🕵️ RESEARCH & DEEP DIVES
The administrative password is hashed using a comparatively weak, fast algori... — CVE ThreatInt
An example environment-configuration file for a bundled inventory-management ... — CVE ThreatInt
A prior update that raised a bundled HTTP client library to a version remedia... — CVE ThreatInt
A deployment mode intended to expose only read access to a bundled packet-ana... — CVE ThreatInt
A file-upload handler redirects the authenticated client's browser to a URL t... — CVE ThreatInt
Requests from the reverse proxy to the identity-provider service for token di... — CVE ThreatInt
An example environment-configuration file ships with a fixed, publicly-known ... — CVE ThreatInt
The application's role-authorization lookup defaults to granting access when ... — CVE ThreatInt
When a particular authentication mode is configured, the reverse proxy forwar... — CVE ThreatInt
A deployment mode intended to expose only read access to stored data proxies ... — CVE ThreatInt
A routing rule selects between two different authentication mechanisms for th... — CVE ThreatInt
An application programming interface endpoint accepts a user-supplied value a... — CVE ThreatInt
An interface that accepts file uploads from authenticated users extracts the ... — CVE ThreatInt
A file-transfer interface that requires valid credentials accepts attacker-co... — CVE ThreatInt
A web interface reflects a portion of the request URL into a script context a... — CVE ThreatInt
OpenStack Ironic through 38.0.0 may send a username and password to an unexpe... — CVE ThreatInt
Cross-monitor event media authorization bypass in direct event media endpoint... — CVE ThreatInt
Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team... — CVE ThreatInt
Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve ActionsHo... — CVE ThreatInt
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff ModeH... — CVE ThreatInt
VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index — CERT/CC Vulnerability Notes
Not particularly related to this one, but the new CVE scoring system basically lets vendors set Exploit Maturity for... — @GossiTheDog@cyberplace.social
With this one, spot what happens to the CVSS score if you change Exploit Maturity from Unreported to Not Defined. — @GossiTheDog@cyberplace.social
I've been digging and I think it might be related to this https:// github.com/libexpat/libexpat/p ull/1321. — @GossiTheDog@cyberplace.social
Palo-Alto are calling resellers and asking them to call customers to tell them to update their Palo-Alto PA and VM... — @GossiTheDog@cyberplace.social
How normies How I use AI use AI. — @SwiftOnSecurity@infosec.exchange
GetSimple CMS: Unauthenticated Admin Account Creation (CVE-2026-53952) — thehackerwire.com (discovered)
Xiongmai IP Camera Critical WS-Security Authentication Bypass — thehackerwire.com (discovered)
CRA reporting starts this week. For those doing SOC 2 / NIS2 with containers: is CI scan output actually accepted as evidence, or did the auditor want proof from the cluster? — r/cybersecurity
SSE (Zero Trust) vendor trial — r/cybersecurity