Skip to content
skopnix
Section C · The archive
Every edition · newest first

The archive.

1,100 dispatchespage 3 / 19№ 980 – 921

  1. Mon 05 Oct 2026

    4 dispatches
    New Dell System Update flaw lets hackers gain root privilegesVULN
  2. Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware ArrestsEXPL
  3. Belarusian hacktivists spent two years inside Russian healthcare network, researchers sayAPT
  4. Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940)VULN

  5. Sun 04 Oct 2026

    4 dispatches
    CISA adds CVE-2026-88779 (Citrix NetScaler) to the Known Exploited Vulnerabilities catalogKEV
  6. Ransomware: booba team → MorseLife Health System, Inc.RANS
  7. Google Patches Fifth Chrome Zero-Day of 2026: Active Exploit in V8 EngineEXPL
  8. China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM PhishingAPT

  9. Sat 03 Oct 2026

    2 dispatches
    Security Affairs newsletter Round 598 by Pierluigi Paganini – INTERNATIONAL EDITIONVULN
  10. Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 ChannelAPT

  11. Fri 02 Oct 2026

    26 dispatches
    GHSA-x4q3-gcj3-m6cf: gitea-runner: workflow container.options passes host namespaces and capability flags to job container when priVULN
  12. GHSA-gjj5-9665-rwrc: probe-image-size: Quadratic-time Denial of Service in the SVG ParserVULN
  13. GHSA-x8gv-g2g3-65fj: SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)VULN
  14. GHSA-cjcg-cxmh-9wcr: Praxis affected by HTTP/2 BombVULN
  15. GHSA-v2f8-6655-7grj: Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chainSUPL
  16. GHSA-5rmq-chc7-m22f: Vibe-Trading file-read tools expose arbitrary server-readable filesVULN
  17. GHSA-jqmf-mx4f-hfr6: Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRFSUPL
  18. GHSA-9q4r-4842-93vw: Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized windowVULN
  19. GHSA-pqxw-g93w-hj9x: Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure CompromiseVULN
  20. GHSA-62ch-8vmq-8xm7: figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small widthVULN
  21. GHSA-gg6r-gp4c-89hp: Trigger.dev: V1 coordinator default-secret unauth Socket.IOVULN
  22. GHSA-5wf9-h793-w73c: Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacksVULN
  23. GHSA-pp95-gc86-jq6q: Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)VULN
  24. CISA adds CVE-2026-102490 (Zammad GmbH Zammad) to the Known Exploited Vulnerabilities catalogKEV
  25. GHSA-8mcx-5rqc-vhmf: Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree PathsVULN
  26. Frontline Education breach exposes school district employee dataBRCH
  27. GHSA-8w8g-wq8h-fq33: Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protectionsVULN
  28. GHSA-5fqc-mrg8-w798: Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistenceVULN
  29. GHSA-cm62-gvxx-vmxx: Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symliVULN
  30. GHSA-xm28-xvqc-gxxg: Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolutionVULN
  31. CVE-2026-104846: Seroval facilitates JS value stringification, including complex structures beyond JSON.strVULN
  32. CVE-2026-104845: Seroval facilitates JS value stringification, including complex structures beyond JSON.strVULN
  33. Ransomware: booba team → University of Illinois ChicagoRANS
  34. Chinese spies impersonate White House, Anthropic figures to phish AI policy expertsAPT
  35. Warlock Expands SharePoint Exploitation in Critical Infrastructure AttacksAPT
  36. NCSC-2026-0396 [1.00] [H/H] Kwetsbaarheden aangetroffen in ZammadKEV

  37. Thu 01 Oct 2026

    14 dispatches
    CISA adds CVE-2026-104286 (Fortinet FortiMail) to the Known Exploited Vulnerabilities catalogKEV
  38. GHSA-qhwx-74w5-xhxq: vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escapeEXPL
  39. GHSA-h85j-hv3c-qfgq: vm2 exposes host HTTPS credentials and TLS traffic through globalAgentEXPL
  40. GHSA-c48m-32m9-vx93: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host PackageEXPL
  41. GHSA-8686-vhfx-7r3j: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_processEXPL
  42. GHSA-8hr7-r645-pc6w: vm2: NodeVM nesting guard accepts array-shaped require and permits host RCEEXPL
  43. GHSA-647f-g98j-qq25: vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirectionEXPL
  44. GHSA-6w8r-xxw2-g3hx: vm2 allows a sandboxed plugin to execute native code through node:sqliteEXPL
  45. GHSA-46pr-c5wc-xffx: vm2 crypto builtin loads attacker native code through setEngineEXPL
  46. GHSA-27g9-p43v-cw3v: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protectorEXPL
  47. GHSA-98xx-8mx4-x7cm: vm2 NodeVM can replace the host process TLS trust storeEXPL
  48. Cisco Patches Exploited Catalyst SD-WAN Zero-Day VulnerabilityEXPL
  49. AI Agent Chains Zammad Zero-Days To Take Over DIVD Systems in SecondsEXPL
  50. MSP360 RMM Abused in Phishing Campaigns to Deploy ScreenConnectMALW

  51. Wed 30 Sep 2026

    10 dispatches
    GHSA-94p9-xgh2-xp45: virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before useVULN
  52. GHSA-c2m8-h5v5-343r: Tornado: StaticFileHandler follows symlinks outside static root (path traversal)VULN
  53. GHSA-qh8j-hqjv-7m4x: Astro: Malformed port in the Host header can crash the Node adapterVULN
  54. GHSA-g5vv-9gxw-82hx: GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/cVULN
  55. GHSA-239g-whfq-7xj9: GitPython: Repository content can impersonate the git directory, leading to arbitrary code executionSUPL
  56. Ransomware: Eclipse → The Japan TimesBRCH
  57. GHSA-ff3f-86qr-9cv3: Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix ParametersVULN
  58. GHSA-3q6v-r5mr-hxv8: league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-starVULN
  59. GHSA-m8m8-qj5v-23w3: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectioVULN
  60. GHSA-r4gj-5m52-g5wh: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFVULN