Skip to content
skopnix
Section C · The archive
Every edition · newest first

The archive.

1,102 dispatchespage 4 / 19№ 922 – 863

  1. Wed 30 Sep 2026

    8 dispatches
    GHSA-m8m8-qj5v-23w3: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectioVULN
  2. GHSA-r4gj-5m52-g5wh: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFVULN
  3. GHSA-c29m-xwm3-cm6r: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)VULN
  4. GHSA-x97p-jq2g-jp4f: Axios: Prototype Pollution Gadget in axios toFormData OptionsVULN
  5. GHSA-3pq3-5fj3-cg6v: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controlsVULN
  6. GHSA-vcvr-r3jv-pc5j: Next.js: Remote Code Execution in next/og ImageResponseVULN
  7. Cisco warns of new SD-WAN zero-day exploited in attacksKEV
  8. South Africa Seeks Help After Cyberattack Targets Air Traffic ControlBRCH

  9. Tue 29 Sep 2026

    9 dispatches
    GHSA-m8vh-jmq9-5rjg: Nest: Remote process termination via a deeply nested microservice message patternVULN
  10. GHSA-hrh2-vp3x-79xf: @xhmikosr/decompress: Path traversal via symlink chainVULN
  11. GHSA-2gc4-cqfq-p2gv: Socket.IO: Engine.IO Protocol Revision Mismatch DoSVULN
  12. GHSA-v53p-9fqp-m79j: Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of serviceVULN
  13. GHSA-9j54-fg26-wv3r: PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validationVULN
  14. GHSA-ffc3-869f-jxw9: PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confVULN
  15. GHSA-9v7f-9g4p-ffgj: PyJWT: PyJWKClient follows redirects when fetching JWKSVULN
  16. GHSA-r6x4-923q-g947: PyJWT BOM BypassVULN
  17. GHSA-8238-w5pm-2374: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)VULN

  18. Mon 28 Sep 2026

    9 dispatches
    GHSA-f67j-2jqw-jpq7: Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPEVULN
  19. Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery PathKEV
  20. Weekly brief — Azerbaijan (2026-W40)MISC
  21. Weekly exposure digest — Azerbaijan (2026-W40)MISC
  22. GHSA-456v-xq2p-r4cj: code-ollama: grep_search Command Injection via Unescaped $() Shell Substitution (CWE-78)VULN
  23. FBI job portals remain offline after ShinyHunters claims breach via PeopleSoft zero-dayAPT
  24. 16-year-old researcher breaks into Microsoft analytics service with access to 17 trillion rows of dataVULN
  25. Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler GatewayEXPL
  26. Ransomware: emperador → Electrolux 2...BRCH

  27. Sun 27 Sep 2026

    8 dispatches
    CISA adds CVE-2026-88772 (Citrix NetScaler) to the Known Exploited Vulnerabilities catalogKEV
  28. Ransomware: Storm → First Secure Bank GroupBRCH
  29. Citrix Confirmed Two New NetScaler Flaws Exploited as Zero-DayEXPL
  30. Fraudsters used AI to impersonate a senior executives and steal €95 million ($108 million) from Fideuram, the private banking arm of Italy’s largest bank Intesa Sanpaolo https://wwBRCH
  31. NCSC-2026-0394 [1.01] [H/H] Kwetsbaarheden verholpen in NetScaler ADC en NetScaler GatewayKEV
  32. Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI VulnerabilityKEV
  33. Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)KEV
  34. CVE-2026-100721: vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver.VULN

  35. Sat 26 Sep 2026

    3 dispatches
    That Reddit rumor about Citrix notifying customers to take Netscaler servers offline because of actively exploited zero-days is apparently real: https://www. reddit.com/r/Citrix/coEXPL
  36. Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted LinkVULN
  37. ShinyHunters Targets Education Sector with Oracle PeopleSoft ExploitKEV

  38. Fri 25 Sep 2026

    16 dispatches
    GHSA-q986-4x7x-gx39: SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email DigestsVULN
  39. GHSA-vj8p-hp9x-gh47: mpp vulnerable to Gas Draining with low gas limitVULN
  40. GHSA-wrvw-254r-wpmv: CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappersVULN
  41. GHSA-j73w-8hfr-4gc9: CliInvoke: Argument Injection in Extensibility Runner FactoryVULN
  42. Kiteworks urges 6-hour server shutdown over potential zero-day attacksEXPL
  43. GHSA-62mm-xwmv-crhg: khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystemVULN
  44. GHSA-29h2-jr22-frmh: OpenZeppelin Confidential Contracts VestingWalletConfidential: a malicious ERC-7984 token is able to extractVULN
  45. Ransomware: metaencryptor → GE Vernova Inc.RANS
  46. Bitget blames North Korea for $387.5M crypto wallet raidBRCH
  47. GHSA-g7vj-c29h-3h5m: FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth providerVULN
  48. Storm-3168: Agentic-driven cloud attacks using compromised service principalsAPT
  49. GHSA-v65j-hff3-753c: Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabledVULN
  50. GHSA-qxg3-46rw-79j8: code16 Sharp vulnerable to stored XSS via iframe srcdoc AttributeVULN
  51. Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend CompromiseAPT
  52. Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the WildEXPL
  53. ‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data ExfiltrationVULN

  54. Thu 24 Sep 2026

    7 dispatches
    GHSA-3c93-f73f-qc9h: social-auth-core: VK App backend accepts unsigned callback data when auth_key is missingVULN
  55. GHSA-r4vp-3vw6-r2x5: Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix oVULN
  56. GHSA-3cj3-hqcr-g934: Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (/browser endpoint)VULN
  57. GHSA-36h5-qg4p-q2qf: zbateson/mail-mime-parser has CRLF header injection via attachment filenameVULN
  58. GHSA-f6v3-2qmr-vfjx: zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIMEVULN
  59. GHSA-jmg2-rcxh-w8q3: @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build MetadataVULN
  60. GHSA-4hq8-gpf5-8p68: Podman: Malformed Image can trick podman run into leaking host environment variables into the containerVULN