Automated cyber signal feeds.
CVE ID :CVE-2026-29008 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net) that allows a network-adjacent attacker to crash the bootloader by sending a…
CVE ID :CVE-2026-59708 Published : July 7, 2026, 6:38 p.m. | 26 minutes ago Description :The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access…
CVE ID :CVE-2026-59800 Published : July 7, 2026, 6:19 p.m. | 45 minutes ago Description :9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so…
CVE ID :CVE-2026-23698 Published : July 7, 2026, 5:16 p.m. | 1 hour, 48 minutes ago Description :Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP…
CVE ID :CVE-2026-57851 Published : July 7, 2026, 5:16 p.m. | 1 hour, 48 minutes ago Description :MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory…
CVE ID :CVE-2026-13020 Published : July 7, 2026, 5:16 p.m. | 1 hour, 48 minutes ago Description :A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote,…
An Iranian hacking group affiliated with Iran’s Ministry of Intelligence and Security (MOIS) has been wielding a previously undocumented modular command-and-control (C2) framework dubbed Cavern (aka Cav3rn) targeting Israeli organizations. The activity, which has primarily singled out IT providers and…
CVE ID :CVE-2026-48614 Published : July 6, 2026, 6:16 p.m. | 43 minutes ago Description :An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and…
A use-after-free bug in Linux’s KVM hypervisor can be triggered from a guest virtual machine to corrupt the shadow-page state of the host kernel that runs it. Dubbed ‘Januscape’ and tracked as CVE-2026-53359, the flaw sits in the shadow MMU code…
CVE ID :CVE-2026-48316 Published : July 6, 2026, 5:16 p.m. | 1 hour, 44 minutes ago Description :ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of…