CVE-2026-26278

creationtimestamp| type| source ---|---|--- 2026-02-14 06:07:36+00:00| published-proof-of-concept| https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj 2026-02-19 21:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfaihpafsp2n...

MAL-2026-878 Malicious code in magichat (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b999f3f5762dc9bcb0dc2e91ef10116a368aca535d2f07fa2519e8d64bbc0902 The package is prepared to download a hardcoded executable and save it in %LOCALAPPDATA% under a very generic name, clearly aiming to hide its existence. Code ...

CVE-2025-54756

creationtimestamp| type| source ---|---|--- 2026-02-13 08:26:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3meq3hshph42r...

CVE-2025-9293 Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception

A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the...

CVE-2019-25346

TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'servername' parameter. Attackers can inject malicious SQL code like ' or '1=1 to retrieve unauthorized database records and potentially access sensitive system information...

[SECURITY] [DSA 6131-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6131-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 12, 2026 https://www.debian.org/security/faq -...

CVE-2019-25347 thesystem App 1.0 - 'username' SQL Injection

thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parameter. Attackers can inject malicious SQL code like ' or '1=1 to the username field to gain unauthorized access to user accounts...

CVE-2026-26214 Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITM

Galaxy FDS Android SDK XiaoMi/galaxy-fds-sdk-android version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled the default configuration. In GalaxyFDSClientImpl.createHttpClient, the SDK configures Apache HttpClient with SSLSocketFactory.ALLOWALLHOSTNAMEVERIFIER, which accep...

CVE-2026-26214

Galaxy FDS Android SDK XiaoMi/galaxy-fds-sdk-android version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled the default configuration. In GalaxyFDSClientImpl.createHttpClient, the SDK configures Apache HttpClient with SSLSocketFactory.ALLOWALLHOSTNAMEVERIFIER, which accep...

CVE-2025-15573 Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud Connection

The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud mqtt001.solaxcloud.com, TCP 8883. This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to...

CVE-2026-2248

creationtimestamp| type| source ---|---|--- 2026-02-12 08:16:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3menkhfrrrg2x...

Active Directory Attacks Demystified: Pass-the-Hash (PtH), Pass-the-Ticket (PtT), and Beyond

Key Takeaways Active Directory attacks are identified as a significant threat in enterprise environments, with 74% of breaches involving compromised identities according to the Verizon DBIR 2025. Pass-the-Hash PtHattacks facilitate lateral movement by allowing the reuse of stolen NTLM hashes...

CVE-2026-23857

creationtimestamp| type| source ---|---|--- 2026-02-12 07:01:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mengbtwaw22g 2026-02-12 13:00:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/116057783104911228 2026-02-12 13:00:34+00:00| seen|...

CVE-2026-1922

The The Events Calendar Shortcode & Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ecs-list-events shortcode message attribute in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied...

CVE-2025-7659

creationtimestamp| type| source ---|---|--- 2026-02-11 12:21:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3melhodozo327 2026-02-11 13:55:16+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3melmweqeno2j 2026-02-16 07:16:25+00:00| seen| https://t.me/poxek/5...

Exploit for Reliance on Untrusted Inputs in a Security Decision in Microsoft

CVE-2026-21509 Mitigation Script Traditional Chinese version:...

PT-2026-7685

SpotDialup 1.6.7 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Name' field to trigger an application crash...

PT-2026-7692

Backup Key Recovery 2.2.5 contains a denial of service vulnerability that allows attackers to crash the application by supplying an overly long registration key. Attackers can generate a 1000-character payload file and paste it into the registration key field to trigger an application crash...

CVE-2025-22453

creationtimestamp| type| source ---|---|--- 2026-02-10 17:59:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mejk4uq73l2v...

CVE-2026-21257

creationtimestamp| type| source ---|---|--- 2026-02-10 17:30:28+00:00| seen| https://www.thezdi.com/blog/2026/2/10/the-february-2026-security-update-review 2026-02-10 18:07:16+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0056 2026-02-12 12:29:03+00:00| seen|...