CVE-2026-76361 Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../checkconnectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The...

CVE-2026-53549 Termix: Server-Side Request Forgery via Proxy Connectivity Test

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The...

CVE-2026-53549

An authenticated low-privileged user can exploit the unvalidated POST /host/db/proxy/test endpoint to probe internal hosts, metadata services, and cloud credentials; fixed in Termix 2.3.2. No exploitation evidence provided in the documents.

CVE-2026-53549 Termix: Server-Side Request Forgery via Proxy Connectivity Test

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The...

EUVD-2026-62552

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receivestr method...

CVE-2026-76361: Server-Side Request Forgery (SSRF)

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../checkconnectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The...

PT-2026-78788

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Administrator role can perform Server-Side Request Forgery SSRF—a technique where an attacker forces a server to make requests to an unintended location—via the...

EUVD-2026-60543

Mattermost Desktop App versions =6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the...

CVE-2026-75587

Mattermost Desktop App versions =6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the...

CVE-2026-72409

In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resume On Marvell MPIC platforms Armada 370/XP/38x, mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR mvnetapercpuisr calls disablepercpuirq to mask the MPIC per-CPU...

UBUNTU-CVE-2026-72409

In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resume On Marvell MPIC platforms Armada 370/XP/38x, mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR mvnetapercpuisr calls disablepercpuirq to mask the MPIC per-CPU...

CVE-2026-72409

CVE-2026-72409 — Linux kernel mvneta per-CPU interrupt resume issue Affected: Linux kernel running on Marvell MPIC platforms (Armada 370/XP/38x) with mvneta NIC driver.Root cause: During NAPI, the ISR disables the per-CPU interrupt (disable_percpu_irq) and schedules NAPI poll; if suspend occurs b...

CVE-2026-72409 net: mvneta: re-enable percpu interrupt on resume

In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resume On Marvell MPIC platforms Armada 370/XP/38x, mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR mvnetapercpuisr calls disablepercpuirq to mask the MPIC per-CPU...

CVE-2026-72409 net: mvneta: re-enable percpu interrupt on resume

In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resume On Marvell MPIC platforms Armada 370/XP/38x, mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR mvnetapercpuisr calls disablepercpuirq to mask the MPIC per-CPU...

CVE-2026-72409: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resume On Marvell MPIC platforms Armada 370/XP/38x, mvneta uses a percpu IRQ disable/enable scheme for NAPI: the ISR mvnetapercpuisr calls disablepercpuirq to mask the MPIC per-CPU...

CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

Overview Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution RCE against a vulnerable SharePoint server. Today, both Rapid7 and Microsoft ar...

CVE-2026-42537 Apache Ranger: Remote Code Execution via JDBC URL Injection

Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-9192

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators...

CVE-2026-21366 Integer Overflow or Wraparound in Data Network Stack & Connectivity

Memory corruption while processing a packet with a size close to the maximum allowed value...

Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk

A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since January 2025. These targeted...