Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)

Summary createAlertRule and createService and their update siblings accept FailTriggerTasks uint64 and RecoverTriggerTasks uint64 — IDs of cron tasks to fire when the alert/service trips. The validation function only validates the alert's Rules.Ignore server map; it never checks that the cron tas...

GHSA-RXF6-WJH4-JFJ6 Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)

Summary createAlertRule and createService and their update siblings accept FailTriggerTasks uint64 and RecoverTriggerTasks uint64 — IDs of cron tasks to fire when the alert/service trips. The validation function only validates the alert's Rules.Ignore server map; it never checks that the cron tas...

PT-2026-42859

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 1.4.0 through 2.0.7 Description An authenticated user with RoleMember privileges can trigger cron tasks belonging to other users, including administrators. This occurs because the system fails to verify the ownership ...

CALIBURN: A Regime-Sensitivity Study of Operationally Calibrated Streaming Intrusion Detection

Streaming network intrusion detection systems must process flows continuously while keeping memory bounded, but most current methods leave alerting threshold selection as a post-hoc tuning problem poorly suited to production. Operators need alerting behaviour specifiable before deployment using...

CVE-2026-40597

creationtimestamp| type| source ---|---|--- 2026-05-22 22:24:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhxykfjqe2i 2026-06-06 11:02:53+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mnmiw2dm4a2l...

CVE-2026-36227

creationtimestamp| type| source ---|---|--- 2026-05-22 15:00:15+00:00| seen| Telegram/dTfSHcoUcJaeOuFARbGp4aQ01psDVJQvBc7YPH7AO1ZEIM0...

PT-2026-42732

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.4 Description Sandbox escape flaws in NodeVM allow unauthenticated remote code execution on the host server. The issue occurs because the dangerous builtin denylist in lib/builtin.js misses process and...

CVE-2026-45659

creationtimestamp| type| source ---|---|--- 2026-05-21 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1886 2026-05-22 13:10:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmgz25nmtv2h 2026-05-22 23:22:57+00:00| seen|...

CVE-2026-42827

creationtimestamp| type| source ---|---|--- 2026-05-21 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1886...

CVE-2026-23652

creationtimestamp| type| source ---|---|--- 2026-05-21 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1886 2026-05-23 03:11:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmii2olzgn2i 2026-05-23 06:06:34+00:00| seen|...

CVE-2026-41090

creationtimestamp| type| source ---|---|--- 2026-05-21 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1886 2026-05-23 04:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mmimhgj3wo2p 2026-05-23 11:02:36+00:00| seen|...

CVE-2026-23663

creationtimestamp| type| source ---|---|--- 2026-05-21 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1886...

CVE-2026-39531

creationtimestamp| type| source ---|---|--- 2026-05-21 17:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmevh22lgg2l...

CVE-2026-44061

creationtimestamp| type| source ---|---|--- 2026-05-21 10:33:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mme7t5fs622e 2026-06-01 00:01:26+00:00| seen| https://bsky.app/profile/slackers.it/post/3mn6rmo4sw523...

BELL-CVE-2026-43340

Bulletin has no description...

CVE-2026-9121

creationtimestamp| type| source ---|---|--- 2026-05-20 22:34:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcxndoehv2p 2026-05-21 18:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmez5wdurf25 2026-05-25 18:00:00+00:00| seen|...

CVE-2026-9144 Taiko AG1000-01A Rev 7.3/8 Stored XSS via Web Configuration Interface

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allows authenticated attackers to execute persistent JavaScript by fragmenting malicious payloads across multiple administrative form fields...

CVE-2026-5946

creationtimestamp| type| source ---|---|--- 2026-05-20 07:42:48+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-per-isc-bind-5 2026-05-20 10:23:00+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/isc-bind-security-advisory-av26-490 2026-05-20 14:24:10+00:00| seen|...

SOC-Alert-Investigation-Portfolio

SOC Alert Investigation Portfolio This repository contains pr...

CVE-2026-9141: Missing Authentication for Critical Function

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface that allows unauthenticated attackers to access internal application pages without any session management or server-side authentication checks. Attacker...