SiYuan before v3.7.4 affected by 11 authentication, XSS and RCE flaws
SiYuan note app patched 11 flaws including RCE and auth bypass; Evooo1Bot Mirai variant targets edge devices; CVSS 10.0 path traversal disclosed.
In this digest
Security Intel Feed
Cyber Hose
Page 61 of 93
Read digest
Evooo1Bot Mirai Botnet Hijacks Routers as SOCKS5 Relay Nodes
Evooo1Bot exploits internet-facing routers and IoT devices using a chain of known CVEs to build a Mirai-derived Linux botnet with SOCKS5 relays.
Read digestMicrosoft to Make Passkeys Default in Entra ID, Retire SMS MFA
Microsoft will make passkeys the default in Entra ID and retire SMS/voice MFA by 2027. Plus a CVSS 8.8 Templately file-upload-to-RCE flaw.
In this digest
Critical TrueBooker Account Takeover Flaw (CVE-2026-16142)
Two CVSS 9.8 unauthenticated bypass vulnerabilities in TrueBooker and User Profile Builder headline this digest.
In this digest
Paymob for WooCommerce SQL Injection (CVE-2026-15205)
Today's CVE roundup includes a CVSS 8.6 SQL injection in Paymob for WooCommerce and a CVSS 8.1 privilege escalation in Essential Addons for Elementor.
In this digest
Critical Auth Bypass in User Session Synchronizer (CVE-2026-15341)
A CVSS 9.8 authentication bypass in User Session Synchronizer headlines this digest of 12 new CVEs ranging from 6.5 to 9.8.
In this digest
CVE-2026-74243: Quay unauthenticated secscan endpoint flaw
Quay container registry exposes an unauthenticated secscan notification endpoint when PSK is unset, rated CVSS 6.5.
In this digest
Metasploit adds 13 exploit modules, HTTP profiles and ARM shells
Rapid7 adds 13 Metasploit exploit modules targeting WordPress, Joomla, SonicWall and more, plus new HTTP profiles and ARM shell payloads.
In this digest
Hackers accused of €30M bank fraud exploiting service-provider flaw
A €30M bank fraud via a service-provider flaw leads this run, alongside a CVSS 9.8 emlog RCE and multiple high-severity CVEs.
In this digest
Jewelbug Runs Government Espionage and Crypto Fraud From One Panel
Jewelbug blends cyberespionage and crypto fraud via shared infrastructure, plus a CVSS 9.3 CRM flaw and misconfigured Power Pages attacks.
In this digest
Assess Your Exposure
Start with the free Posture Self-Check to see where you stand against the current threat landscape.
Free Posture Self-Check