17 casos · pág. 1/1
A vulnerability in Signal's open-source RingRTC calling library, tracked as CVE-2026-113380 (CVSS v4.0 9.3), can stop a call from terminating properly. This can leave audio, and possibly video, channels open after a user hangs up. MITRE published the CVE on October 20, 2026, classified as CWE-754. The affected versions are every RingRTC r…
Cisco disclosed CVE-2026-76505, a High-rated vulnerability in the IPv4 packet processing of Cisco IOS XR Software on Cisco ASR 9000 and 9900 Series routers and ASR 9902/9903 Compact High-Performance Routers. An unauthenticated, remote attacker can send crafted IPv4 packets that trigger network processor (NP) errors, resetting or shutting …
Cisco disclosed CVE-2026-20154, a high-severity vulnerability in the system rate-limiting process for syslog message 419002 in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can cause high CPU utilization on an affected device, r…
Cisco updated its advisory for CVE-2024-20260, a denial-of-service vulnerability in the VPN and management web servers of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The original version covered only the ASAv and FTDv virtual models, but Cisco later found that a…
A denial-of-service vulnerability, CVE-2026-42931, affects the npm endpoint of the Gitea Package Registry. The AddPackageTag function reads the entire HTTP request body into memory with io.ReadAll() before any validation, so a single oversized request can crash the whole Gitea process. Any authenticated user can trigger it against their o…
CERT-FR advisory CERTFR-2026-AVI-1335, published 16 October 2026, reports multiple vulnerabilities in the Linux kernel shipped with SUSE products. Some of them allow an attacker to escalate privileges, cause a remote denial of service and breach data confidentiality. Other listed impacts are data integrity breach and security policy bypas…
The Hakai Security Research Team disclosed CVE-2026-44706, a SQL Injection in Chatwoot versions <= 4.11.1. Any authenticated user with agent privileges, the lowest access level, can read the entire PostgreSQL database. The flaw sits in the FilterService, where user input is interpolated directly into SQL. Exposed data includes bcrypt pass…
CERT-FR advisory CERTFR-2026-AVI-1334, published 16 October 2026, reports multiple vulnerabilities in the Linux kernel shipped with Red Hat Enterprise Linux. Some of them allow a remote attacker to execute arbitrary code, escalate privileges and cause a remote denial of service. Other listed impacts are data integrity and confidentiality …
CERT-FR advisory CERTFR-2026-AVI-1332, published 16 October 2026, reports multiple vulnerabilities in Microsoft products that may allow remote arbitrary code execution, privilege escalation, remote denial of service and breach of data confidentiality. The advisory is based on Microsoft security bulletins dated 15 October 2026 for four CVE…
CERT-FR advisory CERTFR-2026-AVI-1310 reports multiple vulnerabilities in Citrix products, based on Citrix security bulletins dated 13 October 2026. According to the advisory, some flaws allow an attacker to achieve arbitrary code execution, privilege escalation and remote denial of service. Other listed impacts are data integrity and con…
CERT-FR advisory CERTFR-2026-AVI-1316 reports multiple vulnerabilities across Microsoft products, based on Microsoft security bulletins dated 13 October 2026. According to the advisory, some flaws allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. Other listed impacts are data …
Cisco published the NX-OS Software Security Hardening Release: October 2026 advisory (cisco-sa-hardening-nxosw1-cWzSbtR) on 7 October 2026. It covers multiple vulnerabilities found by the Cisco NX-OS engineering team during an internal security review. Cisco rates the security impact as Critical and says the flaws are not known to be acti…
A critical Linux kernel networking flaw, CVE-2026-99999 (nicknamed PwnEscape, CVSS 9.3), lets code inside a guest VM read host memory, crash the host and, in lab conditions, run code on it. Researcher Paulos Yibelo of pwn.ai demonstrated the memory leak against Vercel's production sandboxes, which Vercel confirmed. The flaw was found in a…
CERT-FR advisory CERTFR-2026-AVI-1322, published 15 October 2026, reports multiple vulnerabilities in Juniper Networks products, based on the vendor's October 2026 security bulletins of 14 October (JSA112168 to JSA112250). The flaws affect Junos OS, Junos OS Evolved (including MX and SRX Series) and Juniper Cloud-Native Router. According …
CERT-FR advisory CERTFR-2026-AVI-1313 reports multiple vulnerabilities in Microsoft .NET, ASP.NET Core and .NET Framework, covered by Microsoft's October 13, 2026 security bulletins for 43 CVEs. Some of them allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. The advisory also l…
F5 released NGINX 1.30.6 (stable) and 1.31.7 (mainline) on October 14, 2026 to fix five vulnerabilities. Three are memory-corruption bugs that F5 scores 9.2 (Critical) on CVSS v4.0, and they can crash a worker process or, in some conditions, allow code execution. The others are a TLS session-ticket flaw that can bypass client-certificate …
Researcher Pedro Cruz (Hakai Security / The Hacking Club) disclosed nine vulnerabilities in widely used server-side PDF generation libraries, with a combined footprint of over 90 million monthly installs. The cases range from RCE (ReportLab, ReLaXed) through arbitrary file read and SSRF (WeasyPrint, Browsershot) to DoS and file/directory …
