CVE-2026-34008 **Privilege Escalation** World-writable crontab path monitored and executed by root-owned process

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...

CVE-2026-98404

A flaw was found in the Linux kernel's VirtIO GPU driver. A local user could exploit this flaw to cause a Denial of Service DoS by triggering a system crash. When user framebuffer creation encounters an error, the driver improperly returns a null value instead of an error code, resulting in a nul...

CVE-2026-44084

The Video Station application is affected by an authorization bypass vulnerability caused by a user-controlled key. This flaw could allow remote attackers to obtain sensitive data . The vulnerability has been remediated in Video Station version 5.8.8 and later . No specific exploits or scanner so...

CVE-2026-44084 Access Code Forgery in Video Station leading to unauthorized media access

An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...

EUVD-2026-101980

An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...

CVE-2026-34014

A vulnerability exists in Download Station due to an incorrect permission assignment for the critical resource ds-move-files.sh, which is both writable and executed as root . A local attacker who has gained an administrator account can exploit this to compromise the security of the system. The vu...

CVE-2026-34014 ds-move-files.sh is writable and executed as root

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...

CVE-2026-26245

A SQL injection vulnerability (CWE-89) exists in the Video Station application within the class_videos.php file's getSmartVideosByOffset function. If a remote attacker obtains a valid user account, they can exploit this flaw to execute unauthorized code or commands . The vulnerability is addresse...

CVE-2026-16437

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI...

CVE-2023-32198

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

CVE-2026-101287 Authentication bypass in Stela by Diaple Networking

Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier userId and the status of the authentication process validSteps in this cookie and relies on these...

EUVD-2026-101949

Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier userId and the status of the authentication process validSteps in this cookie and relies on these...

GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromising the GitHub accounts of about 1,900 users. It...

CVE-2026-16436 An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI...

CVE-2026-16436

Mitsubishi Electric products including GENESIS , GENESIS64 , ICONICS Suite , Hyper Historian , AnalytiX , MobileHMI , IoTWorX , MC Works64 , GENESIS32 , and BizViz are vulnerable to an authentication bypass due to a Weak Password Recovery Mechanism . Specifically, the challenge response used to u...

CVE-2026-102461

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the uniqueItems keyword validation uses an On² pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes...

CVE-2023-32198 Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

EUVD-2023-60719

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

EUVD-2025-211104

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the knownhosts file. This could allow the execution of a man-in-the-middle MitM attack against Fleet. In cas...

CVE-2026-58098

When semop2 blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If...