UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

UAT-10147 is a highly capable Chinese-speaking intrusion actor operating a multi-platform post-exploitation ecosystem targeting IIS and Linux servers, combining search engine optimization SEO fraud monetization with advanced persistence and defense evasion techniques. The newly identified SPECTRE...

Johnson Controls Simplex Incident Manager

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials passwords and authentication tokens from system memory, potentially leading to unauthorized access to the application and connected systems. 2. RECOMMENDED...

EUVD-2026-62967

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer REST API could configure a non-secure Hypertext Transfer Protocol HTTP Event Collector endpoint in Splunk Enterprise that causes the connector to send...

EUVD-2026-62969

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...

EUVD-2026-62940

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more...

EUVD-2026-62908

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute attacker-chosen Structured Query Language SQL queries through the Data Orchestration jobs endpoint, allowing for access to substantially all data stor...

EUVD-2026-63127

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could cause an authenticated user to run arbitrary Search Processing Language SPL searches on their behalf through the Event Type Builder. This could expose all relevant data and stored credentials. Th...

EUVD-2026-63105

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could run arbitrary Search Processing Language SPL commands with the highest level of system privilege and read every credential stored in the credential store, whic...

EUVD-2026-63112

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the restpropertiesget capability could read encrypted stored credentials through the Representational State Transfer REST API. Successful exploitation can expose relevant data protected by the...

PT-2026-78929

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.34.1 Description A credential validation bypass exists in the MCP create workflow from code tool when the authentication type is configured as an expression. An attacker possessing a valid MCP Bearer API key and a targe...

The vulnerability of the pgcrypto module in the PostgreSQL database management system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the pgcrypto module in the PostgreSQL database management system is related to the unencrypted storage of user credentials. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Debian dsa-6453 : libgit2-1.9 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6453 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6453-1 [email protected] https://www.debian.org/securit...

PT-2026-78936

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.34.1 Description A bypass of the allowed-domains policy exists in the GraphQL node. When the Authentication parameter is configured in expression mode, all authentication-gated credential...

PT-2026-78932

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 Description The GraphQL node fails to properly handle connection-level errors, re-throwing the underlying HTTP client error without wrapping it in the...

PT-2026-80743

Name of the Vulnerable Software and Affected Versions Pipelines-as-Code versions prior to 0.48.0 Description Installations using the GitHub App provider are susceptible to credential exfiltration via the webhook endpoint. The system accepted the X-GitHub-Enterprise-Host request header as the API...

PT-2026-78925

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 Description An SSRF Server-Side Request Forgery protection bypass exists during the OAuth2 credential authorization-code-to-access-token exchange. While...

cve-2026-47848 - MEDIUM - Reactor Netty WebSocket Client Leaks Credentials On Redirect

cve-2026-47848 - MEDIUM - Reactor Netty WebSocket Client Leaks Credentials On Redirect...

PT-2026-79374

Name of the Vulnerable Software and Affected Versions PassPortal browser extension versions prior to 3.49.6 Description An unvalidated postMessage vulnerability in the PassPortal browser extension allows for authentication abuse. This flaw enables any website or iframe viewed by a user to obtain...

CVE-2026-76404

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...

CVE-2026-76402

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer REST API could configure a non-secure Hypertext Transfer Protocol HTTP Event Collector endpoint in Splunk Enterprise that causes the connector to send...