Zip Slip vulnerability in SonicWall Network Security Manager NSM

🕵️ RESEARCH & DEEP DIVES

• Incomplete fix for CVE-2026-75936 memory-amplification denial of service in A... — CVE ThreatInt

• code-projects Online Shopping System adduser.php mysqli_query sql injectionA ... — CVE ThreatInt

• jofpin trape Telemetry Endpoint user.py race conditionA security vulnerabilit... — CVE ThreatInt

• Unverified access point ownership in Amazon EFS CSI DriverUnverified ownershi... — CVE ThreatInt

• jofpin trape user.py authorizationA weakness has been identified in jofpin tr... — CVE ThreatInt

• PassMark PerformanceTest, BurnInTest, and OSForensics Physical Memory Disclos... — CVE ThreatInt

• PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Der... — CVE ThreatInt

• PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary I/O Port Acce... — CVE ThreatInt

• PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation vi... — CVE ThreatInt

• PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Crash via Direct... — CVE ThreatInt

• PassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials ... — CVE ThreatInt

• PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary Bit Clear via... — CVE ThreatInt

• PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control... — CVE ThreatInt

• jofpin trape Admin Endpoint sockets.py join_room missing authenticationA secu... — CVE ThreatInt

• A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-P... — CVE ThreatInt

• A missing authorization vulnerability in the SonicWall Network Security Manag... — CVE ThreatInt

• Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/apiFrappe... — CVE ThreatInt

• jofpin trape Login Endpoint stats.py missing authenticationA vulnerability wa... — CVE ThreatInt

• Nango before 0.71.6 Missing Authentication RCE via runner tRPC serverNango before ... — CVE ThreatInt

• The US government has taken the Xbox, Nintendo and Sega logos and made them into a campaign website called https://... — @GossiTheDog@cyberplace.social

• I'm live! Weekly Update 520: The Unscripted Edition: No agenda, all impromptu, here's what I'm up to, AMA, etc... — @troyhunt@infosec.exchange

• Amazon EFS CSI Driver: Unauthorized Recursive Deletion (CVE-2026-85781) — thehackerwire.com (discovered)

• 153 Million Reasons to Rethink Identity Data Retention — securityboulevard.com (discovered)

• How Differential Privacy Will Transform Enterprise Data Strategy — securityboulevard.com (discovered)

• The Braid: Rethinking Trust, Continuity and Human-AI Systems — securityboulevard.com (discovered)

• Dissecting Attacks Is Only Valuable If It Informs Controls: What the Unit 42 agentic AI investigation should change in your control set, stage by stage. — securityboulevard.com (discovered)

• Why Hiring More Analysts Won’t Solve an Infinite Automation Attack — securityboulevard.com (discovered)

• How Keeper Helps Enforce Zero Standing Privilege — securityboulevard.com (discovered)