241 matches found
Astra Linux – Vulnerability in Chromium
Before version 94.0.4606.61, using "use after free" in Portals within Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page...
PT-2026-104431
FileRise Pro client portal leaks the folder path, the client email, and the upload policy. No session!! CVE-2026-104110: Sink is /api/pro/portals/get.php. Portal slug is enough. Internal path plus who the portal belongs to comes back in the response. https://t.co/4YkJ7s9dqf Cybersecurity AI...
Astra Linux – Vulnerability in Chromium
The use of “after free” in Portals in Google Chrome before version 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption through user interactions...
CVE-2026-49464: Authorization Bypass Through User-Controlled Key
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL...
CVE-2026-3096
The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...
EUVD-2026-75731
The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...
CVE-2026-18247
A Cross Site Scripting XSS vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session...
EUVD-2026-56218
A Cross Site Scripting XSS vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session...
CVE-2026-18247 DOM-Based Cross-Site Scripting in BlackBerry AtHoc Web Portals
A Cross Site Scripting XSS vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session...
CVE-2026-18247: Improper Neutralization of Input During Web Page Generation
A Cross Site Scripting XSS vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session...
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
In this article 1. The CaptiveCrunch campaign 2. Storm-2945 and Midnight Blizzard 3. CaptiveCrunch tradecraft and tooling 4. How to protect against CaptiveCrunch activity 5. Microsoft Defender detections and hunting guidance 6. Indicators of compromise Since early May 2026, Microsoft Threat...
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
In this article 1. The CaptiveCrunch campaign 2. Storm-2945 and Midnight Blizzard 3. CaptiveCrunch tradecraft and tooling 4. How to protect against CaptiveCrunch activity 5. Microsoft Defender detections and hunting guidance 6. Indicators of compromise Since early May 2026, Microsoft Threat...
CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the credentials, and accounts were compromised later when an opportunity arose. That model is changing. Recent investigations...
EUVD-2026-47338
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce component: ATG Portals. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attac...
CVE-2026-61129
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce component: ATG Portals. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attac...
CVE-2026-61129: Improper Authentication
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce component: ATG Portals. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attac...
PT-2026-63015
Name of the Vulnerable Software and Affected Versions Oracle Commerce Platform version 11.4.0 Description An issue exists in the ATG Portals component of the Oracle Commerce Platform. An unauthenticated attacker with network access via HTTP can exploit this flaw to compromise the system, which ma...
Vulnerabilities in Palo Alto Networks PAN-OS
Palo Alto Networks has identified several vulnerabilities in the PAN-OS software, particularly in PA-Series and VM-Series firewalls, as well as the Panorama management platform. These vulnerabilities affect various components of PAN-OS. - There are several XSS vulnerabilities in the User-ID...
Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns
Cybersecurity researchers have disclosed details of sustained cyber espionage activity against several Pakistani law enforcement organizations undertaken by suspected China- and India-aligned threat actors between February 2024 and April 2026. "At Balochistan Police, the compromised assets includ...
