Aggregator

HackerOne Data Breach – Employees Data Stolen Following Navia Hack

Cyber Security News
2 months 2 weeks ago

HackerOne recently disclosed a data breach affecting 287 of its employees following a cyberattack on its U.S. benefits administrator, Navia Benefit Solutions. The breach stemmed from a Broken Object Level Authorization (BOLA) vulnerability in Navia’s API, which exposed the sensitive personal and health information of approximately 2.7 million individuals nationwide. An unknown threat actor exploited […]

The post HackerOne Data Breach – Employees Data Stolen Following Navia Hack appeared first on Cyber Security News.

Guru Baran

Qilin

Dark Feed IO
2 months 2 weeks ago

You must login to view this content

cohenido

CVE-2026-33161 | Craft CMS up to 4.17.7/5.9.13 Endpoint information disclosure

VulDB Recent Entries
2 months 2 weeks ago
A vulnerability classified as problematic has been found in Craft CMS up to 4.17.7/5.9.13. This affects an unknown part of the component Endpoint. Performing a manipulation results in information disclosure. This vulnerability is reported as CVE-2026-33161. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.
vuldb.com

CVE-2026-33340 | ParisNeo lollms-webui up to 8c5dcef63d847bb3d027ec74915d8fe4afd3014e Web User Interface missing authentication (GHSA-mcwr-5469-pxj4)

VulDB Recent Entries
2 months 2 weeks ago
A vulnerability described as critical has been identified in ParisNeo lollms-webui up to 8c5dcef63d847bb3d027ec74915d8fe4afd3014e. Affected by this issue is some unknown functionality of the component Web User Interface. Such manipulation leads to missing authentication. This vulnerability is documented as CVE-2026-33340. The attack can be executed remotely. There is not any exploit available.
vuldb.com

CVE-2026-33162 | Craft CMS up to 5.9.13 move-to-section improper authorization

VulDB Recent Entries
2 months 2 weeks ago
A vulnerability labeled as critical has been found in Craft CMS up to 5.9.13. Affected is an unknown function of the file /actions/entries/move-to-section. The manipulation results in improper authorization. This vulnerability is cataloged as CVE-2026-33162. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.
vuldb.com

CVE-2025-11571 | Silabs Simplicity Installer tool for Simplicity Studio v6 os command injection (EUVD-2025-208962)

VulDB Recent Entries
2 months 2 weeks ago
A vulnerability was found in Silabs Simplicity Studio v5 and Simplicity Installer tool for Simplicity Studio v6. It has been rated as critical. The impacted element is an unknown function. Performing a manipulation results in os command injection. This vulnerability is identified as CVE-2025-11571. The attack can be initiated remotely. There is not any exploit available.
vuldb.com

CVE-2026-33157 | Craft CMS up to 5.9.12 cleanseConfig fieldLayouts externally-controlled input to select classes or code

VulDB Recent Entries
2 months 2 weeks ago
A vulnerability was found in Craft CMS up to 5.9.12. It has been declared as problematic. The affected element is the function cleanseConfig. Such manipulation of the argument fieldLayouts leads to use of externally-controlled input to select classes or code. This vulnerability is referenced as CVE-2026-33157. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2026-32854 | LibVNC Server up to 0.9.15 HTTP Proxy httpd.c httpProcessInput null pointer dereference

VulDB Recent Entries
2 months 2 weeks ago
A vulnerability was found in LibVNC Server up to 0.9.15. It has been classified as problematic. Impacted is the function httpProcessInput of the file httpd.c of the component HTTP Proxy Handler. This manipulation causes null pointer dereference. The identification of this vulnerability is CVE-2026-32854. It is possible to initiate the attack remotely. There is no exploit available. To fix this issue, it is recommended to deploy a patch.
vuldb.com

