PT-2026-28133

Name of the Vulnerable Software and Affected Versions Enter Software Iperius Backup versions up to 8.7.3 Description A flaw exists in Enter Software Iperius Backup related to the NTLM2 Handler component, potentially leading to information disclosure. Exploitation is limited to local execution and...

N2W 安全漏洞

N2W is a data backup and recovery software developed by N2W Corporation. Versions of N2W prior to 4.3.2 and 4.4.1 contained security vulnerabilities. These vulnerabilities were due to deceptive vulnerabilities, which could lead to remote code execution and theft of account credentials...

Iperius Backup 安全漏洞

Iperius Backup is a backup tool developed by the Italian company Iperius Backup. Iperius Backup versions 8.7.3 and earlier have a security vulnerability. This vulnerability stems from insecure permissions when the backup service component creates temporary files, which could lead to local attacks...

CVE-2025-32991: Concurrent Execution using Shared Resource with Improper Synchronization

In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution...

What Microsoft's EWS Retirement Means for Your Veeam Backups

Updated September 2026 This article has been revised to reflect: Microsoft's October 1, 2026 enforcement timeline. The introduction of the EWSAllowedAppIDs allow list. The current status of Veeam's transition to Microsoft Graph. Customers who have previously read this article are advised to revie...

PT-2026-27771

Name of the Vulnerable Software and Affected Versions Stackfield Desktop App affected versions not specified Description The Stackfield Desktop App is susceptible to Remote Code Execution RCE due to a path traversal and arbitrary file write condition. This allows an attacker to potentially execut...

Iperius Backup 访问控制错误漏洞

Iperius Backup is a backup tool developed by the Italian company Iperius Backup. Iperius Backup versions 8.7.3 and earlier contained an access control vulnerability, which was caused by improper handling of the NTLM2 Handler component, potentially leading to information leakage...

CVE-2026-4823: Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this vulnerability is an unknown functionality of the component NTLM2 Handler. Executing a manipulation can lead to information disclosure. The attack is restricted to local execution. Attacks of this nature are highl...

PT-2026-27778

Name of the Vulnerable Software and Affected Versions N2WS Backup & Recovery versions prior to 4.4.0 Description A two-step attack against the RESTful API can lead to remote code execution. The attack targets the API, potentially allowing an attacker to execute arbitrary code on the system. The A...

CVE-2026-4822: Creation of Temporary File With Insecure Permissions

A vulnerability was detected in Enter Software Iperius Backup up to 8.7.3. Affected is an unknown function of the file C:\ProgramData\IperiusBackup\Jobs\ of the component Backup Service. Performing a manipulation results in creation of temporary file with insecure permissions. The attack is only...

CVE-2025-32991

In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution...

N2W 安全漏洞

N2W is a data backup and recovery software developed by N2W Corporation. Versions of N2W prior to 4.4.0 contained security vulnerabilities. These vulnerabilities stemmed from a two-step attack targeting RESTful APIs, which could lead to remote code execution...

How to Safely Perform Snapshot Rollback of Veeam Backup for Microsoft 365

Purpose This article provides step-by-step guidance for performing a snapshot rollback of a Veeam Backup for Microsoft 365 deployment in the event of a disaster. Critical Warning Rolling back to a snapshot is a complex and highly risky process that should only be performed in rare disaster...

CVE-2026-23482

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on the temp/ path and does not filter path traversal sequences, allowing unauthorized attackers to read arbitrary files on the server. When scheduled backup tasks...

CVE-2026-23482 Blinko: Unauthorized Arbitrary File Read - /api/file/temp

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on the temp/ path and does not filter path traversal sequences, allowing unauthorized attackers to read arbitrary files on the server. When scheduled backup tasks...

CVE-2026-23482

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on the temp/ path and does not filter path traversal sequences, allowing unauthorized attackers to read arbitrary files on the server. When scheduled backup tasks...

CVE-2026-23482 Blinko: Unauthorized Arbitrary File Read - /api/file/temp

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on the temp/ path and does not filter path traversal sequences, allowing unauthorized attackers to read arbitrary files on the server. When scheduled backup tasks...

CVE-2026-23482

Blinko (AI-powered card note-taking project) before version 1.8.4 exposes a file server endpoint that does not enforce permission checks on the temp/ path and does not filter path traversal sequences. This allows unauthenticated attackers to read arbitrary files on the server. When scheduled back...

Sensitive Information Exposure

Nginx UI is vulnerable to Sensitive Information Exposure. The vulnerability is due to missing authentication on the /api/backup endpoint and exposure of decryption keys in the response header, which allows an attacker to download and decrypt sensitive backup data...

CVE-2026-31850: Plaintext Storage of a Password

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 stores sensitive information, including administrative credentials and WiFi pre-shared keys, in plaintext within exported configuration backup files. These backup files can be obtained through legitimate functionality or other...