Skip to content
skopnix
Section C · The archive
Every edition · newest first

The archive.

1,109 dispatchespage 6 / 19№ 809 – 750

  1. Tue 22 Sep 2026

    26 dispatches
    GHSA-9vm9-pqxx-x83v: KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node joinVULN
  2. GHSA-34fc-gh42-pj53: OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing AttackVULN
  3. GHSA-59w7-v8rr-pr4p: OpenBao's Templated Policies Allow Privilege Escalation via Wildcard CharactersVULN
  4. GHSA-m3c6-2p7h-cfr3: KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodesVULN
  5. GHSA-93xw-j965-9mx3: MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()VULN
  6. GHSA-5mj8-gf6m-fhw8: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip HeaderVULN
  7. Check Point warns of Management Server zero-day exploited in attacksEXPL
  8. Unmasking EvilTokens: Getting to the root of device code phishingAPT
  9. EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accountsMALW
  10. GHSA-92cr-jxw4-5wjg: Sync-in Server has a complete 2FA Bypass via POST /api/auth/tokenVULN
  11. GHSA-jjhp-8crj-mppq: @roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file writeVULN
  12. NCSC-2026-0386 [1.01] [H/H] Kwetsbaarheid verholpen in F5 Networks BIG-IP Access Policy ManagerEXPL
  13. New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based SetupsKEV
  14. Recent ZyXEL Switch Vulnerability Exploited by Chinese HackersEXPL
  15. Ransomware: qilin → Columbus InformaticaRANS
  16. New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host MemoryVULN
  17. Malicious B-tree NPM Package Accumulates Millions of DownloadsSUPL
  18. SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the WildKEV
  19. Researchers have spotted a campaign targeting Iranian dissidents in June that tried to deploy the ParsaStealer infostealer on users' devices https:// labs.infoguard.ch/posts/iranopAPT
  20. Public PoC Exposes Critical Veeam Agent Privilege EscalationEXPL
  21. The Closed Quorum: Inside the first reported autonomous AI C2 implantMALW
  22. New Windows Defender zero-day blocks Microsoft antivirus updatesEXPL
  23. Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before RemovalSUPL
  24. CISA orders feds to patch Zyxel flaw exploited for data theftEXPL
  25. Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider SchemeAPT
  26. SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-PhishingAPT

  27. Mon 21 Sep 2026

    15 dispatches
    GHSA-pxcx-fv34-x9p5: nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race ConditionVULN
  28. GHSA-jr34-h97m-9hpx: nginx ignition has ParseAcceptLanguage _ separator bypass that enables ~75x CPU amplificationVULN
  29. CISA adds CVE-2026-7273 (Zyxel GS1900 Series Switches) to the Known Exploited Vulnerabilities catalogKEV
  30. GHSA-phg3-3g28-wq9v: Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthStateVULN
  31. Weekly brief — Azerbaijan (2026-W39)MISC
  32. Weekly exposure digest — Azerbaijan (2026-W39)MISC
  33. RatHat Android Trojan Uses AI for AutomationMALW
  34. North Korea’s job interview scam runs both waysSUPL
  35. CrowdSec Confirms Source Code Stolen in Supply Chain AttackSUPL
  36. TerminalFix: PNG Steganography, (Mon, Sep 21st)APT
  37. Rustaceans warned of job interviews with a malicious payloadSUPL
  38. Colorado Water Utilities Hit by Cyberattacks Targeting OT SystemsBRCH
  39. Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPORANS
  40. From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed PoliciesRSCH
  41. Organizations Warned of 3 Exploited Linux Kernel VulnerabilitiesEXPL

  42. Sun 20 Sep 2026

    3 dispatches
    CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impactingVULN
  43. The Rust team warns of a social engineering campaign targeting core members and owners of popular packages https:// blog.rust-lang.org/2026/09/17/ targeted-attacks/SUPL
  44. Week in review: Cisco patches exploited email gateway 0-day, Revolut breachEXPL

  45. Sat 19 Sep 2026

    6 dispatches
    COGNOSCERE Business Climate Report — 2026-09-19 A perfect-ten severity Cisco vulnerability is already being exploited in the wild — and every network running Identity ServicesVULN
  46. BragJack - $20K in bounty rewards from Anthropic, Perplexity, Google, Microsoft and Opera Using 1 ExtensionVULN
  47. North Korean WaterPlum hackers infected 30,000 devices worldwideAPT
  48. Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained FlawsBRCH
  49. Ransomware: emperador → Cassias MG GovernmentRANS
  50. CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub RepositoriesSUPL

  51. Fri 18 Sep 2026

    10 dispatches
    CISA adds CVE-2025-39682 (Linux Kernel) to the Known Exploited Vulnerabilities catalogKEV
  52. Ransomware: N0n → Inter (Venezuela's largest internet provider)BRCH
  53. GHSA-jgh3-fggc-mcpm: Obot: Server-Side Request Forgery via remote MCP server URLVULN
  54. GHSA-xwmw-prc4-v3cr: Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience ConfusionVULN
  55. GHSA-9jjc-fw8x-fmwx: io.moquette:moquette-broker has a Missing Authorization issueVULN
  56. GHSA-xcw4-53cc-hv32: Mnemosyne has JWT signature verification bypass sync server that allows authentication bypassVULN
  57. CISA adds CVE-2025-39964 (Linux Kernel) to the Known Exploited Vulnerabilities catalogKEV
  58. CISA adds CVE-2026-53266 (Linux Kernel) to the Known Exploited Vulnerabilities catalogKEV
  59. GHSA-vr5f-w35q-98jp: Perses's unvalidated project parameter enables filesystem path traversalVULN
  60. GHSA-4227-9989-jrhx: Perses's missing authorization in datasource proxy allows cross-scope secret disclosureVULN