Blackash-CVE-2025-20343

🔒 CVE-2025-20343: Cisco ISE RADIUS抑制 DoS脆弱性 🌐 ⚠️ 概要 🚨 Cisco Identity Services Engine ISE における高深刻度 のサービス拒否 DoS 脆弱性！ 💥 認証されていないリモート攻撃者 が、細工したRADIUSパケットでデバイスをクラッシュ させる可能性があります。 📅 公開日 : 2025年11月5日 ✅ 実環境での悪用は確認されていません （今のところ） 🛠️ 仕組み 🔄 「Reject RADIUS requests from clients with repeated failures」...

CVE-2026-97176

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how...

CVE-2026-97176

A logic error in the Level of Authentication enforcement mechanism of Keycloak , an identity and access management solution, allows users to bypass security requirements. When a client requests a higher security level for a user with an active session at a lower level, Keycloak may incorrectly is...

EUVD-2026-85792

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how...

CVE-2026-97176

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how...

CVE-2026-82406 Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the...

EUVD-2026-85180

A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache Sling Security Bundle: before 1.3.12. Users are recommended to upgrade to version 1.3.12, which fixes the issue...

UBUNTU-CVE-2026-87080

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libxml2 (UTSA-2025-002241)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002241 advisory. An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors...

Linux Distros Unpatched Vulnerability : CVE-2026-87080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Per...

CVE-2026-87080

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

CVE-2025-26465

CVE-2025-26465 OpenSSHクライアントは、バージョン6.8p1から9.9p1（両端を含む）の間に論理エラーが存在し、VerifyHostKeyDNSオプションが有効な場合にアクティブな中間者攻撃（MitM）に対して脆弱になります。これにより、悪意のある第三者がクライアントの接続試行時に正規のサーバーになりすますことが可能になります。 この検出方法はどのように機能しますか？ このテンプレートは、以下の脆弱性のあるバージョンにマッチします： root@kitploit: - "SSH-2.0-OpenSSH6.8p1" - "SSH-2.0-OpenSSH6.9p1" -...

CVE-2026-55179 Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking...

CVE-2026-55179 Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking...

CVE-2026-55179

Joplin Server (the self-hosted component of the open-source note-taking app Joplin) contains an authorization flaw in its GET /items/:id/content route (defined in packages/server/src/routes/index/items.ts). Prior to version 3.7.2 , the route loads item content using an attacker-supplied internal ...

CVE-2026-55179 Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking...

K000163345: GnuTLS vulnerability CVE-2026-3832

Security Advisory Description A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol OCSP response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a clien...

CVE-2026-1242: Incorrect Authorization

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

EUVD-2026-83055

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbiddenannotationsregex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating...

CVE-2026-93132

In the Linux kernel, the following vulnerability has been resolved: ACPI: RISC-V: Fix riscvacpiaddprtdep loop handling The loop in riscvacpiaddprtdep includes error conditions that are handled in a dubious - if not outright wrong - way, by continuining the loop which skips and misses the entry...