CVE-2026-24032

A vulnerability has been identified in SINEC NMS All versions V4.0 SP3 with UMC. The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component. This could allow an unauthenticated remote attacker to bypass authentication and gain...

CVE-2026-24032

CVE-2026-24032 affects SINEC NMS prior to version 4.0 SP3 with UMC. The issue is an authentication weakness caused by insufficient validation of user identity in the UMC component, enabling an unauthenticated remote attacker to bypass authentication and gain unauthorized access. Documents do not ...

Schneider Electric Easergy MiCOM Px40 Series

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install physical controls so no unauthorized personnel can access...

Schneider Electric PowerChute Serial Shutdown

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install physical controls so no unauthorized personnel can access...

Schneider Electric Modicon Network Managed Switches

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install physical controls so no unauthorized personnel can access...

EUVD-2026-22120

A vulnerability was identified in HummerRisk up to 1.5.0. This vulnerability affects the function ServerService.addServer of the file ServerService.java of the component Video File Download URL Handler. Such manipulation of the argument streamIp leads to server-side request forgery. It is possibl...

Malicious code in getcardslib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88c984b34b3bacb405ca57d999a20be2a2c4c1b3ad75fa7e60f8d6e814b30ab5 The package getcardslib was found to contain malicious code. Source: ghsa-malware ce7e3143ce06f31e15162fef48924c625caddc3e6cc75c9640b053c38ad2665c An...

PT-2026-40494

Уязвимость программного средства защиты данных посредством резервного копирования PowerProtect Data Domain операционных систем Dell EMC Data Domain Operating System DD OS связана с ошибками при обработке информации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получи...

JetBrains Hub Authentication Bypass

The vulnerability of the JetBrains Hub account management software relates to the ability to bypass authentication through phising techniques. Exploiting this vulnerability allows a malicious actor to circumvent existing security measures remotely...

GitLab Authentication Bypass

The vulnerability of the Git-based software platform for collaborative code development on GitLab relates to exploiting authentication bypass using a user-managed key. Exploiting this vulnerability could allow an intruder, operating remotely, to gain unauthorized access to protected information...

Emby Server Auth Bypass

The vulnerability of the Emby Server, a management and multimedia transmission server, is related to the lack of a password recovery mechanism. Exploiting this vulnerability could allow an attacker to gain full access to the system remotely...

Fortinet FortiSOAR PaaS and Fortinet FortiSOAR on-premise have security vulnerabilities

Fortinet FortiSOAR PaaS and Fortinet FortiSOAR on-premise are security orchestration, automation, and response software developed by Fortinet, a US-based company. Both versions of Fortinet FortiSOAR PaaS and FortiSOAR on-premise have security vulnerabilities. These vulnerabilities stem from stori...

PT-2026-114737

Уязвимость компонента DeviceBoundSessionCredentials веб-браузеров Google Chrome и Microsoft Edge связана с недостаточной проверкой вводимых защищаемой информации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить доступ к защищаемой информации...

PT-2026-114736

Уязвимость компонента HttpsUpgrades веб-браузеров Google Chrome и Microsoft Edge связана с недостатком механизма безопасности защищаемой информации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить доступ к защищаемой информации...

Siemens SINEC NMS data falsification vulnerability

Siemens SINEC NMS is a network management system developed by Siemens in Germany. This system can be used for round-the-clock centralized monitoring, management, and configuration of industrial networks containing tens of thousands of devices, including those related to security applications...

Siemens Industrial Edge Management

SUMMARY Industrial Edge Management contains an authorization bypass vulnerability that could be exploited by an unauthenticated remote attacker to circumvent authentication and to access connected Industrial Edge Devices through the remote connection feature. Siemens has released new versions...

BlueBubbles Plugin Bypass

The vulnerability of the BlueBubbles plugin for the AI agent OpenClaw previously known as ClawdBot or MoltBot is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms remotely...

Important: corosync

Issue Overview: A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol UDP packet. This can lead to an out-of-bounds read, causing a...

VulnCheck KEV: CVE-2026-21262

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network...

EUVD-2026-21744

A vulnerability was detected in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects an unknown function of the component Agent Mode Service. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The...