EUVD-2026-103027

Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload,...

CVE-2026-111605

Jpom versions through 2.11.12 are vulnerable to a cross-workspace authorization bypass in the SshFileController component. This vulnerability allows authenticated users to access SSH hosts belonging to different workspaces by providing unauthorized SSH asset IDs. Attackers with SSH file permissio...

PT-2026-116004

Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload,...

CVE-2026-53542 Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...

CVE-2026-53542

CVE-2026-53542 is a tar option injection vulnerability in Termix , a web-based server management platform, prior to version 2.3.2. The archive creation endpoint in src/backend/ssh/file-manager.ts passes user-selected file basenames to tar without an end-of-options marker (--) and without ensuring...

New P2PInfect Worm Targeting Redis Servers on Linux and Windows Systems

Cybersecurity researchers have uncovered a new cloud targeting, peer-to-peer P2P worm called P2PInfect that targets vulnerable Redis instances for follow-on exploitation. "P2PInfect exploits Redis servers running on both Linux and Windows Operating Systems making it more scalable and potent than...

TREVORspray - A Featureful Round-Robin SOCKS Proxy And Python O365 Sprayer Based On MSOLSpray Which Uses The Microsoft Graph API

TREVORproxy is a SOCKS proxy that round-robins requests through SSH hosts. TREVORspray is a A featureful Python O365 sprayer based on MSOLSpray which uses the Microsoft Graph API By @thetechr0mancer Microsoft is getting better and better about blocking password spraying attacks against O365...