Skip to content
skopnix
Every edition · newest first

The archive.

1,109 dispatchespage 10 / 19№ 569 – 510

  1. Thu 10 Sep 2026

    14 dispatches
    Russian e-commerce giant Wildberries says DDoS attack delayed payments to sellersMISC
  2. Attackers call employees’ personal phones to break into Microsoft 365 accountsBRCH
  3. ShinyHunters expose 6.4M in attack on medical supplier McKessonBRCH
  4. Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCEVULN
  5. PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ InstancesEXPL
  6. 4.1 Million Impacted by AdaptHealth Data BreachBRCH
  7. The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRERSCH
  8. NCSC-2026-0365 [1.01] [H/H] Kwetsbaarheden verholpen in Check Point VPN-productenKEV
  9. CISA: WatchGuard RCE flaw now exploited in ransomware attacksEXPL
  10. Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 DaysAPT
  11. Cybercriminals are building phishing pages that exist only inside victims’ browsersMALW
  12. CISA adds CVE-2026-86060 (MikroTik RouterOS) to the Known Exploited Vulnerabilities catalogKEV
  13. CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even thoughKEV
  14. CISA adds CVE-2026-67277 (MikroTik RouterOS) to the Known Exploited Vulnerabilities catalogKEV

  15. Wed 09 Sep 2026

    24 dispatches
    GHSA-cp3j-m783-3ph5: Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspaceVULN
  16. GHSA-g72f-jw3w-mgh7: @openhop/server: Path Traversal in Flow ID File OperationsVULN
  17. GHSA-vv4j-m4vr-f3g6: ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site boundVULN
  18. GHSA-wcjj-9m6g-2fr2: functype-mcp-server: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + DynamicVULN
  19. GHSA-m835-3cm9-rggg: Joker linter executed project-local .jokerd/linter.* files during lintingVULN
  20. GHSA-hxjg-93wc-h8p8: Komari: Management Interface CSRFVULN
  21. GHSA-2r5q-h53f-9rp3: @yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/runVULN
  22. GHSA-fxg7-897c-57mp: Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser ClientsVULN
  23. GHSA-5hx7-j24v-rffj: GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD ToolVULN
  24. Ransomware: thegentlemen → Air CanadaRANS
  25. Chinese espionage groups swarm to exploit triple-link chain of zero-daysEXPL
  26. Passkey-themed social engineering leads to identity and cloud compromiseAPT
  27. Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & WindowsAPT
  28. Active exploitation of Cisco Secure Firewall Management Center vulnerabilitiesEXPL
  29. GHSA-2j8r-3c22-8565: Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution VulnerabilityVULN
  30. Hackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memoryEXPL
  31. ICS Patch Tuesday: Schneider Electric, Siemens Fix Critical FlawsVULN
  32. Untracked Nightmares: The Threats Hiding Behind Commodity InfrastructureMALW
  33. SAP Patches Maximum Severity “Overpass” FlawVULN
  34. New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM accessEXPL
  35. Google warns of new Chrome zero-day bug exploited in attacksEXPL
  36. CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler GatewayKEV
  37. Cisco Secure Firewall Management Center Software Authentication Bypass VulnerabilityKEV
  38. CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RATKEV

  39. Tue 08 Sep 2026

    22 dispatches
    GHSA-2x7j-588g-ccc2: Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a craftedVULN
  40. GHSA-2q42-4q24-7rgv: OpenAPI3 version value escapes emitterOutputDir and overwrites YAML/JSON outside the output treeVULN
  41. GHSA-wc9g-mqfw-jrwm: multer vulnerable to Denial of Service via crafted multipart field namesVULN
  42. GHSA-65fr-j4p9-vc33: mongodb: Reject "." and NUL bytes in database and collection namesVULN
  43. GHSA-26w7-cxv4-gfx2: Astro: Remote code execution through AVIF image optimizationVULN
  44. GHSA-rvx4-ffvw-m9q3: Composer arbitrary command execution via a malicious package's Perforce source URLVULN
  45. GHSA-rgj7-g3m4-5g8c: sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545VULN
  46. GHSA-2883-xcg3-v3hh: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesVULN
  47. GHSA-j95f-988m-3j2f: Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsingVULN
  48. GHSA-2v4p-qf9q-27wj: gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headersVULN
  49. GHSA-2xp9-vwfh-vxw4: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedVULN
  50. GHSA-c7q8-3ch8-vqpv: xmldom: Processing Instruction Target Injection Bypasses requireWellFormedVULN
  51. GHSA-jxjr-3g7g-3944: xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminatorVULN
  52. GHSA-8344-3jmq-59r6: xmldom: Quadratic-time attribute deduplicationVULN
  53. GHSA-x4fp-j954-r2f4: xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parserVULN
  54. GHSA-965w-775f-mr7g: xmldom: Quadratic-memory consumptionVULN
  55. GHSA-93r5-fhx6-vmg9: xmldom: Quadratic-time parsing via the malformed-input recovery path — parseElementStartPart re-scanVULN
  56. GHSA-6mj3-qw4j-hgrw: xmldom: HTML raw-text closing-tag case mismatch causes output amplificationVULN
  57. GHSA-w6f5-v2h6-g786: Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregateVULN
  58. GHSA-fxf7-vhh8-7vpq: CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriverVULN
  59. Microsoft Patch Tuesday Hits Record 974 CVEs, Two ExploitedKEV
  60. Microsoft releases Windows 10 KB5122878 extended security updateVULN