CVE-2026-20358

Cisco Crosswork is affected by externally controlled file system issues (CWE-73), yielding a CVSS 10.0 CRITICAL score with high integrity and availability impact. No affected versions, patch details, or exploitation evidence are provided in the documents. Exploitation status is not available.

CVE-2026-20358 Cisco Crosswork Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

Malicious code in @idanefraim/my-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24017bfaf88f4ffe9c661b8ff489bded977a522bcc9ace9bf7289b11fdf37f84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-20358: External Control of File Name or Path

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

PT-2026-78582

Name of the Vulnerable Software and Affected Versions IBM Power Systems Firmware FW1120.00 IBM Power Systems Firmware versions FW1110.00 through FW1110.30 IBM Power Systems Firmware versions FW1060.00 through FW1060.80 IBM Power Systems Firmware versions FW950.00 through FW950.H2 IBM Power System...

powershell-reverse-tcp v5.0

PowerShell Reverse TCP PowerShell scripts for communicating with a remote host. Remote host will have a full control over the client and all the underlying system commands. Check shells based on: Invoke-Expression PowerShell command here, process pipes here. Tested with PowerShell v5.1.19041.2673...

MAL-2026-14011 Malicious code in shared-slot-gate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 567d0e00a8f67763d2490a1c3bcd2e806e5c02eed7b87c5ba7c082d779d7243e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sui-gql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86abb4ef26b5c61e261c09d96823d64e6bfac2de04c8da1c2be9b738a47a70da The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13817 Malicious code in jhkxcixudnvm1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aecafeb32fc0bc6beb0fcd9f6cab36efa71c8e69dc966271eea55bd03ba8eadf The package contains only package.json and index.html, with index.html declared as main. The HTML imitates a Cloudflare 'Just a moment...' verificati...

CVE-2026-68162

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid authenable sysctl UAF during netns teardown procsctpdoauth updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl-data, so an already opened sysctl file ca...

FileZilla FTP Code Execution

The vulnerability of the FileZilla Client FTP client is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain full control over the system...

Endpoint Manager client program Code Execution Full Control

The vulnerability of the Endpoint Manager client program and the Detection Agent for the UEM system’s centralized management, monitoring, and security solutions, such as LANSCOPE Endpoint Manager On-Premise Edition, is related to insufficient verification of the communication channel source...

thrift: Apache Thrift C++ bindings: Remote code execution via heap-based buffer overflow

A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and...

CVE-2026-55971

A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and...

CVE-2026-12562 Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework TCF service that does not require any...

Toptech Systems RCU II+ and Multiload II+

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to gain full system control and misuse it to access or manipulate connected networks and resources. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain full...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker...

net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

...

CVE-2026-64422

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid net.ipv4.tcpreordering values before they reach TCP socket state. The sysctl is stored as an int but copied into the u32 tp-reordering field for new...