China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

The China-linked threat actor known as Jewelbug has been observed carrying out cyber espionage operations targeting governments and militaries, while simultaneously engaging in cryptocurrency fraud. "Both missions are administered from a single control panel, XG-Web , a browser-centric...

PT-2026-72047

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

The vulnerability of Azure cloud services for managing geospatial data with the Microsoft Planetary Computer Pro lies in the lack of authentication for a critical function, allowing attackers to escalate their privileges.

The vulnerability of Azure cloud services for managing geospatial data with the Microsoft Planetary Computer Pro is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

The vulnerability of the SyncFabric cloud service for synchronizing Microsoft Entra Provisioning Service allows a perpetrator to escalate their privileges.

The vulnerability of the SyncFabric cloud service for synchronizing Microsoft Entra Provisioning Services is related to an incorrect limit on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

Cisco Adaptive Security Appliance (ASA) Remote Access SSL VPN DoS (cisco-sa-asaftd-vpn-dos-dzv4mQFF)

According to its self-reported version, the Cisco ASA software is affected by a denial of service vulnerability. A flaw exists due to insufficient error checking when processing HTTP requests. An unauthenticated, remote attacker can exploit this issue, via a crafted HTTP request to the Remote...

Cisco Firewall Threat Defense (FTD) Software Remote Access SSL VPN DoS (cisco-sa-asaftd-vpn-dos-dzv4mQFF)

According to its self-reported version, the Cisco Secure Firewall Threat Defense FTD Software is affected by a denial of service vulnerability. A flaw exists due to insufficient error checking when processing HTTP requests. An unauthenticated, remote attacker can exploit this issue, via a crafted...

CVE-2026-66270: Unrestricted Upload of File with Dangerous Type

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution...

PT-2026-72124

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.7 alpha1 through 2.7.5 Description When using mbedTLS, remote authenticated users can be misidentified because the system ignores the configured X.509 username identity lookup field. X.509 is a standard for public key...

CVE-2026-66271: Unrestricted Upload of File with Dangerous Type

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution...

Apple Security Advisory 08-06-2026-3

Apple Security Advisory 08-06-2026-3 - macOS Sonoma 14.8.9 addresses an authentication bypass issue on Screen Sharing...

CVE-2026-66272: Exposure of Sensitive Information to an Unauthorized Actor

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

MAL-2026-13978 Malicious code in datefmt-util-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts.postinstall = 'node...

CVE-2026-19297

IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts...

CVE-2026-18164

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

CVE-2026-16867 IBM i is Affected By Multiple Vulnerabilities in NetServer

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation...

CVE-2026-16867 IBM i is Affected By Multiple Vulnerabilities in NetServer

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation...

EUVD-2026-58373

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation...

CVE-2026-16867

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation...

CVE-2026-16867

CVE-2026-16867 affects IBM i (versions 7.3–7.6) in the NetServer component. The root cause is improper authentication during NTLM session negotiation (CWE-287), allowing a remote attacker to access server resources with the privileges of an authenticated user. NVD assigns a CVSS 3.1 score of 9.8 ...

CVE-2026-16722

IBM i SQL vulnerability CVE-2026-16722 affects IBM i releases 7.6, 7.5, 7.4, and 7.3 (5770-SS1). A remote authenticated attacker could obtain unauthorized privileges due to improper privilege management. CVSS v3.1 base score 8.8 (High) with network access, low attack complexity, and no user inter...