Topics /
Cve RSS Feeds
1 feed from 1 site tagged “cve”. Follow one here, or copy its address into any RSS reader.
Follow the whole topic
The newest cve posts from across the directory as one feed, for any reader:
Latest cve posts
CVE-2026-115252: Unknown Confection WordPress Cable (Critical 10.0)
No fix listed. The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP…
CVE-2026-123870: The otterdog webapp evaluates a format-string built from the… (Critical 9.5)
Fix listed. The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an…
One Range header skipped the firmware assignment check: CVE-2026-16454 in Eclipse hawkBit
TL;DR What: In Eclipse hawkBit , the device API's artifact download ran its assignment check only when the request had no Range header. A device that added Range: bytes=0- got the file anyway. The advisory lists 1.0.3 and prior as affected. Impact: per the advisory, any authenticated device could…
CVE-2026-62284: CVE-2026-62284: Remote Code Execution and SSRF via Unsanitized Kubeconfig in OSAC Operator
CVE-2026-62284: Remote Code Execution and SSRF via Unsanitized Kubeconfig in OSAC Operator Vulnerability ID: CVE-2026-62284 CVSS Score: 8.6 Published: 2026-11-06 CVE-2026-62284 (GHSA-5w5g-j6hw-6p8f) is a code injection and server-side request forgery vulnerability in the console-proxy component of…
OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)
An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm Previdian has warned. The flaw (CVE-2026-123158), nicknamed sshole by Wakefield researcher Özgün Kültekin, was fixed in OpenSSH 10.6p2…
Cenovus Energy: Record Discount To WTI Does Not Matter When Commodity Prices Are Strong
Cenovus Energy Inc. (CVE:CA) Q3 2026 Earnings Call Transcript
Matt Corallo Flags Critical Linux Kernel Flaw; Lightning Labs Ships LND Mitigation
Bitcoin Magazine Matt Corallo Flags Critical Linux Kernel Flaw; Lightning Labs Ships LND Mitigation Bitcoin Core and Lightning developer Matt Corallo highlighted CVE-2026-98432 on October 30, a use-after-free in the Linux kernel IPv4 TCP handshake code scored CVSS 9.8. Anthropic’s Frontier Red Team…
Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities
Zero Wire on Cloudflare Radar pairs plain-language briefings with global attack telemetry and remediation steps. Triage critical CVEs faster and decide how to protect your infrastructure.
Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)
Attackers are exploiting an authentication flaw (CVE-2026-58115) in Node-RED, a programming tool built into some industrial control products, to install a Linux bot and backdoors on unprotected servers, VulnCheck has found. Node-RED is a flow-based programming tool built on Node.js that lets users…
AWS Shows Use of AI Agents to Triage Linux Kernel CVEs
Engineers from Amazon Web Services (AWS) have described how the team that maintains the Linux kernel for EC2 infrastructure handles kernel CVEs. The process combines an automated filter, an AI agent and human review. The team also argues that it needs to move to newer long-term-support (LTS)…
Flock can now issue CVEs for its own products. Should we trust it?
Flock joined the CVE Program as a CNA, giving the company authority to assign IDs to vulnerabilities in its own surveillance cameras and license plate readers. The post Flock can now issue CVEs for its own products. Should we trust it? appeared first on CyberScoop .
