Source intelligence
425 collected source records. Original advisories and security research.
300 matching sources · Newest published first
Open CVE tracker →Original publisher records, awaiting Egret editorial review. Headlines open the original source; CVE identifiers open the tracker.
Scroll across the table to see all columns.
| Published | Finding / research | Publisher | Identifiers |
|---|---|---|---|
| Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment GHSA: GHSA-56x6-q882-mf27 CVE: CVE-2026-77463 Reported severity: medium Advisory package entry 1: Affected package: github.com/umputun/remark42/backend (go) Affected versions: >= 1.0.0, < 1.16.2 Patched version: 1.16.2 A… |
GitHub Advisory Database | CVE-2026-77463GHSA-56X6-Q882-MF27 |
|
| Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences GHSA: GHSA-q4xm-p75h-h9p3 CVE: CVE-2026-62662 Reported severity: high Advisory package entry 1: Affected package: github.com/pocket-id/pocket-id/backend (go) Affected versions: < 0.0.0-20260622164202-8158452b3730 Patched… |
GitHub Advisory Database | CVE-2026-62662GHSA-Q4XM-P75H-H9P3 |
|
| tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients GHSA: GHSA-h7c4-q426-7jh9 CVE: CVE-2026-76893 Reported severity: medium Advisory package entry 1: Affected package: @tsparticles/mcp-server (npm) Affected versions: < 4.3.2 Patched version: 4.3.2 Advisory description: Su… |
GitHub Advisory Database | CVE-2026-76893GHSA-H7C4-Q426-7JH9 |
|
| VU#188754: FrodoBots EarthRover Mini+ firmware contains multiple vulnerabilities Overview Multiple vulnerabilities in the FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) may allow remote code execution, unauthorized access to onboard sensors, disclosure of sensitive information, and… |
CERT/CC | ||
| VU#385711: PrestaShop debug mode configuration allows PHP code injection Overview PrestaShop's back-office Performance > Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration can submit crafted cookie… |
CERT/CC | ||
| FORGE Lab uses agentic tools to identify memory safety issues in Rust | Microsoft Security Blog Microsoft’s FORGE Lab found several memory safety issues in Rust’s standard library (std and core), including cases where code written entirely in safe Rust can trigger undefined behavior. The research used Hyenas, FORGE… |
Microsoft | ||
| Introducing Claude Fable 5.2 and Claude Mythos 5.2 We’ve upgraded Claude Fable and Claude Mythos—models that are designed to tackle the most daunting technical challenges. Claude Fable 5.2 and Claude Mythos 5.2 show improvements in areas like coding, reasoning, and visio… |
Anthropic | None reported |
|
| FBI agent stole $2.5 million in crypto from hackers under investigation A former FBI agent has pleaded guilty to stealing nearly $2.5 million from the wallets of fraud victims and nation-state hackers under investigation. 37-year-old Patrick Steven Yaroch worked on a national security invest… |
BleepingComputer | None reported |
|
| Hackers exploit SSHole OpenSSH flaw to breach Linux systems Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. Multiple cybersecurity firms have confirmed the attacks, re… |
BleepingComputer | ||
| Russian cloud firm Beget rebuilds from scratch after data wiper attack A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said. On the night of November 1st, the attacker gained access to the management… |
BleepingComputer | None reported |
|
| N-able takes cloud platform offline after 30+ "zero-days" published N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, includin… |
BleepingComputer | None reported |
|
| Почти 1000 коммутаторов Zyxel взломаны через уязвимость, от которой не защищал патч Специалисты компании Binarly выяснили, что июньский патч для коммутаторов Zyxel GS1900 не защищал от эксплоита, который хакеры использовали для взлома почти 1000 устройств. В итоге злоумышленники задействовали в атаках н… |
Xakep | ||
| Microsoft патчит RCE-уязвимость в Windows Paint Разработчики Microsoft подготовили патч для уязвимости CVE-2026-83844, обнаруженной в Windows Paint. Проблема позволяет удаленно выполнить код без аутентификации и каких-либо действий со стороны пользователя. При этом па… |
Xakep | ||
| RCE-уязвимость в ядре WordPress активно эксплуатируют злоумышленники Агентство по кибербезопасности и защите инфраструктуры США (CISA) предупредило, что злоумышленники атакуют уязвимость CVE-2026-119977 в ядре WordPress. Баг позволяет выполнить код без аутентификации во время обновления д… |
Xakep | ||
| Fake GitHub Security Tools Infect Over 2,000 PCs With Malware - Security Affairs Cybersecurity firm Doctor Web has found malware hidden in GitHub projects that look like security tools. The campaign targets blockchain game fans and, more recently, information security professionals. The researchers d… |
Security Affairs | None reported |
|
| QNAP Warns Users as Plex2Shell Flaws Are Used to Hack NAS Devices QNAP urges users to update Plex Media Server through the QNAP App Center after reports that threat actors exploited the Plex2Shell vulnerability chain to compromise NAS devices. “QNAP has received reports from some users… |
Security Affairs | ||
| About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support About the security content of iOS 27.2.1 and iPadOS 27.2.1 This document describes the security content of iOS 27.2.1 and iPadOS 27.2.1. About Apple security updates For our customers' protection, Apple doesn't disclose,… |
Apple Security | ||
| IBM Aspera Faspex Incorrect Authorization Vulnerability CVE-2026-123218 — IBM / Aspera Faspex. IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege esc… |
CISA KEV | ||
| SignalWire FreeSwitch Code Injection Vulnerability CVE-2026-116779 — SignalWire / FreeSwitch. SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution. CISA required … |
CISA KEV | ||
| OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability CVE-2026-123158 — OpenBSD / OpenSSH. OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass. CISA required action: Apply mitigations in accord… |
CISA KEV | ||
| GPUStack Improper Authentication Vulnerability CVE-2026-102895 — GPUStack / GPUStack. GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-ke… |
CISA KEV | ||
| CVE-2026-124498 - Convene Azeus Convene Board Management Portal dummy_launcher.jsp cross site scripting CVE-2026-124498 Convene Azeus Convene Board Management Portal dummy_launcher.jsp cross site scripting Description A vulnerability was determined in Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72. The impacte… |
CVE Feed | ||
| CVE-2026-124499 - Fengoffice Feng Office Translation Tool ToolController.class.php write_translations code injection CVE-2026-124499 Fengoffice Feng Office Translation Tool ToolController.class.php write_translations code injection Description A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This affec… |
CVE Feed | ||
| Attackers Exploit Third-Party Provider to Raid French Bank Crédit Mutuel Arkéa French cooperative bank Crédit Mutuel Arkéa was hit by a cyberattack that let attackers make fraudulent transactions of up to $133 million, forcing it to suspend certain systems. Crédit Mutuel Arkéa is a major French coo… |
Security Affairs | None reported |