CVE-2026-32853 | LibVNC Server up to 0.9.15 HandleUltraZipBPP out-of-bounds

VulDB Recent Entries
2 months 2 weeks ago
A vulnerability was found in LibVNC Server up to 0.9.15 and classified as critical. This issue affects the function HandleUltraZipBPP of the component VNC Handler. The manipulation results in out-of-bounds read. This vulnerability was named CVE-2026-32853. The attack may be performed from remote. There is no available exploit. A patch should be applied to remediate this issue.
vuldb.com

CVE-2026-23269 | Linux Kernel up to 6.12.76/6.18.17/6.19.7/7.0-rc3 apparmor aa_dfa_next out-of-bounds (EUVD-2026-12912 / Nessus ID 303009)

Vuldb Updates
2 months 2 weeks ago
A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.12.76/6.18.17/6.19.7/7.0-rc3. Impacted is the function aa_dfa_next of the component apparmor. The manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2026-23269. The attack can only be performed from the local network. There is not any exploit available. It is advisable to upgrade the affected component.
vuldb.com

CVE-2026-26948 | Dell Integrated Remote Access Controller up to 7.00.00.174/7.10.90.00 exposure of sensitive system information due to uncleared debug information (dsa-2026-113 / Nessus ID 303190)

Vuldb Updates
2 months 2 weeks ago
A vulnerability classified as problematic was found in Dell Integrated Remote Access Controller up to 7.00.00.174/7.10.90.00. Affected by this vulnerability is an unknown functionality. The manipulation results in exposure of sensitive system information due to uncleared debug information. This vulnerability is reported as CVE-2026-26948. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.
vuldb.com

CVE-2026-26945 | Dell Integrated Remote Access Controller up to 1.20.25.00/7.00.00.181/7.20.10.50 process control (dsa-2026-113)

Vuldb Updates
2 months 2 weeks ago
A vulnerability, which was classified as problematic, was found in Dell Integrated Remote Access Controller up to 1.20.25.00/7.00.00.181/7.20.10.50. This affects an unknown part. Such manipulation leads to process control. This vulnerability is traded as CVE-2026-26945. Access to the local network is required for this attack to succeed. There is no exploit available. You should upgrade the affected component.
vuldb.com

CVE-2026-27135 | nghttp2 up to 1.68.0 HTTP/2 nghttp2_session_terminate_session assertion (GHSA-6933-cjhr-5qg6 / EUVD-2026-12919)

Vuldb Updates
2 months 2 weeks ago
A vulnerability identified as problematic has been detected in nghttp2 up to 1.68.0. This impacts the function nghttp2_session_terminate_session of the component HTTP2 Handler. Performing a manipulation results in reachable assertion. This vulnerability is identified as CVE-2026-27135. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.
vuldb.com

CVE-2026-23270 | Linux Kernel up to 6.12.76/6.18.17/6.19.7/7.0-rc2 sched act_ct use after free (EUVD-2026-12913 / WID-SEC-2026-0790)

Vuldb Updates
2 months 2 weeks ago
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.12.76/6.18.17/6.19.7/7.0-rc2. The affected element is the function act_ct of the component sched. Performing a manipulation results in use after free. This vulnerability is known as CVE-2026-23270. Access to the local network is required for this attack. No exploit is available. It is advisable to upgrade the affected component.
vuldb.com

CVE-2026-23268 | Linux Kernel up to 6.12.76/6.18.17/6.19.7/7.0-rc3 Apparmorfs Interface permission (EUVD-2026-12910 / Nessus ID 303000)

Vuldb Updates
2 months 2 weeks ago
A vulnerability described as critical has been identified in Linux Kernel up to 6.12.76/6.18.17/6.19.7/7.0-rc3. This impacts an unknown function of the component Apparmorfs Interface. Executing a manipulation can lead to permission issues. This vulnerability is registered as CVE-2026-23268. The attack needs to be launched locally. No exploit is available. Upgrading the affected component is recommended.
vuldb.com

Managed ad