Skip to content
skopnix
Every edition · newest first

The archive.

1,109 dispatchespage 11 / 19№ 509 – 450

  1. Tue 08 Sep 2026

    27 dispatches
    NCSC-2026-0349 [1.00] [M/H] Kwetsbaarheden verholpen in Microsoft Exchange serverVULN
  2. GHSA-8mcc-hrx5-hvxc: GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitraryVULN
  3. GHSA-284h-m62q-gf8w: GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. …VULN
  4. NCSC-2026-0347 [1.01] [M/H] Kwetsbaarheden verholpen in Microsoft AzureVULN
  5. GHSA-7833-fr7j-v32q: GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodulesVULN
  6. Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-daysEXPL
  7. GHSA-c4c3-7fpv-j4q5: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContextVULN
  8. GHSA-4r6h-5v86-94p3: LiquidJS: Uncontrolled Resource Consumption in join filter allows template authors to bypass memoryLimitVULN
  9. GHSA-xp7j-h7jc-4w8p: Semaphore U: OS Command InjectionEXPL
  10. GHSA-v684-q882-jgmq: SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowingVULN
  11. GHSA-3gq4-3j92-5w49: NLTK: Corpus Reader Sandbox BypassVULN
  12. GHSA-p4rw-rvv2-7xwr: NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcementVULN
  13. GHSA-x99w-6fgc-pmfw: NLTK: Allowlisted pickle loaders still permit code execution in current sourceVULN
  14. GHSA-97qj-x29f-37w7: NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parsesVULN
  15. GHSA-6ww7-3frv-cqxh: NLTK: pathsec SSRF protection can be bypassed when a proxy is configuredVULN
  16. GHSA-rhp5-r9x4-f5g2: NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code ExecutionVULN
  17. GHSA-f833-7jw8-xwrv: NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)VULN
  18. GHSA-568f-pv23-39p4: NLTK: Stable FrameNet and NKJP readers parse outside-root XMLVULN
  19. GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AIRSCH
  20. “Zero-click” WeChat worm could hijack accounts and spread via a single callEXPL
  21. EU’s 24-Hr Vulnerability Reporting Rules Take Effect Friday, a Year Before the Rest of the Cyber Resilience ActKEV
  22. FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator CredentialsEXPL
  23. Massive Vietnam-Linked APIS Database Exposes Passport and Flight DataBRCH
  24. CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)KEV
  25. ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport ManagerMALW
  26. MikroTik router flaws allow takeover without a passwordVULN
  27. 220 million traveler records exposed in Vietnam-linked APIS leakBRCH

  28. Mon 07 Sep 2026

    19 dispatches
    CVE-2026-86540: knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field inVULN
  29. CVE-2026-86439: knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool argumentsVULN
  30. Condé Nast Data of 32.8 Million Users Offered for Sale After WIRED LeakBRCH
  31. BigBear Microsoft 365 phishing service bypassed MFA at 258 organizationsBRCH
  32. Ransomware: everest → KÖRBERRANS
  33. Weekly brief — Azerbaijan (2026-W37)MISC
  34. Weekly exposure digest — Azerbaijan (2026-W37)MISC
  35. Microsoft security advisory – August 2026 monthly rollup (AV26-804) – Update 4POLI
  36. North Korean Hackers Deploy New Linux Espionage ToolkitAPT
  37. Ransomware: metaencryptor → ST EngineeringRANS
  38. Rhysida Publishes Berlin Government Data After €2m Extortion Demand RefusedRANS
  39. N-able N-central Pre-Auth RCE Flaw Exploited in the WildKEV
  40. Attackers Exploited MikroTik RouterOS Flaws a Day Before Patches ShippedKEV
  41. NCSC-2026-0342 [1.01] [H/H] Kwetsbaarheid verholpen in N-central van N-ableVULN
  42. ConnectWise warns of new ScreenConnect flaw without patchVULN
  43. Attackers use rogue ScreenConnect clients to spread malwareEXPL
  44. Researcher Publishes CrowdStrike Privilege Escalation Zero DayVULN
  45. N-able patches max severity N-central flaw amid ongoing attacksVULN
  46. US Puts $10 Million Bounty on Alleged Iranian Cyber ChiefAPT

  47. Sun 06 Sep 2026

    2 dispatches
    Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without AuthenticationEXPL
  48. Reddit Infostealer AdvertsMALW

  49. Sat 05 Sep 2026

    4 dispatches
    Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online StoresEXPL
  50. Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host CodeVULN
  51. Over 5,400 hacked sites serve ClickFix payloads stored on the blockchainSUPL
  52. Broadcom Patches Critical VMware Workstation and Fusion VM-Escape VulnerabilitiesVULN

  53. Fri 04 Sep 2026

    8 dispatches
    CVE-2026-73749: HPE ArubaOS-CX RCEVULN
  54. Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade FiltersBRCH
  55. Self-hosted Coder: check whether you pulled a registry module on Aug 31. no CVE, so nothing will flag it for youSUPL
  56. CVE-2026-84428: fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header namesVULN
  57. Security Vulnerability in a Voting SystemVULN
  58. Chinese Hackers Use AI Agents in Multi-Country Cyber CampaignAPT
  59. AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate NetworksSUPL
  60. CVE-2026-84504: fastify versions before 5.12.2 treat the object resolved by a successful Ajv asyncVULN