-arm64-kvm-guests-read-write-acce skopnix en 2026-09-22T11:38:40.000Z New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory https://skopnix.com/news/55a3a0ffa997-malicious-b-tree-npm-package-accumulates-millions-of-downloa skopnix en 2026-09-22T11:33:59.000Z Malicious B-tree NPM Package Accumulates Millions of Downloads https://skopnix.com/news/CVE-2026-656-sharepoint-flaw-initially-listed-as-spoofing-by-microsoft-en skopnix en 2026-09-22T11:17:41.000Z SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE https://skopnix.com/news/c82b46f73d01-researchers-have-spotted-a-campaign-targeting-iranian-dissid skopnix en 2026-09-22T11:00:54.000Z Researchers have spotted a campaign targeting Iranian dissidents in June that tried to deploy the ParsaStealer infostealer on users' devices https:// labs.infoguard.ch/posts/iranop https://skopnix.com/news/328603788eb7-public-poc-exposes-critical-veeam-agent-privilege-escalation skopnix en 2026-09-22T10:13:28.000Z Public PoC Exposes Critical Veeam Agent Privilege Escalation https://skopnix.com/news/4c4cb6380811-the-closed-quorum-inside-the-first-reported-autonomous-ai-c2 skopnix en 2026-09-22T10:00:58.000Z The Closed Quorum: Inside the first reported autonomous AI C2 implant https://skopnix.com/news/9ec5079fab2a-new-windows-defender-zero-day-blocks-microsoft-antivirus-upd skopnix en 2026-09-22T09:55:11.000Z New Windows Defender zero-day blocks Microsoft antivirus updates https://skopnix.com/news/b8f1171f5339-malicious-npm-package-indexed-btree-hid-its-loader-in-runtim skopnix en 2026-09-22T09:38:18.000Z Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal https://skopnix.com/news/3ddf58e86eff-cisa-orders-feds-to-patch-zyxel-flaw-exploited-for-data-thef skopnix en 2026-09-22T08:53:09.000Z CISA orders feds to patch Zyxel flaw exploited for data theft https://skopnix.com/news/a51bfa53bb0a-japan-dismantles-first-north-korean-laptop-farm-as-us-and-al skopnix en 2026-09-22T08:37:06.000Z Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme https://skopnix.com/news/8ccc97a0b799-sidecopy-broadens-india-targeting-to-academia-with-reversera skopnix en 2026-09-22T07:52:03.000Z SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing https://skopnix.com/news/CVE-2026-616-ghsa-pxcx-fv34-x9p5-nginx-ignition-has-unauthenticated-admin skopnix en 2026-09-21T21:54:42.000Z GHSA-pxcx-fv34-x9p5: nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition https://skopnix.com/news/CVE-2026-616-ghsa-jr34-h97m-9hpx-nginx-ignition-has-parseacceptlanguage-s skopnix en 2026-09-21T21:49:03.000Z GHSA-jr34-h97m-9hpx: nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Lan https://skopnix.com/news/CVE-2026-727-cisa-adds-cve-2026-7273-zyxel-gs1900-series-switches-to-the skopnix en 2026-09-21T19:43:55.051Z CISA adds CVE-2026-7273 (Zyxel GS1900 Series Switches) to the Known Exploited Vulnerabilities catalog https://skopnix.com/news/CVE-2026-616-ghsa-phg3-3g28-wq9v-hatchet---unauthenticated-oauth-state-cs skopnix en 2026-09-21T15:47:01.000Z GHSA-phg3-3g28-wq9v: Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState https://skopnix.com/news/hefte-AZ-202-weekly-brief-azerbaijan-2026-w39 skopnix en 2026-09-21T13:21:38.282Z Weekly brief — Azerbaijan (2026-W39) https://skopnix.com/news/AZ-2026-W39-weekly-exposure-digest-azerbaijan-2026-w39 skopnix en 2026-09-21T13:21:34.733Z Weekly exposure digest — Azerbaijan (2026-W39) https://skopnix.com/news/c64188f52a80-rathat-android-trojan-uses-ai-for-automation skopnix en 2026-09-21T12:51:41.000Z RatHat Android Trojan Uses AI for Automation https://skopnix.com/news/e8a3b2edefd8-north-koreas-job-interview-scam-runs-both-ways skopnix en 2026-09-21T12:27:05.000Z North Korea’s job interview scam runs both ways https://skopnix.com/news/235c3bfe61f7-crowdsec-confirms-source-code-stolen-in-supply-chain-attack skopnix en 2026-09-21T10:55:46.000Z CrowdSec Confirms Source Code Stolen in Supply Chain Attack https://skopnix.com/news/24ce00a91522-terminalfix-png-steganography-mon-sep-21st skopnix en 2026-09-21T10:33:53.000Z TerminalFix: PNG Steganography, (Mon, Sep 21st) https://skopnix.com/news/63aa8c538632-rustaceans-warned-of-job-interviews-with-a-malicious-payload skopnix en 2026-09-21T10:33:00.000Z Rustaceans warned of job interviews with a malicious payload